Most SOC teams start investigating when a threat alert fires. Analysts triage the alert, piece together context, and begin an investigation, all after something has already happened. That model was built for a world where attackers moved at human speed and relied mostly on known exploits.
That's no longer the case. Two shifts are happening at the same time, and both are changing the day-to-day for the SOC:
• Organizations are shipping more custom code than ever: AI-assisted development means teams are building custom AI applications at unprecedented speed. These apps can contain logic-driven vulnerabilities, such as broken authorization and authentication bypasses, that are impossible to detect with signature-based scanners.
• Attackers are using AI to move faster: Adversaries are using frontier AI models to scan perimeters, find exposed applications, and weaponize vulnerabilities in hours instead of months. AI also lowers the barrier to entry, so more attackers can probe custom applications for weaknesses, at greater scale than ever.
For the SOC, that means the first sign of a logic flaw is often the breach itself. By the time a detection fires, the attacker has already chained their way in.
Human-speed defense can't keep up with AI-powered offense. The only way to keep pace is to use AI to fight AI: find the open door before an attacker walks through it, and investigate at AI speed when someone does. This is critical for incident response in the AI era, and ensuring that the SOC can action at the speed required to defend the enterprise.
Proactive security belongs in the SOC
Gartner® makes the priority clear:
Proactive, continuous threat exposure management (CTEM) with offensive testing will dominate SOC operations, as reactive detection yields an exponential increase in diminishing returns.
Gartner Report, The Security Operations Roadmap to 2030, By Kevin Schmidt, Alex Tytarenko, etc., October 2026. Gartner is a trademark of Gartner, Inc. and/or its affiliates
For the SOC, this means treating validated, exploitable exposures as what they are: attack paths that are proven exploitable. They deserve the same urgency as an active threat, because in the AI era, it's only a matter of time before attackers find them.
That is the job of two Wiz agents working together:
• The Red Agent, our AI-powered attacker that continuously finds and validates exploitable risk across your attack surface, and delivers it as pre-breach, SOC-level alerts.
• The Blue Agent, our AI investigator that works alongside analysts to investigate active threats with full cloud, code, and runtime context, and reach a confident verdict fast.
Red Agent: Pre-breach alerts your SOC can trust
The Red Agent is an AI-powered pentester that enables teams to uncover complex, validated exploitable risks and remove them before attackers find them, at machine speed. It works alongside Wiz ASM to cover all types of risks- from known risks, such as CVEs and misconfigurations, to the unknown, logic-based risks in custom-built applications, like authorization bypasses that signature-based scanners miss.
Every validated exploitable risk Red Agent finds is a ticking time bomb. Red Agent has already proven the exploit works, so the only open question is who gets there next: your team or an attacker. That calls for pre-breach urgency, not a place in the vulnerability backlog.
Each finding arrives with proof of exploitability, reproduction steps, blast radius context from the Security Graph, and a clear owner and remediation guidance from the Green Agent. Instead of waiting for a detection, teams can shut down the attack path first and respond to fewer incidents.
What is most amazing about Red Agent is the way that we can track and get alerting or visibility on endpoints that can be attacked or manipulated from the outside. It tells me: 'You have an endpoint here, you are missing authentication, you have an exposure.' All of those insights are really, really helping me to close gaps fast.
Roy Weiss, Principal DevSecOps, Fireblocks
What a pre-breach SOC alert looks like
In one finding from our Red Agent POV series, Red Agent found a way into a financial services company's production cloud API without authentication, exposing live cloud credentials and the application's full source code.
Without Red Agent, the SOC might first learn about this risk when those credentials are used from an unfamiliar location, and only then start investigating what the attacker touched. With Red Agent, the SOC can act before an attacker finds it, and close the door on what would have been a breach before it can begin.
The pre-breach playbook
When Red Agent finds a validated exploitable risk, here's a playbook the SOC can follow. The steps will feel familiar from incident response, but they happen before a breach instead of after one. Here's how it works for this example:
1. Triage: already done. Red Agent proved the path is exploitable and provides reproduction steps. There's no "is this real?" debate.
2. Scope: has anyone already used this path? Threat hunters check whether a real attacker got there first. Here, that means assuming and looking for any use of the exposed credentials from unexpected sources.
3. Contain: put a stopgap in place. Rotate the credentials and restrict the endpoint. That buys time before the permanent fix.
4. Hand off: Green Agent routes the fix. The Green Agent identifies who owns the affected application and sends them specific fix guidance, so nobody has to hunt for the owner.
5. Verify: Confirm the path is closed. Once the owner ships the fix, Red Agent retests the same exploitable risk to confirm it no longer works.
Blue Agent: AI investigation for active threats
Proactive alerts shrink the attack surface, but no SOC can close every door instantly. When a threat is active, the Blue Agent takes on the manual investigation steps that usually eat an analyst's day: Is this activity legitimate, a security test, or an attack? What is the blast radius? Have our containment actions worked?
The Blue Agent goes beyond surface-level triage. It pulls together context from the Security Graph, code-to-cloud visibility, and runtime signals, and investigates the way a trained incident responder would. Specialized sub-agents answer the questions analysts would otherwise answer manually. For example, the Forensics sub-agent analyzes forensic evidence captured at detection time by the Wiz Sensor to uncover the root cause of suspicious activity and analyze what actually ran on a machine.
The Blue Agent shows its work: the questions it asked, the data it retrieved, and how each signal shaped the verdict. This ensures analysts can stay in control and trust the delivered verdict. With Wiz Workflows, teams can turn verdicts into action, automatically escalating incidents, notifying response teams, or triggering containment playbooks based on verdict and confidence level.
Agentic security for the SOC: proactive first, defensive always
Detection still matters, but it shouldn't be the first time you hear about a critical, validated, exploitable risk. With Red Agent and Blue Agent, your SOC has AI on both sides of the fight.
Get started with the Red Agent and Blue Agent, read the Red Agent and Blue Agent POV blog series, or book a live demo with our team.
