THE CYBER TOOLCHAIN
Top pick for July 2026
One product, chosen from everything that won a weekly Head pick over July 2026. Always a product, never a vendor.
Wiz Defend
Cloud Runtime Security
- Head weeks
- 3/5
- Feature releases
- 3
- Finalists
- 8
The Cyber Toolchain
The month’s pick
Wiz Defend shipped three substantive releases across July.
AI-agent-context-aware runtime detections (malicious symlinks, SSH key writes, severity elevation when an AI agent is the originating process), agentless EDR-like visibility into FortiGate appliances and Redis replication abuse via local log parsing, and the GA of Red Agent — a continuous autonomous pentester that reasons through business logic, validates API and vibe-coded app flaws, and delivers reproduction-ready proofs of execution. No other product in the month combined new detection surface, new autonomous offensive validation, and new runtime context (AI agent awareness) across three consecutive weeks.
The story
Before this month, a few blind spots sat right in your working day. AI coding assistants were running commands on untrusted repos, and you had no clean way to tell when one wrote an SSH key or planted a bad symlink. Appliances like FortiGate firewalls and services like Redis kept their logs on the box, so attacker activity there never reached you. And testing your own APIs and custom apps for logic flaws meant writing scripts by hand.
Wiz Defend closed all three over July. First it added runtime detections that watch for malicious symlinks at clone time and writes to sensitive files, and it raises the severity when an AI coding assistant is the process behind it. Next it brought EDR-like visibility to FortiGate and Redis by parsing local logs that never stream off-box, so you see super-user creation and replication abuse. Then it shipped Red Agent to general availability, an autonomous pentester that reasons through business logic and hands you reproduction-ready proof of real API flaws.
That's why it won. Cloudflare shipped Precursor for session-scoped bot detection, and Keycloak shipped SCIM and an SSF transmitter. Both are solid. But Wiz Defend added detection surface, offensive validation, and AI-agent context across three straight weeks. If you run cloud and own the apps on it, this is your month.
How it won
Five Head weeks in July 2026 put 18 products in their top five. One of them is the month’s pick.
- 1 Dalfox
- 2 trufflehog
- 3 Headscale
- 4 xsrfprobe
- 5 ssh-audit
- 1 Cloudflare
- 2 Keycloak
- 3 Docker Sandboxes
- 4 Wiz Defend
- 5 StepSecurity
- 1 Cloudflare
- 2 Keycloak
- 3 xsrfprobe
- 4 Docker Sandboxes
- 5 ssh-audit
- 1 VulnHunter
- 2 noir
- 3 Pomerium
- 4 Grype
- 5 Wiz Defend
- 1 Wiz Defend
- 2 Intruder
- 3 OpenAI Codex CLI
- 4 tcpreplay
- 5 ConductorOne
The pick Other finalists Numbers are that week’s Head ranking
What you can do with it
- Deploy Red Agent against your APIs and custom apps to get autonomous, logic-driven DAST findings with PoC reproduction steps — no manual test scripting required.
- Enable Secrets Blast Radius to automatically validate whether exposed secrets are live against real third-party SaaS APIs before triaging.
- Turn on AI-agent-context detections to catch malicious symlinks and SSH key writes specifically when the originating process is an AI coding assistant on an untrusted repo.
- Use agentless FortiGate and Redis replication detections to get EDR-like coverage on appliances and services that never stream logs off-box.
Examples from what it shipped
Jul 8
Wiz Defend adds AI coding assistant context-aware detections for symlink and SSH key attacks at clone and write time.
Detects malicious symlinks pointing to sensitive files at git clone time, catching…
Detects malicious symlinks pointing to sensitive files at git clone time, catching GhostApproval-style attacks before AI coding assistant involvement.
Monitors writes to sensitive files (e.g., SSH authorized_keys) at write time…
Monitors writes to sensitive files (e.g., SSH authorized_keys) at write time, triggering alerts regardless of whether the write originates via a symlink.
Adds AI agent context awareness
Adds AI agent context awareness: alerts auto-elevate severity when malicious activity originates from an AI coding assistant process operating on untrusted repositories.
Jul 22
Wiz Agentless Workload Detection gains EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-like visibility into FortiGate appliances, Redis, npm supply chain, and more virtual appliance threats.
Extends Agentless Workload Detection to FortiGate firewalls, collecting and parsing…
Extends Agentless Workload Detection to FortiGate firewalls, collecting and parsing local FortiOS logs not typically streamed to expose attacker activity including super-user account creation and configuration theft.
Adds Cloud Event page visibility for FortiGate authentication logs, enabling real-time…
Adds Cloud Event page visibility for FortiGate authentication logs, enabling real-time monitoring of login activity and admin account changes for agentless EDR customers.
Adds built-in threat detection rules for Redis replication abuse
Adds built-in threat detection rules for Redis replication abuse: Redis suspicious replication target configured, Redis module loaded from unusual path, and Attack Detected and Prevented by Redis.
Enables agentless monitoring of npm package installation logs to detect supply chain…
Enables agentless monitoring of npm package installation logs to detect supply chain compromises such as malicious versions of @asyncapi/specs in real time.
Jul 29
Wiz Defend GA's Red Agent AI pentester with Web API Crawler, logic-driven API DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., and Secrets Blast Radius modules.
Red Agent is now generally available (GA)
Red Agent is now generally available (GA): a continuous, autonomous AI pentester that reasons through business logic to uncover unknown vulnerabilities across custom-built software, vibe-coded applications, and APIs.
New Web API Crawler module
New Web API Crawler module: uses client-side code analysis to map API endpoints, extract and analyze API specifications, and surface hidden or forgotten shadow APIs.
New API DAST Attacker module
New API DAST Attacker module: continuously finds and validates logic-driven exploitable risks — including OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API Top 10 flaws, authorization bypasses, and logic flaws — adapting its strategy in real time and delivering proofs of execution with reproduction steps.
New Secrets Blast Radius module
New Secrets Blast Radius module: validates secrets exposed in public websites, APIs, and code repositories by executing safe checks against third-party SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. provider APIs to confirm exploitability and determine the precise scope of permissions held.