https://cybertoolchain.io/tools/wiz-defend New releases and features in Wiz Defend, tracked by The Cyber Toolchain. en Wed, 29 Jul 2026 14:00:01 GMT https://www.wiz.io/blog/6-months-google https://www.wiz.io/blog/6-months-google Wed, 29 Jul 2026 14:00:01 GMT Wiz Defend GA's Red Agent AI pentester with Web API Crawler, logic-driven API DAST, and Secrets Blast Radius modules. • Red Agent is now generally available (GA): a continuous, autonomous AI pentester that reasons through business logic to uncover unknown vulnerabilities across custom-built software, vibe-coded applications, and APIs. • New Web API Crawler module: uses client-side code analysis to map API endpoints, extract and analyze API specifications, and surface hidden or forgotten shadow APIs. • New API DAST Attacker module: continuously finds and validates logic-driven exploitable risks — including OWASP API Top 10 flaws, authorization bypasses, and logic flaws — adapting its strategy in real time and delivering proofs of execution with reproduction steps. • New Secrets Blast Radius module: validates secrets exposed in public websites, APIs, and code repositories by executing safe checks against third-party SaaS provider APIs to confirm exploitability and determine the precise scope of permissions held. • Red Agent automatically ingests context from Wiz sources — API schemas, cloud resources, Runtime Sensor, code repositories, and network layers — without manual setup. • AI Threat Defense launched in partnership with Google, combining Wiz, Mandiant, and Google DeepMind capabilities. • Blue Agent introduced: a SecOps AI analyst that automates threat detection, triage, and containment workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wiz-defend https://www.wiz.io/blog/6-months-google https://www.wiz.io/blog/6-months-google Wed, 29 Jul 2026 14:00:01 GMT Wiz Defend GA's Red Agent AI pentester with Web API Crawler, logic-driven API DAST, and Secrets Blast Radius modules. • Red Agent is now generally available (GA): a continuous, autonomous AI pentester that reasons through business logic to uncover unknown vulnerabilities across custom-built software, vibe-coded applications, and APIs. • New Web API Crawler module: uses client-side code analysis to map API endpoints, extract and analyze API specifications, and surface hidden or forgotten shadow APIs. • New API DAST Attacker module: continuously finds and validates logic-driven exploitable risks — including OWASP API Top 10 flaws, authorization bypasses, and logic flaws — adapting its strategy in real time and delivering proofs of execution with reproduction steps. • New Secrets Blast Radius module: validates secrets exposed in public websites, APIs, and code repositories by executing safe checks against third-party SaaS provider APIs to confirm exploitability and determine the precise scope of permissions held. • Red Agent automatically ingests context from Wiz sources — API schemas, cloud resources, Runtime Sensor, code repositories, and network layers — without manual setup. • AI Threat Defense launched in partnership with Google, combining Wiz, Mandiant, and Google DeepMind capabilities. • Blue Agent introduced: a SecOps AI analyst that automates threat detection, triage, and containment workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wiz-defend https://www.wiz.io/blog/6-months-google https://www.wiz.io/blog/6-months-google Wed, 29 Jul 2026 14:00:01 GMT Wiz Defend GA's Red Agent AI pentester with Web API Crawler, logic-driven API DAST, and Secrets Blast Radius modules. • Red Agent is now generally available (GA): a continuous, autonomous AI pentester that reasons through business logic to uncover unknown vulnerabilities across custom-built software, vibe-coded applications, and APIs. • New Web API Crawler module: uses client-side code analysis to map API endpoints, extract and analyze API specifications, and surface hidden or forgotten shadow APIs. • New API DAST Attacker module: continuously finds and validates logic-driven exploitable risks — including OWASP API Top 10 flaws, authorization bypasses, and logic flaws — adapting its strategy in real time and delivering proofs of execution with reproduction steps. • New Secrets Blast Radius module: validates secrets exposed in public websites, APIs, and code repositories by executing safe checks against third-party SaaS provider APIs to confirm exploitability and determine the precise scope of permissions held. • Red Agent automatically ingests context from Wiz sources — API schemas, cloud resources, Runtime Sensor, code repositories, and network layers — without manual setup. • AI Threat Defense launched in partnership with Google, combining Wiz, Mandiant, and Google DeepMind capabilities. • Blue Agent introduced: a SecOps AI analyst that automates threat detection, triage, and containment workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wiz-defend https://www.wiz.io/blog/agentless-threat-hunting-fortigate https://www.wiz.io/blog/agentless-threat-hunting-fortigate Wed, 22 Jul 2026 14:24:50 GMT Wiz Agentless Workload Detection gains EDR-like visibility into FortiGate appliances, Redis, npm supply chain, and more virtual appliance threats. • Extends Agentless Workload Detection to FortiGate firewalls, collecting and parsing local FortiOS logs not typically streamed to expose attacker activity including super-user account creation and configuration theft. • Adds Cloud Event page visibility for FortiGate authentication logs, enabling real-time monitoring of login activity and admin account changes for agentless EDR customers. • Adds built-in threat detection rules for Redis replication abuse: 'Redis suspicious replication target configured', 'Redis module loaded from unusual path', and 'Attack Detected and Prevented by Redis'. • Enables agentless monitoring of npm package installation logs to detect supply chain compromises such as malicious versions of @asyncapi/specs in real time. • Provides agentless visibility into HTTP/HTTPS access logs (Nginx, Apache, IIS) to detect webshell deployments, unusual executable access, and exploitation of hosted applications such as WordPress via wp2shell. • Adds detection coverage for PAN-OS CVE-2026-0257 and CVE-2026-0300 exploitation patterns observed in the wild via agentless log ingestion. • Adds detection for BeyondTrust Remote Support CVE-2026-1731 (CVSS 9.9 pre-auth RCE) observed in active exploitation. • Adds detection for MongoBleed (CVE-2025-14847), an unauthenticated MongoDB memory leak exploited in the wild, with real-time customer alerting via agentless visibility. • Correlates Agentless Workload events with Wiz ASM findings to surface threats like Zabbix instances running from unusual paths with default credentials. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wiz-defend https://www.wiz.io/blog/agentless-threat-hunting-fortigate https://www.wiz.io/blog/agentless-threat-hunting-fortigate Wed, 22 Jul 2026 14:24:50 GMT Wiz Agentless Workload Detection gains EDR-like visibility into FortiGate appliances, Redis, npm supply chain, and more virtual appliance threats. • Extends Agentless Workload Detection to FortiGate firewalls, collecting and parsing local FortiOS logs not typically streamed to expose attacker activity including super-user account creation and configuration theft. • Adds Cloud Event page visibility for FortiGate authentication logs, enabling real-time monitoring of login activity and admin account changes for agentless EDR customers. • Adds built-in threat detection rules for Redis replication abuse: 'Redis suspicious replication target configured', 'Redis module loaded from unusual path', and 'Attack Detected and Prevented by Redis'. • Enables agentless monitoring of npm package installation logs to detect supply chain compromises such as malicious versions of @asyncapi/specs in real time. • Provides agentless visibility into HTTP/HTTPS access logs (Nginx, Apache, IIS) to detect webshell deployments, unusual executable access, and exploitation of hosted applications such as WordPress via wp2shell. • Adds detection coverage for PAN-OS CVE-2026-0257 and CVE-2026-0300 exploitation patterns observed in the wild via agentless log ingestion. • Adds detection for BeyondTrust Remote Support CVE-2026-1731 (CVSS 9.9 pre-auth RCE) observed in active exploitation. • Adds detection for MongoBleed (CVE-2025-14847), an unauthenticated MongoDB memory leak exploited in the wild, with real-time customer alerting via agentless visibility. • Correlates Agentless Workload events with Wiz ASM findings to surface threats like Zabbix instances running from unusual paths with default credentials. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wiz-defend https://www.wiz.io/blog/agentless-threat-hunting-fortigate https://www.wiz.io/blog/agentless-threat-hunting-fortigate Wed, 22 Jul 2026 14:24:50 GMT Wiz Agentless Workload Detection gains EDR-like visibility into FortiGate appliances, Redis, npm supply chain, and more virtual appliance threats. • Extends Agentless Workload Detection to FortiGate firewalls, collecting and parsing local FortiOS logs not typically streamed to expose attacker activity including super-user account creation and configuration theft. • Adds Cloud Event page visibility for FortiGate authentication logs, enabling real-time monitoring of login activity and admin account changes for agentless EDR customers. • Adds built-in threat detection rules for Redis replication abuse: 'Redis suspicious replication target configured', 'Redis module loaded from unusual path', and 'Attack Detected and Prevented by Redis'. • Enables agentless monitoring of npm package installation logs to detect supply chain compromises such as malicious versions of @asyncapi/specs in real time. • Provides agentless visibility into HTTP/HTTPS access logs (Nginx, Apache, IIS) to detect webshell deployments, unusual executable access, and exploitation of hosted applications such as WordPress via wp2shell. • Adds detection coverage for PAN-OS CVE-2026-0257 and CVE-2026-0300 exploitation patterns observed in the wild via agentless log ingestion. • Adds detection for BeyondTrust Remote Support CVE-2026-1731 (CVSS 9.9 pre-auth RCE) observed in active exploitation. • Adds detection for MongoBleed (CVE-2025-14847), an unauthenticated MongoDB memory leak exploited in the wild, with real-time customer alerting via agentless visibility. • Correlates Agentless Workload events with Wiz ASM findings to surface threats like Zabbix instances running from unusual paths with default credentials. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wiz-defend https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants Wed, 08 Jul 2026 14:00:00 GMT Wiz Defend adds AI coding assistant context-aware detections for symlink and SSH key attacks at clone and write time. • Detects malicious symlinks pointing to sensitive files at git clone time, catching GhostApproval-style attacks before AI coding assistant involvement. • Monitors writes to sensitive files (e.g., SSH authorized_keys) at write time, triggering alerts regardless of whether the write originates via a symlink. • Adds AI agent context awareness: alerts auto-elevate severity when malicious activity originates from an AI coding assistant process operating on untrusted repositories. • Leverages Wiz Runtime Sensor telemetry to identify active endpoints and their exposure based on inbound network traffic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wiz-defend https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants Wed, 08 Jul 2026 14:00:00 GMT Wiz Defend adds AI coding assistant context-aware detections for symlink and SSH key attacks at clone and write time. • Detects malicious symlinks pointing to sensitive files at git clone time, catching GhostApproval-style attacks before AI coding assistant involvement. • Monitors writes to sensitive files (e.g., SSH authorized_keys) at write time, triggering alerts regardless of whether the write originates via a symlink. • Adds AI agent context awareness: alerts auto-elevate severity when malicious activity originates from an AI coding assistant process operating on untrusted repositories. • Leverages Wiz Runtime Sensor telemetry to identify active endpoints and their exposure based on inbound network traffic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wiz-defend https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants Wed, 08 Jul 2026 14:00:00 GMT Wiz Defend adds AI coding assistant context-aware detections for symlink and SSH key attacks at clone and write time. • Detects malicious symlinks pointing to sensitive files at git clone time, catching GhostApproval-style attacks before AI coding assistant involvement. • Monitors writes to sensitive files (e.g., SSH authorized_keys) at write time, triggering alerts regardless of whether the write originates via a symlink. • Adds AI agent context awareness: alerts auto-elevate severity when malicious activity originates from an AI coding assistant process operating on untrusted repositories. • Leverages Wiz Runtime Sensor telemetry to identify active endpoints and their exposure based on inbound network traffic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wiz-defend