Wiz Defend

No entries match these filters. Clear filters

1. changelog Oct 14, 2026 · issue 109

   Wiz Defend gains Blue Agent for automated threat triage and Red Agent for continuous runtime attack-path mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Wiz Blue Agent, which automatically triages threats that fire in Wiz Defend, generating an investigation summary and severity verdict to reduce MTTA and MTTR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Wiz Red Agent, which continuously analyzes live production environments to map multi-step attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. and prioritize exploitable risk combinations before they are exploited.

   2 details in Everything

2. changelog Sep 15, 2026 · issue 078

   Wiz Defend integrates with Google Security Operations via a Content Pack, bringing Blue Agent analysis, shared data model, and bidirectional sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds the Wiz Content Pack for Google Security Operations, providing out-of-the-box rules, dashboards, search queries, playbooks, and response policies in a single-click install.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds playbooks in Google Security Operations to automatically fetch and display Wiz Blue Agent AI-powered threat analysis directly in Google Security Operations cases.
   • Adds bidirectional real-time sync of status, severity, and comments between Wiz Defend threats and Google Security Operations cases.
   • Enables analysts to investigate Wiz threats directly within Google Security Operations via a shared data model across both platforms.

   4 details in Everything

3. changelog Jul 29, 2026 · issue 2026/07

   Wiz Defend GA's Red Agent AI pentester with Web API Crawler, logic-driven API DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., and Secrets Blast Radius modules.

   • Red Agent is now generally available (GA): a continuous, autonomous AI pentester that reasons through business logic to uncover unknown vulnerabilities across custom-built software, vibe-coded applications, and APIs.
   • New Web API Crawler module: uses client-side code analysis to map API endpoints, extract and analyze API specifications, and surface hidden or forgotten shadow APIs.
   • New API DAST Attacker module: continuously finds and validates logic-driven exploitable risks — including OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API Top 10 flaws, authorization bypasses, and logic flaws — adapting its strategy in real time and delivering proofs of execution with reproduction steps.
   • New Secrets Blast Radius module: validates secrets exposed in public websites, APIs, and code repositories by executing safe checks against third-party SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. provider APIs to confirm exploitability and determine the precise scope of permissions held.
   • Red Agent automatically ingests context from Wiz sources — API schemas, cloud resources, Runtime Sensor, code repositories, and network layers — without manual setup.

   +2 more show less

   • AI Threat Defense launched in partnership with Google, combining Wiz, Mandiant, and Google DeepMind capabilities.
   • Blue Agent introduced: a SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. AI analyst that automates threat detection, triage, and containment workflows.

   7 details in Everything

4. changelog Jul 29, 2026 · issue 029

   Wiz Defend GA's Red Agent AI pentester with Web API Crawler, logic-driven API DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., and Secrets Blast Radius modules.

   • Red Agent is now generally available (GA): a continuous, autonomous AI pentester that reasons through business logic to uncover unknown vulnerabilities across custom-built software, vibe-coded applications, and APIs.
   • New Web API Crawler module: uses client-side code analysis to map API endpoints, extract and analyze API specifications, and surface hidden or forgotten shadow APIs.
   • New API DAST Attacker module: continuously finds and validates logic-driven exploitable risks — including OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API Top 10 flaws, authorization bypasses, and logic flaws — adapting its strategy in real time and delivering proofs of execution with reproduction steps.
   • New Secrets Blast Radius module: validates secrets exposed in public websites, APIs, and code repositories by executing safe checks against third-party SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. provider APIs to confirm exploitability and determine the precise scope of permissions held.
   • Red Agent automatically ingests context from Wiz sources — API schemas, cloud resources, Runtime Sensor, code repositories, and network layers — without manual setup.

   +2 more show less

   • AI Threat Defense launched in partnership with Google, combining Wiz, Mandiant, and Google DeepMind capabilities.
   • Blue Agent introduced: a SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. AI analyst that automates threat detection, triage, and containment workflows.

   7 details in Everything

5. changelog Jul 29, 2026 · issue 005

   Wiz Defend GA's Red Agent AI pentester with Web API Crawler, logic-driven API DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., and Secrets Blast Radius modules.

   • Red Agent is now generally available (GA): a continuous, autonomous AI pentester that reasons through business logic to uncover unknown vulnerabilities across custom-built software, vibe-coded applications, and APIs.
   • New Web API Crawler module: uses client-side code analysis to map API endpoints, extract and analyze API specifications, and surface hidden or forgotten shadow APIs.
   • New API DAST Attacker module: continuously finds and validates logic-driven exploitable risks — including OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API Top 10 flaws, authorization bypasses, and logic flaws — adapting its strategy in real time and delivering proofs of execution with reproduction steps.
   • New Secrets Blast Radius module: validates secrets exposed in public websites, APIs, and code repositories by executing safe checks against third-party SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. provider APIs to confirm exploitability and determine the precise scope of permissions held.
   • Red Agent automatically ingests context from Wiz sources — API schemas, cloud resources, Runtime Sensor, code repositories, and network layers — without manual setup.

   +2 more show less

   • AI Threat Defense launched in partnership with Google, combining Wiz, Mandiant, and Google DeepMind capabilities.
   • Blue Agent introduced: a SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. AI analyst that automates threat detection, triage, and containment workflows.

   7 details in Everything

6. changelog Jul 22, 2026 · issue 2026/07

   Wiz Agentless Workload Detection gains EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-like visibility into FortiGate appliances, Redis, npm supply chain, and more virtual appliance threats.

   └──▷ HOW TO FIND IT
   Hunt for rogue admin account creation on FortiGate devices during active CVE-2026-24858 exploitation — search the Cloud Event page for admin accounts named helpdesk.
   📍In the Wiz console, go to Cloud Events and run the pre-built query to search for creation of an admin named helpdesk on FortiGate devices.
   Detect dangerously permissive FortiGate admin accounts (trusthost 0.0.0.0/0) that allow management access from any IP — a key persistence indicator in documented FortiGate campaigns.
   📍In the Wiz console, go to Cloud Events and run the pre-built event query to search for creation of admin accounts with trusthost set to 0.0.0.0/0 on FortiGate devices.
   • Extends Agentless Workload Detection to FortiGate firewalls, collecting and parsing local FortiOS logs not typically streamed to expose attacker activity including super-user account creation and configuration theft.
   • Adds Cloud Event page visibility for FortiGate authentication logs, enabling real-time monitoring of login activity and admin account changes for agentless EDR customers.
   • Adds built-in threat detection rules for Redis replication abuse: Redis suspicious replication target configured, Redis module loaded from unusual path, and Attack Detected and Prevented by Redis.
   • Enables agentless monitoring of npm package installation logs to detect supply chain compromises such as malicious versions of @asyncapi/specs in real time.
   • Provides agentless visibility into HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. access logs (Nginx, Apache, IIS) to detect webshell deployments, unusual executable access, and exploitation of hosted applications such as WordPress via wp2shell.

   +4 more show less

   • Adds detection coverage for PAN-OS CVE-2026-0257 and CVE-2026-0300 exploitation patterns observed in the wild via agentless log ingestion.
   • Adds detection for BeyondTrust Remote Support CVE-2026-1731 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.9 pre-auth RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.) observed in active exploitation.
   • Adds detection for MongoBleed (CVE-2025-14847), an unauthenticated MongoDB memory leak exploited in the wild, with real-time customer alerting via agentless visibility.
   • Correlates Agentless Workload events with Wiz ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. findings to surface threats like Zabbix instances running from unusual paths with default credentials.

   9 details in Everything

7. changelog Jul 22, 2026 · issue 022

   Wiz Agentless Workload Detection gains EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-like visibility into FortiGate appliances, Redis, npm supply chain, and more virtual appliance threats.

   └──▷ HOW TO FIND IT
   Hunt for rogue admin account creation on FortiGate devices during active CVE-2026-24858 exploitation — search the Cloud Event page for admin accounts named helpdesk.
   📍In the Wiz console, go to Cloud Events and run the pre-built query to search for creation of an admin named helpdesk on FortiGate devices.
   Detect dangerously permissive FortiGate admin accounts (trusthost 0.0.0.0/0) that allow management access from any IP — a key persistence indicator in documented FortiGate campaigns.
   📍In the Wiz console, go to Cloud Events and run the pre-built event query to search for creation of admin accounts with trusthost set to 0.0.0.0/0 on FortiGate devices.
   • Extends Agentless Workload Detection to FortiGate firewalls, collecting and parsing local FortiOS logs not typically streamed to expose attacker activity including super-user account creation and configuration theft.
   • Adds Cloud Event page visibility for FortiGate authentication logs, enabling real-time monitoring of login activity and admin account changes for agentless EDR customers.
   • Adds built-in threat detection rules for Redis replication abuse: Redis suspicious replication target configured, Redis module loaded from unusual path, and Attack Detected and Prevented by Redis.
   • Enables agentless monitoring of npm package installation logs to detect supply chain compromises such as malicious versions of @asyncapi/specs in real time.
   • Provides agentless visibility into HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. access logs (Nginx, Apache, IIS) to detect webshell deployments, unusual executable access, and exploitation of hosted applications such as WordPress via wp2shell.

   +4 more show less

   • Adds detection coverage for PAN-OS CVE-2026-0257 and CVE-2026-0300 exploitation patterns observed in the wild via agentless log ingestion.
   • Adds detection for BeyondTrust Remote Support CVE-2026-1731 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.9 pre-auth RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.) observed in active exploitation.
   • Adds detection for MongoBleed (CVE-2025-14847), an unauthenticated MongoDB memory leak exploited in the wild, with real-time customer alerting via agentless visibility.
   • Correlates Agentless Workload events with Wiz ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. findings to surface threats like Zabbix instances running from unusual paths with default credentials.

   9 details in Everything

8. changelog Jul 22, 2026 · issue 004

   Wiz Agentless Workload Detection gains EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-like visibility into FortiGate appliances, Redis, npm supply chain, and more virtual appliance threats.

   └──▷ HOW TO FIND IT
   Hunt for rogue admin account creation on FortiGate devices during active CVE-2026-24858 exploitation — search the Cloud Event page for admin accounts named helpdesk.
   📍In the Wiz console, go to Cloud Events and run the pre-built query to search for creation of an admin named helpdesk on FortiGate devices.
   Detect dangerously permissive FortiGate admin accounts (trusthost 0.0.0.0/0) that allow management access from any IP — a key persistence indicator in documented FortiGate campaigns.
   📍In the Wiz console, go to Cloud Events and run the pre-built event query to search for creation of admin accounts with trusthost set to 0.0.0.0/0 on FortiGate devices.
   • Extends Agentless Workload Detection to FortiGate firewalls, collecting and parsing local FortiOS logs not typically streamed to expose attacker activity including super-user account creation and configuration theft.
   • Adds Cloud Event page visibility for FortiGate authentication logs, enabling real-time monitoring of login activity and admin account changes for agentless EDR customers.
   • Adds built-in threat detection rules for Redis replication abuse: Redis suspicious replication target configured, Redis module loaded from unusual path, and Attack Detected and Prevented by Redis.
   • Enables agentless monitoring of npm package installation logs to detect supply chain compromises such as malicious versions of @asyncapi/specs in real time.
   • Provides agentless visibility into HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. access logs (Nginx, Apache, IIS) to detect webshell deployments, unusual executable access, and exploitation of hosted applications such as WordPress via wp2shell.

   +4 more show less

   • Adds detection coverage for PAN-OS CVE-2026-0257 and CVE-2026-0300 exploitation patterns observed in the wild via agentless log ingestion.
   • Adds detection for BeyondTrust Remote Support CVE-2026-1731 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.9 pre-auth RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.) observed in active exploitation.
   • Adds detection for MongoBleed (CVE-2025-14847), an unauthenticated MongoDB memory leak exploited in the wild, with real-time customer alerting via agentless visibility.
   • Correlates Agentless Workload events with Wiz ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. findings to surface threats like Zabbix instances running from unusual paths with default credentials.

   9 details in Everything

9. changelog Jul 8, 2026 · issue 2026/07

   Wiz Defend adds AI coding assistant context-aware detections for symlink and SSH key attacks at clone and write time.

   • Detects malicious symlinks pointing to sensitive files at git clone time, catching GhostApproval-style attacks before AI coding assistant involvement.
   • Monitors writes to sensitive files (e.g., SSH authorized_keys) at write time, triggering alerts regardless of whether the write originates via a symlink.
   • Adds AI agent context awareness: alerts auto-elevate severity when malicious activity originates from an AI coding assistant process operating on untrusted repositories.
   • Leverages Wiz Runtime Sensor telemetry to identify active endpoints and their exposure based on inbound network traffic.

   4 details in Everything

10. changelog Jul 8, 2026 · issue 009

    Wiz Defend adds AI coding assistant context-aware detections for symlink and SSH key attacks at clone and write time.

    • Detects malicious symlinks pointing to sensitive files at git clone time, catching GhostApproval-style attacks before AI coding assistant involvement.
    • Monitors writes to sensitive files (e.g., SSH authorized_keys) at write time, triggering alerts regardless of whether the write originates via a symlink.
    • Adds AI agent context awareness: alerts auto-elevate severity when malicious activity originates from an AI coding assistant process operating on untrusted repositories.
    • Leverages Wiz Runtime Sensor telemetry to identify active endpoints and their exposure based on inbound network traffic.

    4 details in Everything

11. changelog Jul 8, 2026 · issue 002

    Wiz Defend adds AI coding assistant context-aware detections for symlink and SSH key attacks at clone and write time.

    • Detects malicious symlinks pointing to sensitive files at git clone time, catching GhostApproval-style attacks before AI coding assistant involvement.
    • Monitors writes to sensitive files (e.g., SSH authorized_keys) at write time, triggering alerts regardless of whether the write originates via a symlink.
    • Adds AI agent context awareness: alerts auto-elevate severity when malicious activity originates from an AI coding assistant process operating on untrusted repositories.
    • Leverages Wiz Runtime Sensor telemetry to identify active endpoints and their exposure based on inbound network traffic.

    4 details in Everything