Lessons from Hagerty: scaling AppSec without becoming the bottleneck. Casey Cline | May 5, 2026 Scaling to 40+ teams in two quarters. Hagerty chose StackHawk for its strong documentation, flexibility across environments, developer-friendly design, and ability to simulate real attacks without blocking pipelines. But when John Mercer, DevOps Security Engineer at Hagerty, decided it was time to scale StackHawk across more than 40 developer teams, he faced a common organizational challenge. How do you get leadership and dev buy-in, secure resources, and make sure everyone is up to speed about a new product, all in the course of two quarters? Like most companies, Hagerty's Security team is small compared to its Engineering team. "It's a challenge when Security is only 7 or 8 percent of your whole IT budget, and you are asking them to do something." This is something StackHawk Inc. hear time and time again at StackHawk. It's why StackHawk Inc. emphasize that shifting AppSec left requires distributed ownership. In John's words, "One person can't go through 20, 30, 40, 100 teams... You have to distribute it." As Hagerty's Customer Success Manager here at StackHawk, I had a front-row seat to the rollout. John's approach was genuinely impressive, and I knew other customers could learn from it. John and I sat down for a conversation, and these are the lessons I came away with. AppSec at scale is a coordination effort. "The trouble isn't really technical... It's bureaucratic. It's a project management problem." I asked John why he chose to roll out to 40 teams at once, rather than implement one team at a time. His answer was very direct: "Because that approach could take literally five years. Why not knock it out all at once and make it a company-wide standard?" John leveraged Hagerty's "awesome project managers," who prioritized the StackHawk work, assigned deadlines, and fit implementation into an upcoming sprint. As John put it, "The real challenge wasn't technical, and it wasn't the devs. It's an easy product to implement. It was a project management problem." Once he had the project managers on board, things moved quickly. Not every customer has a dedicated project management team, but in many cases, all it takes is one person willing to own the implementation and prioritize it. Leadership alignment is necessary but not sufficient alone. One thing that became clear throughout Hagerty's rollout is that leadership alignment, while important, isn't the hardest part. In John's experience, getting buy-in at the CIO or CISO level was relatively straightforward. Leadership at Hagerty understands how important AppSec is. Where things became more complex was in translating that priority into actual work across teams. Even with clear top-down direction, the real effort was in scheduling, prioritizing, and completing the work within existing sprint cycles. The challenge wasn't convincing people of the importance; it was operationalizing it. Pattern-Based rollouts work. Before rolling StackHawk out to the entire Hagerty organization, John did a deep dive into its product, set up and configured initial scans, and then optimized them. I teased him that, at this point, he is such a StackHawk SME that he could be on its payroll. That upfront investment made it easy to take the approach StackHawk Inc. often recommend to larger organizations: templatize and repeat. In John's own words, "Once there's a pattern, you can simply copy it with very little additional work needed." Specifically, he did upfront work across multiple stacks (.NET, Python, Node) and then reused it for a comprehensive yet scalable approach. Communicate the value to developers. John focused on communicating the value of StackHawk in a way that would resonate with developers and address their concerns up front. "I always led with 'StackHawk mimics a real-world attack.' Then I reassured them that I will never block them with StackHawk. It'll only add like five minutes to their pipeline, and then they're covered. They were good with that." Leverage existing goodwill. At Hagerty, Security and Engineering have a strong working relationship, and that wasn't accidental. It's been an intentional, mindful choice grounded in mutual trust and respect. As John said, "We've worked hard to build good relationships with engineers. They know we're not adversarial." That trust paid off during the rollout. Engineers gave the work the benefit of the doubt because they had reason to. AppSec at scale, without the bottleneck. Over roughly two quarters, Hagerty rolled StackHawk out across more than 40 teams without turning security into a bottleneck. The technical pieces (easy implementation, dev-friendly pipeline integration, strong documentation, scans that mimic real attacks) gave John a foundation he could trust. From there, the work that mattered was operational: focusing on repeatable patterns, clear communication, and distributed ownership, they were able to scale AppSec in a way that actually worked for engineers. As John put it, "You have a great tool. You've got great documentation. It's very clear how to implement it in different environments. It's very flexible for all kinds of different scenarios or use cases." Once StackHawk reached developers' hands, adoption followed quickly. For organizations looking to do the same, the takeaway is simple: treat AppSec scale as a coordination effort. Build the pattern, communicate the value, and make it easy for teams to run with it. Read the full customer success story.

StackHawk, an application security company, has appointed Joe Sullivan to its board of directors. Sullivan previously served as chief security officer at Meta, Uber and Cloudflare during critical growth periods. The appointment comes as StackHawk scales operations amid rising demand for security testing that matches AI development velocity. A recent StackHawk survey found 87% of organisations have adopted AI coding assistants like GitHub Copilot, driving code velocity up to 10 times faster. Sullivan cited the paradigm shift created by AI coding tools, noting traditional security approaches cannot handle the accelerated application generation speed. StackHawk's platform combines shift-left runtime testing with attack surface discovery, integrating directly into development workflows. The Boulder-based company recently launched an Alliance & Reseller Programme to expand market reach.

David Geevaratne joins StackHawk as EVP of Sales. David Geevaratne | Feb 27, 2026 David brings 20+ years of IT and cybersecurity sales experience to his role at StackHawk. Learn what brought him here. Why runtime application security? Throughout my career in IT and cybersecurity, I've had a front-row seat to major platform shifts: cloud migration, DevOps, container adoption. Each one reshaped how software gets built and eventually secured. What's happening with AI-assisted development is, without a doubt, the most dramatic yet, with higher stakes for application security than ever. Organizations are reporting an eightfold increase in code output through AI coding assistants. That's not theoretical. It's happening inside every engineering org right now (87% according to its recent survey!). And it has a longer tail impact than the market is paying attention to. The jury might be out as to how secure vs. vulnerable AI-generated code is. But what's not up in the air: more code means more attack surface, more endpoints, and more to test. When security validation doesn't scale at the same rate, the gap compounds fast. And yet, AppSec tools are moving in the wrong direction, trading precision for promises with black-box approaches that can't tell you what's covered and what isn't. Budgets are flat. Teams are stretched. And the CISOs I talk to aren't asking for more tools. They're asking three questions: Can you show me what StackHawk Inc. has? Can you prove it's tested? Can you prove StackHawk Inc. is reducing risk? Answering those takes dynamic testing that is API-first, pipeline-native, and defined as code. Not promises. Proof. Why StackHawk? AI has reset the software lifecycle. Every day is effectively Day 0. You either maintain perpetual visibility and continuously test what's exploitable, or you try to find the needle in the haystack and end up finding it in production. What drew me to StackHawk is that the approach maps to how modern AppSec actually needs to work: shift-left DAST that runs natively in CI/CD and finds real, exploitable vulnerabilities before production. That is the only way to keep up with the pace of AI. On top of that, the product this talented team has built is solving real problems for real customers. Attack surface discovery from source code, so you know what exists before production. Centralized program intelligence so leaders can prove what's working and where risk lives. Most tools are built for one audience. Developer tools that security teams tolerate. Security tools that developers ignore. StackHawk serves the full triangle of influence: practitioners, AppSec leaders, and CISOs. I'm proud to be joining this team, and I'm looking forward to helping organizations understand their real attack surface, demonstrate actual risk reduction, and move as confidently as the AI-powered development teams they protect. About David. David brings 20+ years in cloud-native and cybersecurity sales leadership to StackHawk. Most recently, he served as SVP of Sales at Uptycs, a cloud-native security analytics company. Before that, he held leadership roles at Rapid7 and DivvyCloud (acquired by Rapid7), where he led cloud security go-to-market efforts. Earlier in his career, David co-founded New Signature, a Microsoft cloud services provider later acquired by Cognizant, where he served as President and CRO and helped drive 12 consecutive years of double-digit revenue growth. David has been recognized as a Washington Business Journal Minority Business Leader, a CRN 30 in Their 30s honoree, and a Washington Business Journal Corporate Philanthropy Award recipient for his work at New Signature.