Wiz Code

No entries match these filters. Clear filters

1. changelog Aug 13, 2026 · issue 045

   Wiz Code now inventories developers' personal public GitHub repos, validates secret exploitability via AI Red Agent, and maps full attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. on the Security Graph.

   • Adds automated inventory and correlation of developer identities to their personal public GitHub repositories outside org boundaries, closing the visibility gap where unmanaged secret exposure lives.
   • Enriches secrets found in personal repositories onto the Wiz Security Graph to show the full attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. and blast radius of a compromised credential, including downstream resource access.
   • Introduces exploitability validation via the Wiz Red Agent — an AI-powered attacker that actively tests whether an exposed credential is live and what it can reach, going beyond traditional validity checks.
   • Surfaces identity-attached findings with the exact commit, GitHub user, and email that pushed a secret, enabling immediate owner-assigned remediation without manual investigation.
   • Integrates personal-repo findings into existing remediation workflows including Jira ticket creation, Slack developer notification, and tracked token rotation and revocation.

   5 details in Everything

2. changelog Aug 13, 2026 · issue 007

   Wiz Code now inventories developers' personal public GitHub repos, validates secret exploitability via AI Red Agent, and maps full attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. on the Security Graph.

   • Adds automated inventory and correlation of developer identities to their personal public GitHub repositories outside org boundaries, closing the visibility gap where unmanaged secret exposure lives.
   • Enriches secrets found in personal repositories onto the Wiz Security Graph to show the full attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. and blast radius of a compromised credential, including downstream resource access.
   • Introduces exploitability validation via the Wiz Red Agent — an AI-powered attacker that actively tests whether an exposed credential is live and what it can reach, going beyond traditional validity checks.
   • Surfaces identity-attached findings with the exact commit, GitHub user, and email that pushed a secret, enabling immediate owner-assigned remediation without manual investigation.
   • Integrates personal-repo findings into existing remediation workflows including Jira ticket creation, Slack developer notification, and tracked token rotation and revocation.

   5 details in Everything

3. changelog Jul 30, 2026 · issue 031

   Wiz Code adds AI SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. (Private Preview) and a three-tier agentic scanning system with Atlas deep-analysis and Google CodeMender integration.

   └──▷ HOW TO FIND IT
   Enroll your organization in broad, continuous AI code scanning to catch business logic flaws on every PR without custom configuration.
   📍In the Wiz console, go to Wiz Code settings and join the Wiz AI SAST Private Preview to enable continuous AI scanning within your existing Wiz Code workflows.
   • New Wiz AI SAST (Private Preview): continuous AI-powered first-party code analysis that models application entry points, trust boundaries, and data flows to surface complex business logic flaws missed by pattern-matching scanners.
   • New Wiz Rule-Based SAST (GA): deterministic scanning that automatically blocks known vulnerability patterns, insecure code, and hardcoded secrets before code is merged.
   • Atlas vulnerability research system is being productized as a first-party deep-analysis engine for targeted agentic pentesting of high-value applications and critical code.
   • New orchestration of Google CodeMender as a third-party agentic engine for complementary code analysis and remediation.
   • New open, multi-engine orchestration layer routes analysis across first- and third-party agentic scanning engines, with all findings correlated on the Wiz Security Graph and flowing through existing AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. validation and remediation workflows.

   +1 more show less

   • Wiz Security Graph now connects code findings with runtime, identity, deployment, and attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. context to prioritize which repositories receive deterministic, continuous AI, or deep agentic investigation.

   6 details in Everything

4. changelog Jul 28, 2026 · issue 028

   Wiz introduces Atlas, an autonomous AI SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. system that validates every finding with a working exploit and scans pipelines for Secure by Design compliance.

   • Introduces Atlas, an autonomous AI vulnerability research system that uses specialized agents to map attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources., hunt in parallel, and adversarially validate findings — each confirmed with a dynamically generated, working exploit.
   • Adds AI SAST at scale: Atlas performs continuous, cost-efficient deep code scanning across entire enterprise codebases using a code property graph (CPG) for call- and data-flow–grounded analysis.
   • Adds shift-left tracing that links vulnerabilities discovered in production back to their originating code repository or container image, enabling fixes at the source.
   • Extends pipeline scanning to AI application configurations and model deployments, in addition to container images, software packages, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., to enforce Secure by Design guardrails.

   4 details in Everything