Wiz

No entries match these filters. Clear filters

1. changelog Oct 14, 2026 · issue 109

   Wiz AI Agents now available in Wiz for Gov (FedRAMP HighFedRAMP HighA US federal authorization tier for cloud services, managed by GSA, certifying that a provider meets the strictest NIST 800-53 controls required to handle the most sensitive unclassified government data.), enabling autonomous and human-in-the-loophuman-in-the-loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. remediation for U.S.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ public sector.

   • Wiz AI Agents are now available within Wiz for Gov, the FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. High authorized environment, bringing AI-driven risk remediation to U.S.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ public sector organizations handling sensitive and mission-critical data.
   • Wiz AI Agents offer configurable operational boundaries, allowing security teams to authorize agents to execute routine remediations autonomously or require human-in-the-loop approval before applying changes on sensitive systems.

   2 details in Everything

2. changelog Sep 30, 2026 · issue 093

   Wiz launches WizOS Helm Charts: hardened, signed, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.-shipped Kubernetes charts built and patched in Wiz's own pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Browse available WizOS Helm Charts and verify a chart's provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. and SBOM before installing into a cluster.
   📍In the Wiz portal, navigate to Secured Image Catalog, locate the desired WizOS Helm chart, and review its attached SBOM and provenance attestation before running helm install.
   • Introduces WizOS Helm Charts — hardened, minimal Helm charts built, tested, and signed by Wiz in its own pipeline, isolating deployments from upstream supply chain risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Signs every WizOS image and ships it with provenance and an SBOM, enabling verification of origin and contents at install time.
   • Adds Argo Rollouts (with a FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. variant), Sealed Secrets, and KEDA to the WizOS catalog for delivery and GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. use cases.
   • Adds Grafana Loki and Alloy (with anonymous usage reporting off by default) and Redis Exporter to the WizOS catalog for observability.
   • Adds Cosign (including keyless signing) and OpenSCAP (bundled with the DISA general purpose operating system baseline) to the WizOS catalog for signing and compliance.

   +3 more show less

   • Adds Valkey Bundle (with search, JSON, Bloom, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. modules) and Redis Operator to the WizOS catalog for data workloads.
   • Adds OpenSSH Server and Ansible (with major cloud collections included) to the WizOS catalog for access and automation.
   • Makes the full WizOS Helm chart catalog browsable in the Secured Image Catalog in the Wiz portal.

   8 details in Everything

3. changelog Sep 22, 2026 · issue 082

   Wiz MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gains a GA WIN partners endpoint so partner AI agents can pull live Issues, Findings, and resources on demand.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a GA WIN partners endpoint in the Wiz MCP, letting partner AI agents (Claude Code, Cursor, GitHub Copilot, or any remote-MCP-capable agent) search WIN documentation, retrieve API operations and required scopes, and query demo environment data without manual API calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces MCP-based agent integrations in the Wiz Integration Network (WIN), enabling partner AI agents to pull live Wiz context — Issues, Findings, affected resources, attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., and blast radius — directly from customer tenants on demand during investigations.

   2 details in Everything

4. changelog Aug 19, 2026 · issue 050

   Wiz Penetration Test Findings reaches GA, unifying bug bounty, red team, third-party audit, and AI pen-test results in a single platform.

   • Wiz Penetration Test Findings is now Generally Available, providing a single home for pen-test results from bug bounties, third-party audits, internal red team exercises, and AI pen-test scanning — connected to real-time cloud context on the Wiz Security Graph.
   • Pen-test findings are automatically linked to continuous prioritization, ownership assignment, and remediation tracking, closing the loop between offensive assessment and ongoing exposure management.
   • Introduces support for Continuous Threat Exposure Management (CTEMCTEMContinuous threat exposure management, a recurring process for finding, prioritizing and validating exploitable exposures. It connects discovery to fixes and checks whether those fixes work.) workflows by bridging the Validation stage back to Discovery, Prioritization, and Mobilization within a single platform.

   3 details in Everything

5. changelog Aug 6, 2026 · issue 037

   Wiz adds automated DISA STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. assessment for Amazon Linux 2023 and Windows Server 2025 in AWS GovCloud.

   • Adds automated DISA STIG compliance assessment for Amazon Linux 2023 (AL2023 V1R2 and V1R3 benchmarks) and Windows Server 2025, covering gaps where official SCAP content is not yet available.
   • Delivers continuous hardening validation for federal agencies and defense contractors operating in AWS GovCloud, supporting FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Rev5, FedRAMP 20xFedRAMP 20xA GSA-led overhaul of the FedRAMP cloud-authorization program aimed at cutting compliance burden through continuous, automated evidence collection rather than point-in-time audits, letting vendors reach federal markets faster., CMMC, and DoD authorization requirements.

   2 details in Everything

6. changelog Jul 27, 2026 · issue 043

   Wiz introduces Atlas, an autonomous AI system for vulnerability research that ranked #1 on CyberGym with 90.9% accuracy and found 200+ validated bugs.

   • Introduces Atlas, an autonomous multi-agent AI system for AI SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. that maps attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. via a code property graph (CPG), hunts vulnerabilities in parallel with independent agents, validates findings adversarially, and confirms them by dynamically executing a generated exploit in a dedicated execution environment.
   • Atlas ranked #1 on CyberGym — the public benchmark for AI-driven vulnerability research — with a 90.9% success rate, and uncovered 200+ previously unknown vulnerabilities in heavily audited open-source projects including grpc, dnsmasq, Kubernetes, gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM., the Linux kernel, and containerd.
   • Each Atlas finding is autonomously validated end-to-end: an adversarial debate stage (one agent argues exploitability, one argues against, a third adjudicates) filters false positives before a dynamic proof-of-concept trigger confirms real security impact.
   • Atlas uses a Cyber Model Arena internal benchmark to continuously evaluate newly released models across threat modeling, hunting, validation, and proof-generation tasks, routing each pipeline stage to whichever model currently wins on that task.
   • Atlas development uses Evaluation-Driven Development (EDD), requiring strict quality metrics for every AI component and stage — including a dedicated validation eval that scores candidate ratings against known false-positive and true-positive ground-truth sets — before any pipeline change is accepted.

   5 details in Everything

7. changelog Jul 14, 2026 · issue 015

   Wiz adds detection and IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. for the @asyncapi npm supply chain compromise (M-RED-TEAM v6.4 malware).

   • Adds detection for five malicious @asyncapi npm package versions (@asyncapi/generator 3.3.1, @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/specs 6.11.2 and 6.11.2-alpha.1) tied to the July 14, 2026 supply chain attack.
   • Surfaces IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. coverage as a three-stage funnel metric (IaC-supportable → Tracked by IaC → Mapped to a declaration in code) within the Wiz platform to quantify how much cloud infrastructure is governed, traceable, and remediable via pull request.

   2 details in Everything

8. Build AI Security Agents with Wiz MCP (2026-07-02) Jul 2, 2026 · issue 002

   Wiz MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. is now generally available, connecting AI agents and assistants to the Wiz Security Graph, AI Agents, and reusable AI Skills.

   └──▷ HOW TO FIND IT
   Let an AI agent surface only exploitable vulnerabilities an attacker could chain to reach sensitive data — ranked by remediation priority rather than raw CVE severity.
   📍Surface only the open vulnerabilities an attacker could realistically chain to reach sensitive data, explain the attack path for each, and rank them by what to remediate first.
   Operationalize a penetration test report by importing it into Wiz, mapping findings to cloud assets, and creating tracked Penetration Test Findings — eliminating the static-report problem.
   📍Import this penetration test report into Wiz, map findings to my environment, and create Penetration Test Findings.
   Give a security leader an auditable compliance gap analysis by comparing an internal framework against existing Wiz policies and publishing results to a documentation tool.
   📍Compare our internal security framework against existing Wiz policy coverage, identify the gaps, recommend custom rules to close them, and produce an auditable coverage summary.
   • Introduces Wiz MCP (general availability): a secure integration layer that connects AI assistants, custom agents, and AI-powered applications to the Wiz platform.
   • Enables AI to query and reason over the Wiz Security Graph — including findings, issues, vulnerabilities, attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., identities, cloud infrastructure, code, data, and runtime relationships.
   • Exposes Wiz AI Agents (Red, Blue, and Green) through MCP so external AI can consume agent analyses and recommendations without recreating the same reasoning.
   • Provides access to Wiz AI Skills — predefined, reusable agentic playbooks for vulnerability triage, remediation, threat investigation, compliance mapping, and more.
   • Supports an Import Security Reports Skill that extracts findings from external penetration test reports, maps them to cloud resources, and creates Penetration Test Findings in Wiz.

   +3 more show less

   • Supports a Custom Compliance Mapping Skill that maps internal security frameworks against existing Wiz policies, identifies gaps, recommends custom rules, and generates auditable coverage summaries.
   • Enables Green Agent–driven code-to-cloud remediation from the IDE: traces Wiz Issues to responsible repositories, generates fixes, and opens pull requests.
   • Enables Blue Agent–powered SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. workflows: correlates threats with SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. data, builds investigation timelines, and creates remediation tickets with documented findings.

   8 details in Everything

9. Start Secure in the AI Era: Accelerating AI Threat Readiness with WizOS (2026-06-30) Jun 30, 2026 · issue 002

   Wiz adds Secure Architecture Opportunities, WizOS Migration Skill, and Green Agent WizOS remediation to accelerate container hardening.

   └──▷ HOW TO FIND IT
   Find which container image types carry the most CVE risk and get a prioritized migration plan before touching any Dockerfiles.
   📍In the Wiz console, go to Findings › Secure Architecture Opportunities, filter by image type (e.g., Python, nginx), and review the associated vulnerabilities, security issues, and estimated effort score to pick your highest-impact migration target.
   Patch a critical container CVE without leaving your AI coding agent — let the WizOS Migration Skill swap the base image automatically.
   📍In your AI coding agent, invoke the WizOS Migration Skill against your Dockerfile; the skill identifies the appropriate WizOS replacement image and applies the base-image swap directly in the file.
   Accelerate MTTR on a critical container finding by routing a WizOS fix straight to an engineering issue with full context.
   📍In a Wiz Green Agent remediation recommendation for a container image CVE, click Send to Coding Agent — Wiz opens a repository issue, tags your AI coding agent, and passes the specific WizOS image and migration context for automated resolution.
   • New Secure Architecture Opportunities page (public preview) in Wiz Findings groups WizOS migration candidates by image type (e.g., Python, nginx) with associated CVEs, related issues, and estimated migration effort for risk-ordered prioritization.
   • New WizOS Migration Skill for AI coding agents surfaces the correct WizOS replacement image from Dockerfile context and can apply the base-image swap directly within the development environment.
   • Wiz Green Agent now includes WizOS image recommendations in remediation guidance for container CVEs, with a Send to Coding Agent action that automatically opens a repo issue and passes full context to the coding agent for hands-off migration.

   3 details in Everything

10. Bridging the Visibility Gap: A Unified Security Operating Model for Hybrid Cloud Teams (2026-06-29) Jun 29, 2026 · issue 001

    Wiz Sensor Workload Scanner is now GA, extending risk prioritization and attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis to on-premise VMware, bare metal, and self-hosted Kubernetes.

    • Adds Sensor-based Workload Scanner (WLS) GA for on-premise environments, identifying public exposure, vulnerabilities, misconfigurations, malware, secrets, and sensitive data on VMware vSphere, bare metal, and self-hosted Kubernetes.
    • Extends the Wiz Security Graph to on-premise assets, correlating infrastructure context with workload findings to surface toxic combinations and cross-environment attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
    • New Runtime Validation confirms whether a vulnerable package is actually loaded into memory and actively running, separating theoretical CVEs from live exploitable risks.
    • Native vSphere and Kubernetes Connectors provide agentless infrastructure assessment via native APIs, mapping ESXi vulnerabilities, local identities, and cluster misconfigurations into the Security Graph.
    • Supports ingestion of findings from existing on-premise scanners via Unified Vulnerability Management (UVM) to centralize hybrid risk strategy.

    +5 more show less

    • Integrated Attack Surface Management combines external outside-in scanning with internal context to identify which on-premise servers are exposed to the public internet.
    • Wiz Red Agent can simulate attacker lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. through on-premise environments to validate true exploitability of exposed servers.
    • Runtime Threat Detection via the Runtime Sensor continuously monitors on-premise workload behavior, delivering high-fidelity alerts with automated forensics collection and AI-powered initial investigation via the Blue Agent.
    • Wiz Workflows enables automatic triggering of remediation playbooks upon threat detection, turning a detected on-premise threat into a resolved one without manual intervention.
    • Extends AI workload coverage to on-premise environments, providing visibility into AI technologies and detecting AI-specific threats such as suspicious prompt activity.

    10 details in Everything

11. Uncovering Hidden Attack Paths in Cloud Environments Using Runtime Signals (2026-06-25) Jun 25, 2026 · issue 001

    Wiz Security Graph now ingests live runtime network signals to surface previously hidden attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. as critical Issues.

    └──▷ HOW TO FIND IT
    Identify internet-facing containers with vulnerabilities that have an active runtime network connection to sensitive data stores — a combined risk that agentless scanning alone cannot surface.
    📍In the Wiz console, go to Security Graph › Issues and filter by Issues that include a Runtime signal layer to view attack paths where a live network connection joins an exposed/vulnerable workload to a sensitive destination (e.g., S3 bucket with PII, Vault secrets).
    Discover which containers in your environment are actively communicating with external MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers at runtime — critical for AI workload blind-spot coverage.
    📍In the Wiz console, go to Security Graph › Graph Controls and query for workloads with observed DNS connections to remote MCP servers to review which containers are reaching external AI tool endpoints and whether those containers also have access to sensitive data.
    • Adds runtime network telemetry from the Wiz Runtime Sensor into the Security Graph, correlating live connections (container-to-database, pod-to-pod, DNS queries) with existing risk findings to expose complete attack paths.
    • Surfaces correlated runtime + risk findings as a single critical Issue, replacing separate agentless findings with one prioritized, validated attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. view.
    • Enables visibility into AI workload network behavior, including containers making live connections to remote MCP servers that were never declared in configuration or policy.
    • Available automatically to all existing Wiz Cloud and Runtime Sensor customers across Graph Controls and Issues — no additional deployment required.

    4 details in Everything

12. Cloud-native Security for your Windows environment: Announcing the Wiz Runtime Sensor for Windows (2026-06-22) Jun 22, 2026 · issue 001

    Wiz Runtime Sensor reaches GA for Windows, adding real-time threat detection, automated response, and runtime vulnerability validation across hybrid cloud.

    • Adds Wiz Runtime Sensor for Windows (GA), extending agent-based real-time monitoring and threat detection to Windows VMs and Windows Kubernetes nodes alongside existing Linux/container coverage.
    • Enables cross-layer attack correlation in Wiz Defend, automatically stitching Windows workload events (e.g., LSASS dump, IMDS credential theft) with cloud control-plane logs into a unified attack timeline.
    • Supports Custom Detection Rules for Windows, letting security teams define fleet-specific threat logic and behavioral detections beyond built-in rules.
    • Introduces Automated Runtime Response for Windows: policies that automatically terminate malicious processes based on defined rules or threat categories.
    • Adds Context-Aware Forensics for Windows: automatic capture of logs, suspicious binaries, and scripts at detection time, preserved directly in the Wiz platform.

    +2 more show less

    • Enables Runtime Risk Validation for Windows vulnerability management, identifying which vulnerable DLLs and packages are actively loaded in memory to prioritize genuinely exploitable CVEs.
    • Delivers multi-cloud Windows coverage across Azure, AWS, GCP, and hybrid environments with a memory-safe (Rust-based), low-footprint architecture capped at 0.5 cores and 500 MiB.

    7 details in Everything

13. Introducing the Red Agent POV Series (2026-06-17) Jun 17, 2026 · issue 001

    Wiz launches Red Agent POV Series, showcasing its AI-powered pentester finding 5,500+ critical vulns across ~1,000 production environments.

    • Introduces the Red Agent POV Series: a recurring research blog where Wiz Research details real-world exploitable vulnerabilities discovered autonomously by the Red Agent AI pentester.
    • Highlights Red Agent's continuous autonomous scanning capability, completing hundreds of thousands of scans across ~1,000 environments in a single month and surfacing 17,000+ unique findings.
    • Surfaces dominant real-world risk patterns at scale: 54% of findings stem from broken access control, 52%+ of injection findings are Critical/High, and 61%+ of exposed secrets are Critical/High severity.
    • First POV entry demonstrates multi-step SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. discovery in a GCP Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. service — the Red Agent chained 96 reasoning iterations across 3 scan runs to bypass GitHub-URL validation and extract credentials and source code without authentication.

    4 details in Everything

14. Wiz Exposure Management Dashboard: Your CTEM Command Center (2026-06-16) Jun 16, 2026 · issue 001

    Wiz launches Exposure Management Dashboard (Public Preview): a CTEMCTEMContinuous threat exposure management, a recurring process for finding, prioritizing and validating exploitable exposures. It connects discovery to fixes and checks whether those fixes work.-aligned single pane of glass for scoping, prioritizing, validating, and remediating attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. at AI speed.

    └──▷ HOW TO FIND IT
    Enable the new Exposure Management Dashboard to begin operationalizing CTEM across your environment.
    📍In the Wiz console, go to Preview Hub and enable the Exposure Management Dashboard.
    • New Exposure Management Dashboard (Public Preview) provides a unified CTEM lifecycle view — scoping, discovery, prioritization, validation, and remediation — in a single console.
    • Scoping stage maps all covered assets across cloud environments, code repositories, on-premise servers, AI workloads, workstations, identities, and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. in one inventory view.
    • Discovery stage surfaces infrastructure vulnerabilities, code vulnerabilities (via Wiz Code and ASPMASPMApplication security posture management, combining findings about applications from multiple tools and relating them to business context. It helps teams decide which fixes matter most. integrations), pen-test findings, cloud misconfigurations, exposed secrets, and sensitive data findings in a unified risk profile.
    • Prioritization stage leverages the Wiz Security Graph to correlate risks into attack paths with validated business impact, cutting through thousands of alerts to surfaced Wiz Issues.
    • Validation stage integrates Wiz ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. and the Red Agent (AI-powered pentester) to verify exploitable attack paths from an external attacker perspective and correlate findings with internal cloud context.

    +3 more show less

    • Remediation stage includes the Wiz Green Agent — an AI-powered investigation and remediation engine that automates root-cause analysis and ownership mapping — and tracks posture improvements against SLAs.
    • Wiz Workflows enable automated remediation pipelines, such as triggering a Green Agent investigation on critical Issues and opening an assigned Jira ticket automatically.
    • Unified Vulnerability Management (Wiz UVM) ingests data from existing third-party scanners alongside native Wiz cloud and code scanner data.

    8 details in Everything

15. AI Threat Readiness Pillar 3: Perform AI Code Analysis Natively in Wiz (2026-06-11) Jun 11, 2026 · issue 001

    Wiz adds native AI Code Scans, Red Agent adversarial validation, and Green Agent auto-remediation for AI-driven development.

    • Adds native AI Code Scans (now in private preview) using commercially available AI models to perform semantic reasoning on application code, surfacing intent-dependent vulnerabilities like IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data., business logic errors, and broken function-level authorization that traditional SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. misses.
    • Introduces a layered scanning model: continuous rules-based SAST via the Unified Policy Engine, periodic AI Code Scans on major updates, and deep frontier-model X-Ray analysis for mission-critical repositories.
    • Enables Code-to-Cloud mapping via the Wiz Service Catalog to connect deployed cloud resources to source repositories, letting runtime exposure drive AI scan prioritization rather than scanning all repos uniformly.
    • Introduces the Wiz Red Agent, which autonomously tests AI Code Scan findings end-to-end against live environments to confirm exploitability and validate attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. on the Wiz Security Graph.
    • Introduces the Wiz Green Agent, which triggers automatically after Red Agent validation to generate tailored remediation plans, identify exact code/infrastructure ownership, issue pull requests, and coordinate with AI coding agents such as Claude Code and CodeMender.

    +2 more show less

    • Adds Posture Policies to govern lower-severity findings as security debt, with configurable remediation SLAs, team ownership tracking, and board-level progress reporting across the full vulnerability lifecycle.
    • Operates as an open platform: ingests findings from external scanners and frontier models alongside native scans, enriching all findings on the Wiz Security Graph under a unified workflow.

    7 details in Everything

16. AI Threat Readiness Pillar 2: Accelerate Patching and Response (2026-06-09) Jun 9, 2026 · issue 001

    Wiz adds Green Agent-powered remediation paths, unified ownership automation, CI/CD guardrails, and WizOS hardened images to accelerate patching.

    └──▷ HOW TO FIND IT
    Automatically investigate a critical Issue, identify its owner, and open a fix PR — turning hours of manual triage into a minutes-long automated flow.
    📍In the Wiz console, go to Workflows › New Workflow, select the Assign Ownership template, add a Green Agent investigation step triggered on Critical Issue creation, then append a Create PR action to push the recommended fix to the source repository.
    • New Green Agent capability automatically traces runtime vulnerabilities back to their source (VM, container image, Dockerfile, or Terraform module) and generates environment-specific, step-by-step remediation plans.
    • Green Agent integration via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. enables remediation orchestration through external AI agents and toolchains.
    • Unified ownership model aggregates signals from CODEOWNERS files, Git Blame, cloud event logs (e.g., CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions.), Resource Tag Rules, Backstage, and ServiceNow CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context. to automatically suggest the right Issue assignee.
    • Wiz Workflows adds a built-in Assign Ownership template that automatically routes Critical Issues to the identified owner without manual triage.
    • Wiz Workflows can now chain Green Agent investigation, root-cause analysis, ownership assignment, and PR creation into a single automated remediation pipeline triggered on Issue creation.

    +3 more show less

    • Wiz CI/CD Policies enforce the same cloud-environment policies at build time, blocking vulnerabilities, misconfigurations, and exposed secrets before deployment.
    • Wiz Code plugins (Wiz Skills and Wiz Hooks) bring policy enforcement into the developer IDE, scanning at pre-commit and pre-push for secrets, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. misconfigurations, and vulnerable dependencies — including code written by AI agents.
    • WizOS provides hardened container images with supply chain integrity guarantees and CVE remediation SLAs; Green Agent can recommend the specific WizOS image to migrate to and send the change to a coding agent.

    8 details in Everything

17. Introducing Wiz Cloud Cost: Powering Cost Management and Optimization with Context (2026-06-08) Jun 8, 2026 · issue 001

    Wiz Cloud Cost launches GA: unified cloud & AI spend visibility, optimization, and anomaly alerting across AWS, Azure, and GCP.

    └──▷ HOW TO FIND IT
    Alert your team in Slack when a specific product's cloud spend exceeds a budget threshold, so engineers can investigate before a large overrun occurs.
    📍In the Wiz console, go to Cloud Cost › Cost Monitors › Create Monitor, scope the monitor to a Project (e.g., your payment-service project), set a fixed threshold on monthly spend, then create an Automation Rule to send the finding to your Slack channel when the monitor triggers.
    Investigate a sudden cost spike and identify its root cause without leaving the cost view.
    📍In the Wiz console, go to Cloud Cost › Cost Explorer, open the Heatmap tab, click the anomalous time window, then select Launch Investigation with Mika AI to get a root cause summary and suggested next steps.
    Review disk right-sizing recommendations informed by actual utilization data to find immediate savings on overprovisioned volumes.
    📍In the Wiz console, go to Cloud Cost › Optimization Opportunities, filter by Disk Right Sizing, sort by Estimated Monthly Savings, and open a finding to view remediation guidance and the linked IaC template.
    • Introduces Wiz Cloud Cost, a new FinOps module delivering unified cost visibility across AWS, Azure, and GCP environments directly within the Wiz platform.
    • Integrates cost data into the Wiz Graph, enabling teams to visualize application-level spend alongside security findings and resource relationships.
    • Adds Cost Explorer with actual spend tracking, forecasting, and drill-down filtering by cloud platform, subscription, resource tags, resource type, and AI model.
    • Adds a Kubernetes cost tab in Cost Explorer showing spend across clusters, top controllers, and allocated cost over time.
    • Surfaces 140+ context-aware cost optimization rules covering waste, right-sizing, and configuration — including disk right-sizing via agentless disk analysis and shadow data detection via data scanning.

    +7 more show less

    • Enables code-to-cloud mapping for optimization opportunities, tracing resources back to their IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. templates and code repositories.
    • Introduces Cost Monitors with a rules engine supporting fixed thresholds and anomaly detection for alerting on budget overruns and spend spikes, scoped to projects or individual resources.
    • Adds Pricing Updates feed showing upcoming cloud provider pricing changes and their projected impact on your environment.
    • Provides commitment governance tracking utilization, coverage, and expiration of reserved capacity across cloud subscriptions.
    • Includes a dedicated AI Cost dashboard with model-level cost attribution and AI spend visibility across providers.
    • Supports cost attribution via Projects, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. scoped to project level, custom dashboards, and automation rules routing cost findings to Slack, Jira, or other integrations.
    • Integrates Mika AI for cost spike investigations launched directly from the cost heatmap or monitor findings.

    12 details in Everything

18. AI Threat Readiness Pillar 1: Reduce Critical Exposures & Scan with AI (2026-06-04) Jun 4, 2026 · issue 001

    Wiz adds Red Agent (autonomous AI attacker) and Green Agent (AI remediation) alongside expanded Attack Surface Management for cloud, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., and AI environments.

    └──▷ HOW TO FIND IT
    Enable the AI-powered attacker to continuously discover logic flaws and API vulnerabilities across your applications at machine speed.
    📍In the Wiz console, navigate to Red Agent and select Activate to begin continuous AI-powered exploitation scanning across your mapped API attack surface.
    Extend attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. visibility to any asset and get comprehensive external risk assessment beyond default cloud coverage.
    📍In the Wiz console, go to Attack Surface Management › Settings and enable Advanced ASM to discover shadow APIs, unmanaged cloud services, and AI-generated applications.
    Accelerate remediation by using Green Agent to identify root cause and route actionable fixes directly to resource owners.
    📍In the Wiz console, open a Validated External Risk Issue, select Green Agent, and review the contextual root-cause guidance and recommended fix, then trigger the associated Wiz Workflow to route the remediation to the resource owner.
    • New Red Agent: autonomous AI-powered attacker that continuously maps API attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. (from cloud APIs, Swagger/OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. docs, runtime sensor, and web crawler) and performs context-aware exploitation to uncover broken authorization, business logic flaws, injection vulnerabilities, and multi-step attack chains in custom and AI-generated applications.
    • New Green Agent: AI-powered remediation assistant that identifies root cause of exposure findings and delivers context-aware, actionable fixes to resource owners by synthesizing code-to-cloud relationships, ownership data, Security Graph context, and historical remediation patterns.
    • Expanded Wiz Attack Surface Management (ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them.) with Advanced ASM tier: continuously discovers and validates internet-facing assets across cloud, SaaS, AI, and on-premises environments — including shadow APIs, unmanaged cloud services, and vibe-coded applications — enriched with internal cloud network and runtime context.
    • Wiz Security Graph correlation now connects validated external findings from ASM and Red Agent to internal cloud infrastructure, identities, sensitive data, and application ownership to enable prioritization by reachability, exploitability, and business impact.
    • Automated remediation routing via Wiz Workflows: findings can be automatically assigned to the appropriate application owner, infrastructure team, or developer, and combined with Green Agent guidance for repeatable remediation processes.

    5 details in Everything

19. Eliminate Critical API Attack Paths with Wiz API SPM (2026-06-01) Jun 1, 2026 · issue 001

    Wiz API SPM is now GA, adding automated API discovery, exploitability testing, and toxic-combination prioritization across cloud environments.

    └──▷ HOW TO FIND IT
    Start reviewing your full API attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources., including shadow APIs, immediately after GA enablement.
    📍In the Wiz console, go to API Security › API Security dashboard to view all discovered API endpoints, their sources (e.g., AWS API Gateway, Azure APIM), exposure status, and associated risk findings.
    • New Wiz API Security Posture Management (API SPM) module provides continuous, agentless discovery of APIs — including shadow and zombie APIs — across AWS API Gateway, Azure API Management, Google Cloud API Gateway, and Apigee.
    • Enriches every discovered API with context: external exposure, authentication configuration, sensitive data access, and associated cloud resources.
    • Introduces Attack Surface Management (ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them.) for APIs, which dynamically tests APIs from the outside in — simulating real attacker techniques to validate whether endpoints are actually exploitable, not just theoretically vulnerable.
    • Adds Red Agent capability that actively probes APIs using attacker techniques, expanding coverage across the full OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API Top 10 including Broken Object Level Authorization and other issues passive scanning cannot reliably detect.
    • Identifies toxic combinations by mapping exposed API endpoints through the Wiz Security Graph to sensitive data and cloud resources, surfacing the highest-priority attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. (e.g., internet-accessible endpoint with confirmed SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. hosting PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations.).

    +2 more show less

    • Supports automated remediation workflows, including triggering Terraform patches via a coding agent directly from the remediation interface.
    • Green Agent generates step-by-step remediation plans grounded in full cloud and API context — ownership, linked resources, and data sensitivity — to accelerate mean time to remediation.

    7 details in Everything