Global Airline Company Operationalizes API Security at Scale

Choosing a Solution

The airline conducted an extensive evaluation of API security solutions, ultimately selecting StackHawk for its unique capabilities that aligned perfectly with their needs.

Seamless Integration with Existing Workflows

StackHawk’s deep integrations with GitHub Actions and Jira were game-changers for the airline. The GitHub Actions integration allowed them to embed security testing directly into their CI/CD pipelines and automatically trigger scans on pull requests, giving developers immediate feedback before merging code. With the Jira integration, discovered issues are automatically assigned/routed to the appropriate teams, removing the need for manual handoffs. Both of these integrations have enabled developers to address security issues without disrupting their normal workflows.

Support for Complex Authentication

The airline’s authentication requirements presented significant challenges for most security tools. StackHawk’s flexible authentication handling provided the capabilities needed to properly navigate complex authentication workflows and test their protected APIs.

Shifting Security Left

The ability to integrate security testing early in the development lifecycle was crucial for the airline. StackHawk’s modern design made it possible to run comprehensive security scans during the development and testing phases, not just in production. This shift has enabled developers to find and fix vulnerabilities before production, making security testing part of the development process rather than an afterthought.

Developer Empowerment

Perhaps most importantly, StackHawk’s developer-centric approach resonated with the airlines’ vision for developers to own the dynamic security testing process, allowing them to scale security efforts effectively. StackHawk’s remediation guides, vulnerability overviews, run-time context and developer tools have armed developers with comprehensive and useful information about security findings they need to take action.

Experience with StackHawk

Since implementing StackHawk, the airline has seen tangible improvements in its security posture and development efficiency.

Accelerated Development Cycles

By shifting security left and automating testing, the airline has significantly improved its release velocity without compromising security.

Reduced Security Backlog

The early visibility into vulnerabilities provided by StackHawk has dramatically reduced the airline’s backlog of security tickets. Instead of handing developers external penetration reports long after they’ve moved on from the code, developers now catch issues sooner—when fixes are simpler and less costly.

A Culture Shift

The most significant impact has been on the airline’s security culture. They have experienced a fundamental shift in how their teams approach security: Developers now have ownership and visibility into security testing, allowing them to think about potential vulnerabilities earlier and design more secure systems from the start.