Challenge
Native security tooling required continuous custom manual work to build dashboards and extract basic threat metrics, creating heavy operational overhead.
Established market solutions prioritized AWS and Azure, leaving Coop’s primary Google Cloud footprint without adequate cloud security coverage.
Uncontextualized telemetry produced over 11,000 raw alerts, creating alert fatigue and lack of context to prioritize real attack paths.
Solution
Wiz provided immediate, agentless visibility across Google Cloud and Azure environments without requiring custom dashboard coding or complex agent management.
Wiz’s contextual risk graph filtered out background noise, enabling Coop to isolate prioritized exposures and join the Zero Critical Club.
Integrated runtime sensors provided deep container coverage, Mika AI streamlined CI/CD pipeline security and accelerated zero-day response times down to hours.
Wiz Green AI agent provided actionable insights to rapidly identify vulnerabilities and enforce least-privilege principles across publicly exposed services.
Zero critical issues
achieved by contextualising alerts, eliminating all critical cloud risks.
24-hour remediation time
achieved for public-facing critical zero-day vulnerabilities without impacting retail operations.
100% agentless visibility
established across hybrid GCP and Azure footprints, replacing custom scripting with instant multi-cloud risk posture insights.
Securing Switzerland’s retail leader at scale
Coop Group is one of Switzerland’s largest retail and wholesale enterprises, employing approximately 100,000 people across its core operations and international subsidiaries in France, Germany, Austria, and beyond. Beyond its widely recognized supermarkets, Coop operates across diverse sectors including consumer electronics, home furnishings, and specialized retail markets.
Over the past five years, Coop has rapidly expanded its digital operations through hybrid cloud environments and artificial intelligence initiatives. Under the leadership of CISO Dominik Bachofner, Coop’s IT security organization focuses on embedding security into technology strategy to enable rapid business expansion without introducing unmanaged risk.
We want to be the business enabler with security. The challenge is merging business, technology strategy, and security together seamlessly.
Dominik Bachofner, CISO, Coop Switzerland
Overcoming visibility gaps and alert fatigue
As Coop migrated key workloads to Google ClouD, complemented by secondary Microsoft Azure instances and on-premise Swiss data centers, the security team initially relied on native CSP tools. However, obtaining visibility into security posture required continuous manual work to create custom dashboards. Simple inquiries regarding active threats or dashboard views consistently required developers to code custom solutions.
When Coop evaluated commercial Cloud Security Posture Management (CSPM) vendors, they encountered a market gap: most established players focused heavily on AWS and Azure, pushing Google Cloud support six to twelve months down their product roadmaps.
Simultaneously, rapidly expanding cloud environments flooded the team with over 11,000 uncontextualized alerts. The security dashboard lit up like a Christmas tree, creating operational friction and making it challenging to give executive leadership a quick answer when asked, "Are we safe?" As Bachofner reflects, "Don't cry when you see 11,000 alerts. The secret with Wiz is changing your perspective and breaking risks down into bite-sized portions you can actually solve.” Coop needed a platform capable of natively supporting Google Cloud, stripping away alert noise, and highlighting true risk.
When we evaluated other big players, they told us Google was off their roadmap for a year. Wiz was ready on day one with the deep Google Cloud support we needed.
Dominik Bachofner, CISO, Coop Switzerland
Unifying multi-cloud security, AI and developer workflows
Coop selected Wiz as an early enterprise partner in Switzerland for its native, day-one Google Cloud support. Wiz’s agentless API discovery provided immediate visibility into cloud assets without disrupting workloads. Coop deployed the Wiz Runtime Sensor across hundreds of container and VM workloads as well as cloud and on-premises Kubernetes clusters. They also leveraged Wiz’s CI/CD scanning pipelines alongside image scanning to ensure complete coverage.
To drive shared responsibility, Coop established the Google Cloud Competence Center, uniting development, architecture, AI, and security teams. This collaboration is supported by scalable governance where Wiz project hierarchies mirror internal Organizational Units (OEs) and landing zones across GCP and Azure, standardizing team onboarding.
Using the Wiz Security Graph across Google Cloud and Azure, Coop can prioritize critical toxic combinations such as internet-exposed assets paired with unpatched vulnerabilities and high-privilege IAM roles. Engineering leads gain direct visibility into their projects with clear remediation guidance. To streamline the process, Coop integrated Wiz Workflows and Mika AI. When Wiz identifies a toxic combination, Wiz Green agent generates a contextual summary, and Wiz Workflows automatically creates a Jira ticket populated with this AI summary and direct portal deep links. This clear operational pipeline accelerates time-to-remediate while minimizing developer friction.
Actionable remediation with Wiz Green Agent
Building on this workflow automation, Coop integrated the Wiz Green AI agent to shift security operations from monitoring to proactive risk elimination.
When Green Agent analyzed a publicly exposed Cloud Run service, it immediately surfaced a critical gap: unauthenticated access combined with excessive IAM permissions. Rather than generating a standard alert, it delivered an exact blueprint to enforce authentication and bring access control strictly in line with least-privilege practices.
Shortly after, in another production service, Green Agent exposed a compound threat involving exploitable software vulnerabilities and risky impersonation rights. By providing step-by-step guidance, including exact package upgrades and granular IAM changes, Green agent enabled Coop’s engineering teams to systematically eliminate attack paths without stalling delivery timelines.
Green Agent doesn’t just show us where we’re exposed, it gives our teams the exact package upgrades and IAM fixes needed to close attack paths fast.
Dominik Bachofner, CISO, Coop Switzerland
Achieving Zero Critical status and rapid zero-day remediation
By leveraging Wiz's contextual analysis, Coop shifted its operational perspective, recognizing that thousands of individual alerts often stemmed from a single underlying risk. By applying targeted policies and filters, the team systematically eliminated critical attack paths across its multi-cloud estate, officially joining the elite Zero Critical Club.
Wiz proved essential during a major zero-day event in November 2025. Using Wiz, Bachofner’s team instantly queried their entire multi-cloud footprint, pinpointing exactly which affected workloads were exposed to the public internet versus those isolated internally. Armed with this instant blast-radius visibility, engineering teams deployed temporary workarounds immediately and fully patched all public-facing critical applications within 24 hours, all without business interruption.
Wiz gave us the speed to identify public-facing critical vulnerabilities in minutes and patch them within 24 hours without disturbing the business.
Dominik Bachofner, CISO, Coop Switzerland
Unified vulnerability management and proactive prevention
As Coop advances its cloud security roadmap, the security team is leveraging Wiz to build out a Unified Vulnerability Management (UVM) framework spanning both cloud environments and on-premise Kubernetes clusters. Upcoming priorities include enforcing strict Identity and Access Management (IAM) governance to eliminate over-privileged service accounts in Google Cloud, expanding runtime sensors across hybrid infrastructure, and transitioning from detection to automated prevention rules to protect against software supply chain threats, such as malicious NPM package attacks.
