Lateral movement risks in the cloud and how to prevent them – Part 1: the network layer (VPC)

In this first blog post, we will introduce lateral movement as it pertains to the VPC. We will discuss attacker TTPs, and outline best practices for security practitioners and cloud builders to help secure their cloud environment and reduce risk...

The cloud has an isolation problem: PostgreSQL vulnerabilities affect multiple cloud vendors

How Wiz Research uncovered multiple related vulnerabilities in PostgreSQL-as-a-Service offerings from GCP, Azure, and others...

A new vision for cloud security unites builders and defenders

Our introduction of attack path analysis APA and Cloud Detection and Response CDR further enriches the context provided by our foundational Wiz Security Graph...

Wiz launches cloud detection and response to help organizations quickly identify threats and limit breach exposure

Wiz today unveiled new advancements to its cloud security platform...

Wiz and RegScale: Cloud security compliance management at scale

Learn how to achieve compliance security at scale with Wiz and RegScale, supporting a variety of compliance framework controls...

Wiz goes (even more) global

The first half of 2021 has been incredible for Wiz. Fueled by an additional $250M in funding $350M total from Sequoia, Index Ventures, Insight, Salesforce, Blackstone, Advent, Greenoaks, and Aglaé Wiz has grown at a blistering pace, going from 25 employees at the start of the year to 120 today...

Democratizing FinOps with Wiz: Driving Cost Attribution with the Wiz Service Catalog

How the Wiz Cloud Cost automates cost allocation to power developer-led cost optimization and connect cost to business value...

How to Spot and Stop Rogue Device Joins

Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attack...

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign...

Wiz Brings Automated DISA STIG Assessment to Amazon Linux 2023 and Windows Server 2025

Automating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation...

It’s Official: Wiz Joins Google

Welcoming a new era of Cloud and AI Security...

Wiz Achieves CPSTIC Certification in Spain

Strengthening secure cloud modernization for Spain’s public sector through CPSTIC certification...

The Agile FedRAMP Playbook, Part 2: Proactive Risk Management with Continuous Monitoring

In the second part of our series, we dive into Proactive Risk Management. Discover how Wiz for U.S. Government automates visibility and prioritizes risk remediation to meet FedRAMP continuous monitoring requirements without slowing down innovation...

From Detection to Remediation: It’s Time to Rethink AppSec Around Exploitability and Root Cause Fixes

Learn how Wiz is fundamentally changing AppSec by using the Security Graph to connect validated runtime vulnerabilities directly back to source code. Stop chasing alerts and fix what’s truly exploitable...

Hacking Moltbook: The AI Social Network Any Human Can Control

1 exposed database. 35,000 emails. 1.5M API keys. And 17,000 humans behind the not-so-autonomous AI network...

A 90-Day Action Plan to Turn Resolutions into Results with Wiz

Whether you’re new to Wiz or early in your cloud security journey, start the year strong by turning cloud security resolutions into real impact in your first 90 days with Wiz...

Expanding the Zero Critical Club to set a new standard for AppSec and SecOps teams

We are introducing Zero Code Criticals and Zero Time to Respond clubs to give every team a clear north star for secure development and rapid response...

Wiz Product Announcements at re:Invent 2025: Expanding Visibility from Code to Cloud

Check out new product releases that help security and engineers work together to keep cloud environments secure...

Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact

A deeper look at the Shai-Hulud 2.0 supply chain attack: reviewing the infection spread, victimology, leaked secrets distribution, and community response so far...

Empower and Accelerate Your SOC with the Blue Agent

Meet the Blue Agent: AI-powered threat triage built on the Wiz platform. Investigate every threat with speed and transparency...

Securing Critical Infrastructure in the Cloud Era: A Policy and Technology Blueprint

Why Securing Critical Infrastructure Requires a Modern Approach...

Bringing Visibility to Kubernetes: Unified Inventory and Network Insight

Bridge the gap between Platform and Security teams with unified inventory and network visibility across Kubernetes clusters...

Introducing HoneyBee: How We Automate Honeypot Deployment for Threat Research

Turning attacker insights into stronger cloud security protections...

AI Security 101: Mapping the AI Attack Surface

A practical guide to the risks, blind spots, and protections every security team needs to know...

Beyond CVEs: The Exploitation of Everyday Misconfigurations

Exploring how simple setup flaws become open doors for attackers—and what teams can do to shut them...

Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware

Detect and mitigate a critical supply chain compromise affecting over 100+ packages, organizations should act urgently...

DORA Compliance in the Cloud Era: Insights from Deloitte and Wiz

How to address DORA compliance challenges with Wiz and Deloitte...

Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond

A deeper look at the npm debug/chalk supply-chain incident: deobfuscating the wallet-hijacking browser interceptor, quantifying the 2-hour exposure with Wiz telemetry 99% package prevalence, 10% malware presence, and unpacking what made it spread so fast...

The insider’s guide to Black Hat 2025

Cut through 100+ talks to find what matters: AI vulnerabilities, cloud attacks, and where to grab drinks...

What the U.S. AI Action Plan Means For Cyber Defenders

In the race to lead in AI, the U.S. is prioritizing rapid innovation and national security...

DevOps Tools Targeted for Cryptojacking

The Wiz Threat Research team has identified a widespread cryptojacking campaign targeting commonly used DevOps applications including Nomad and Consul...

Conquer HIPAA Controls With Wiz

Demystifying HIPAA: How Wiz Can Be Your Compliance Ally...

Introducing Wiz Defend: Redefining a new standard for cloud detection and response

Accelerate your cloud SecOps transformation...

The Overlooked Attack Surface: Securing Code Repositories, Pipelines, and Developer Infrastructure

Learn how Wiz for ASPM extends security to developer infrastructure by continuously enforcing secure defaults and detecting threats across the software supply chain...

The Basics of AWS Infrastructure Security

Discover key strategies to strengthen your AWS security posture, from applying protection at all layers to understanding shared responsibility in the cloud...

Tracking cloud-fluent threat actors - Part two: Behavioral cloud IOCs

Discover how behavioral cloud IOCs can expose malicious activity as we break down real-world examples to reveal actionable detection techniques...

A Cloud-First Approach to Vulnerability Remediation: A Holistic Approach

Learn about how Wiz helps organizations operationalize vulnerability remediation with true code-to-cloud visibility...

Tracking cloud-fluent threat actors - Part one: Atomic cloud IOCs

Strategies for tracking and defending against malicious activity and threats in the cloud using atomic indicators of compromise IOCs...

AWS Console Session Traceability: How Attackers Obfuscate Identity Through the AWS Console

Attackers can take advantage of a quirk of the default AWS configuration without SourceIdentity configured to potentially make detecting and attributing their actions more difficult...

Defeating Kubernetes Privilege Escalation: A Cloud Detection & Response Case Study

This case study serves to highlight the importance of rapid, heuristic, accurate, and contextualized detection and response in the cloud...

Strategies for performing security migrations

Advice for tackling and completing these major projects, including metrics, alerts, and prevention strategies...

Increasing transparency in cloud security: Wiz is now a CVE Numbering Authority (CNA)

Our next steps and hope for the industry...

Enhance existing security workflows with high-fidelity cloud security data from Wiz in ServiceNow

Add Wiz’s cloud and container security context to your organization's ServiceNow CMDB, vulnerability response, and IT service management solutions...

Monitor sensitive data [3**-** ***7] that resides in code

Monitor code for sensitive data to reduce the risk of accidental exposure or compliance violation...

How to supercharge collaboration between your security, development, and DevOps teams

Industry-leading CISOs share advice and best practices to break down internal barriers and reinforce cloud security...

What are the biggest cyberthreats heading our way in 2023?

Wiz and Procter & Gamble experts share their security insights and tips...

Enhanced policy management with GitOps and Terraform

Wiz announces new GitOps workflows and Terraform provider, enabling customers to manage policies as code...

KubeCon + CloudNativeCon North America 2022: Our top 10 sessions to attend

KubeCon 2022 will be full of great presentations and content. Here's our take on the conference sessions apart from our own that you shouldn't miss, whether you're onsite or attending virtually...

New customers, new clouds, new challenges

Companies are turning to Wiz every day to gain instant visibility into their cloud environments...

The top cloud security threats to be aware of in 2022

As more organizations move to the cloud, so do attackers. What can you do to better protect your cloud environment in 2022? Wiz Research has compiled the most pressing cloud security threats and how you can protect against them...