Wiz Sensor
commercialThe section your link pointed to isn't on Wiz Sensor's page any more, so we've brought you to the top.
Wiz Sensor is a lightweight, eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.-based runtime sensor that scans workloads and AI models, detects threats, and blocks active attacks in real time.
gcloud container clusters create <cluster-name> \ --zone <zone> \ --addons=WizSensor=ENABLED gcloud container clusters update <cluster-name> \ --zone <zone> \ --update-addons=WizSensor=ENABLED
Summary
Wiz Sensor is a commercial runtime protection agent that scans cloud workloads and AI models for risks, validates them during execution, and blocks active attacks before they spread. It runs as an eBPF-based sensor deployed onto workloads across private, hybrid, and multi-cloud infrastructure, built to be lightweight and kernel-safe so it adds negligible performance overhead, and it pairs with agentless inventory scanning to map coverage and flag gaps where no sensor is installed. It is aimed at cloud security teams who need host-level detection alongside their broader posture tooling, covering file integrity monitoring, image drift, log tampering, network scanning, and malicious IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., with custom and predefined rules for blocking malware and suspicious process behavior. Its documentation frames it as a companion to agentless scanning rather than a replacement, correlating runtime findings back to source code for remediation.
Wiz Sensor is a lightweight, eBPF-based runtime sensor that scans workloads and AI models, detects threats, and blocks active attacks in real time.
How Wiz Sensor helps
Which of my workloads are actually running without runtime protection?
correlates the agentless inventory of the environment against deployed sensors and flags the gap where none is installed
Is this vulnerability actually reachable, or just sitting in a manifest?
watches the workload's memory at runtime and flags the vulnerabilities that are actually active, separating those from findings that exist only on disk
Has something altered a file it shouldn't have on this host?
runs file integrity monitoring directly on the host in real time, catching changes as they happen rather than on the next scheduled scan
Did this running container drift from the image it was built from?
compares the running workload against its source image and reports where the two no longer match
Is an attacker moving inside my cloud environment right now?
watches host and network behavior for scanning, log tampering, and known malicious indicators, and blocks the matching activity before it spreads
Which process on this host is behaving like malware or an unwanted actor?
matches running process behavior against predefined and custom rules and blocks the ones that break a rule
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
Five scores for Wiz Sensor, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail Wiz Sensor puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Website history
wiz.io, every changeWiz's home page and 21 more pages as they looked each month from September 2021 to October 2026: 94 renders, 19 changes of tagline or palette. Step through them, play them, or put any two months side by side.
Website history is included with Researcher and Business.
See plans → Already subscribed? Sign in →← → or h l a month · Shift a year · [ ] previous / next change · Space play · 1 2 3 page · T whole page · C compare · F full size
← → or h l the right month · Shift the left · S swap · W wipe · T whole page · Esc back
Rebranding timeline
Dates bound when a change appeared between captures. Possible rebrands are AI suggestions; a redesign alone does not establish a rebrand.
Coverage
Missing something? Tell us
What Wiz Sensor connects to, runs on and detects, read from its release notes and docs. So far: 1 new detection, 1 new integration, 1 new supported platform.
3 changes, tracked since Oct 20, 2026.
-
Oct 202026
new GKE runtime threat detection via Wiz Sensor eBPF add-on
With reverse shells, binary executions from /tmp, image drift, privilege escalation attempts
Once active, the Wiz Sensor continuously monitors for high-risk runtime behaviors, including reverse shells, binary executions from /tmp, image drift, and privilege escalation attempts.
-
Oct 202026
new Wiz Runtime Sensor native GKE add-on integration
With GKE Standard, GKE Autopilot, Workload Identity Federation, Google Cloud Organization Policies
Google Cloud and Wiz are excited to introduce the Wiz Runtime Sensor add-on for Google Kubernetes Engine (GKE) in Preview. Available directly within the GKE platform for both GKE Standard and GKE Autopilot clusters, this first-party integration transforms how teams deploy and manage in-cluster runtime security.
-
Oct 202026
new GKE Standard and GKE Autopilot cluster support for Wiz Sensor add-on
Available directly within the GKE platform for both GKE Standard and GKE Autopilot clusters
Identity & access 1
Cloud platforms & services 1
Containers & orchestration 2
Containers & orchestration 2
Nothing first seen in this window. That doesn't mean Wiz Sensor shipped nothing, only that we found no record of it.
How we count
Read from 1 of 1 release notes and docs updates we hold for Wiz Sensor. "First seen" is the earliest note that names something; "last" is the latest. Our history may start partway through Wiz Sensor's life, so an old integration can show a recent first-seen date.
Each change counts once: "added 40 checks" is one line, so the numbers measure how often coverage moves, not how big the catalogue is or how well it detects.
Releases
1 entry
No entries match these filters.
- October 20261
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →