Featured
The risk hiding behind exposed MCP servers
How unauthenticated Model Context Protocol (MCP) servers are opening doors to sensitive cloud data, IAM, and command execution.
Blog
Accelerating CISA BOD 26-04 Vulnerability and Triage Activities through Wiz
Wiz enables organizations to continuously assess environments against the CISA KEV catalog, automating risk prioritization, rapid remediation, and forensic triage workflows.
Atlas: Wiz's autonomous AI Agent for vulnerability research, ranked #1 on CyberGym
See how Wiz built Atlas, an autonomous AI system for vulnerability research that validates every finding with a real, working exploit.
Opening the Black Box: Agentless Threat Detection for Virtual Appliances
Mapping appliances event logs to real-world campaigns: A step-by-step researcher’s guide to continuous agentless monitoring.
Agentless Threat Detection: Illuminating Cloud Blind Spots
How Agentless Workload Detection exposes hidden threats in virtual appliances and modern cloud networks.
300 WINtegrations Strong: An Open Security Ecosystem Built for the Speed of AI
As AI accelerates how organizations build and how attackers operate, a deeply connected security ecosystem is how defenders keep up.
Exploitation in the Wild of wp2shell
Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations.
The Red Agent POV: The One Boolean That Broke a B2B Platform’s Credit System
Part 3: How the Red Agent bypassed a credit and paywall system by changing a single client-side value from false to true.
M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
Detect and mitigate malicious @asyncapi npm packages linked to the latest npm supply chain attack.
Why IaC Coverage Belongs on Your Security Dashboard
Rethinking IaC coverage as a funnel that shows how much of your infrastructure is governed, traceable, and ready for remediation at speed
How ProdSec uses Wiz
Automation, resilience, and security for the modern age
Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense
Verizon's latest DBIR highlights how attackers are exploiting familiar weaknesses at increasing speed and scale. Here's what Wiz research reveals about vulnerabilities, trust relationships, and AI in modern cloud environments.
GhostApproval: A Trust Boundary Gap in AI Coding Assistants
Uncovering a category-level blind spot in modern AI coding assistants, and why the Human-in-the-Loop safety model fails against this classic threat
Wiz ASM for any environment, any risk, everywhere
Protect the modern attack surface with new auto-reconnaissance capabilities, deep internal context, and the Red Agent to find any risk, anywhere.
FAQs from the Field: Is Wiz a Runtime Security Tool?
It's a common question we hear from prospects: "Does Wiz actually do runtime, or is it just risk prevention?" The short answer is yes, Wiz does runtime.
Build AI Security Agents with Wiz MCP
Power AI-driven security with trusted security context, Wiz AI Agents, and Wiz AI Skills.
Breaking Down the White House’s Actions on Post-Quantum Cryptography Readiness
The U.S. Federal Migration to PQC Just Got Real
Start Secure in the AI Era: Accelerating AI Threat Readiness with WizOS
As the time from vulnerability discovery to exploitation shrinks, building with minimal, secured components is more important than ever. Here is how WizOS helps.
Bridging the Visibility Gap: A Unified Security Operating Model for Hybrid Cloud Teams
Move beyond chasing vulnerabilities to a unified hybrid risk strategy. The Sensor Workload Scanner is now GA and extends our risk prioritization engine to on-premise environments to identify the critical attack paths across your hybrid cloud.
The Borderless Attack Surface: Securing Public Sector Hybrid Environments
Aligning Modern CNAPP Telemetry with realistic risk assessments to drive agency efficiency through cross-team collaboration
The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API
Part 2: How the Red Agent bypassed backend resolvers to expose an entire airline booking database in fifteen minutes
MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension
By automatically loading MCP servers from workspace files, Amazon Q enabled attackers to execute code and access sensitive cloud environments.
Uncovering Hidden Attack Paths in Cloud Environments Using Runtime Signals
Wiz now layers runtime signals into the Security Graph, exposing hidden attack paths to give security teams a complete picture of risk.
How AI Is Rewriting the SecOps Playbook
The threat landscape has changed. Adversaries operate at machine speed, shrinking attacks from days to minutes. Defenders can no longer investigate and respond before damage occurs. In this new era, Security Operations must prioritize speed, automation, and continuous decision-making.
AI Threat Readiness Pillar 4: Detect and contain threats in real-time
Your guide to operationalizing AI-powered threat detection and response with Wiz to stay ahead of AI-driven attackers.