Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild

Wiz Threat Research has observed exploitation in-the-wild of CVE-2025-4427 and CVE-2025-4428, the latest vulnerabilities affecting Ivanti Endpoint Manager Mobile EPMM...

Wiz observes exploitation in the wild of PAN-OS vulnerabilities

Detect and mitigate CVE-2024-0012 and CVE-2024-9474, PAN-OS vulnerabilities which Wiz Threat Research has observed being exploited in-the-wild. Organizations should patch urgently...

Securing clouds, securely

Let's take a look at how Wiz designed the agentless workload scanner to be modular and scalable, and what security measures Wiz takes to protect sensitive customer data...

Wiz integrates with Amazon Security Lake to improve cloud security through cloud security data sharing

New integration enables customers to consolidate security logs, run investigations and analyze security metrics in their customer-owned data lake...

The Red Agent POV: How it Reasoned its Way to SSRF

Part 1: How the Red Agent uncovered a multi-step attack chain allowing SSRF-to-Local-File-Read on a GCP Cloud Run API...

It's Here! Wiz Exposure Management is Now GA

Moving beyond CVE counts to true exposure management everywhere with new UVM and ASM capabilities, now GA...

Key Takeaways from the 2025 State of AI in the Cloud Report

From DeepSeek adoption to impact on security and governance...

Introducing Wiz Lens: Role-based views for every security team

Empowerment and speed for security teams without losing unified cloud context...

2025 Cloud Security Predictions: Trends to Look Out for

Wizards share some of the cloud security trends to look out for in 2025...

Under the Radar: Exploring Spring Boot Actuator Misconfigurations

Wiz Threat Research investigates misconfigurations in Spring Boot Actuator’s endpoints that can leak environment variables, passwords, and API keys, and even lead to remote code execution...

Wizards of security, casting spells on themselves for ultimate digital security

Wiz practices what it preaches. Let’s look at how the security team at Wiz uses the power of the Wiz platform to monitor all its cloud-based infrastructure and services...

Introducing the Wiz extension: cloud security delivered to your AWS console

Wiz’s new Chrome browser extension brings cloud security to your fingertips and streamlines access to Wiz from your cloud console...

Wiz is the #1 Cloud Security Company on the 2023 Forbes Cloud 100

Wiz is the 1 cloud security company on the list and one of the biggest movers from last year, alongside OpenAI. What an honor!...

Wiz is on the FedRAMP Marketplace

What our “in process” milestone means, and why it’s great news for the public sector...

Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era

As AI expands who builds software, the developer workstation is becoming a new security perimeter. AI and third-party software increasingly operate with access to your most sensitive credentials and cloud environments...

S3 Clones in the Neoclouds

S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain...

Agentless Threat Detection: Illuminating Cloud Blind Spots

How Agentless Workload Detection exposes hidden threats in virtual appliances and modern cloud networks...

Operationalizing Cloud Security: How PwC and Wiz Help Turn Risk into Resilience

PwC leverages Wiz to empower secure cloud transformation—bridging strategy, visibility, and execution...

Wiz Integrates with NVIDIA Enterprise AI Factory Validated Design

Wiz is now included in the NVIDIA Enterprise AI Factory validated design, integrating with NVIDIA AI to help developers securely build and deploy enterprise AI agents at scale...

Introducing Wiz Service Catalog: Democratize Cloud Security with Application Service Visibility

Empower platform teams and developers to reduce noise, scale ownership, and accelerate remediation across cloud-native apps...

Cloud Detection Without Drowning: The Zero-Noise Approach

By adopting the 'Zero Noise' approach—prioritizing attacker-focused detections, continuous feedback loops, and a 'no alert left behind' mentality—security teams can cut through cloud alert noise, enabling swift and precise responses to true threats...

Avoiding mistakes with AWS OIDC integration conditions

Let’s explore some common missteps in securing your AWS OIDC...

AskAI – Text to Security Graph Query

AskAI – Text to Security Graph Query...

Custom runtime rules and runtime response policies: new layers of defense

Wiz's custom runtime rules and runtime response policies add new layers to your defense-in-depth strategy...

Wiz Acquires Gem Security to Reinvent Threat Detection in the Cloud

We’re pushing for consolidation, bolstering our Cloud Detection and Response capabilities, and delivering on the promise of security operations for the cloud era...

New attack vectors in EKS

We explore how advancements in EKS Access Entries and Pod Identity have opened new attack vectors and offer examples of how adversaries could exploit them...

Wiz recognized with top score for the current offering category in The Forrester Wave™: Cloud Workload Security, Q1, 2024

Learn why Forrester recognized Wiz as the top ranked in the current offering category on the market out of the top 13 providers, and how their analysis connects with the Wiz vision...

5 Surprising facts from the Cloud Security Salary Guide

Wiz is releasing a new report providing insight into various jobs in the field of cloud security and compensation packages they offer; here are 5 key facts from our data...

Storm-0558 Update: Takeaways from Microsoft's recent report

The Wiz research team examines Microsoft's latest Storm-0558 findings and summarizes the key learnings cloud customers should take away from the incident...

$100M ARR in 18 months: Wiz becomes the fastest-growing software company ever

Just two years since its launch, Wiz protects hundreds of the world’s leading organizations by enabling them to build faster and more securely in the cloud...

Log4Shell 10 days later: Enterprises halfway through patching

Wiz and EY Ernest & Young analyzed more than 200 enterprise cloud environments with thousands of cloud accounts. The results were striking: While 93% of all cloud environments are at risk from Log4Shell, on average organizations have patched 45% of their vulnerable cloud resources by Day 10...

Start Secure in the AI Era: Accelerating AI Threat Readiness with WizOS

As the time from vulnerability discovery to exploitation shrinks, building with minimal, secured components is more important than ever. Here is how WizOS helps...

Bridging the Visibility Gap: A Unified Security Operating Model for Hybrid Cloud Teams

Move beyond chasing vulnerabilities to a unified hybrid risk strategy. The Sensor Workload Scanner is now GA and extends our risk prioritization engine to on-premise environments to identify the critical attack paths across your hybrid cloud...

Dirty Frag: Linux Kernel Local Privilege Escalation via ESP and RxRPC

Unpatched kernel flaw chain CVE-2026-43284, CVE-2026-43500 enables root escalation on major Linux distributions...

How to Harden GitHub Actions: An Updated Guide

Build resilient GitHub Actions workflows with lessons from recent attacks like TeamPCP and Axios...

Defense in depth: XZ Utils

We explore assessment, prevention, and detection strategies for protecting your organization from the XZ Utils vulnerability...

Top security talks from KubeCon Europe 2024

KubeCon Europe is the largest open source community conference in Europe with hundreds of talks, many of them about security. All the sessions are available online; in this blog, we’ll discuss our favorites...

Wiz becomes the first CNAPP to provide AI Security Posture Management

Wiz extends its platform to secure AI with AI-SPM capabilities, helping organizations accelerate their AI innovation in the cloud...

Eight questions to measure vulnerability remediation "pain"

What is it about certain vulnerabilities that makes them especially hard to deal with, and how can vendors make things easier for security teams?...

GAO Study Reveals: Government Faces Challenges with Continuous Monitoring

Learn how government agencies can meet the GAO’s recommended cloud security best practices by establishing continuous risk and compliance monitoring in the cloud...

Wiz helps organizations innovate with AI securely and responsibly, launching support for Google Cloud Vertex AI

Wiz protects AI infrastructure against cloud attacks, allowing data scientists and engineers to focus on deploying more AI applications...

Bridging the Security Gap: Mitigating Lateral Movement Risks from On-Premises to Cloud Environments

This blog post will discuss lateral movement risks from on-prem to the cloud. We will explain attacker TTPs, and outline best practices for cloud builders and defenders to help secure their cloud environments and mitigate risk...

Wiz and Google Cloud’s Security Command Center: Modern threat detection and response rooted in risk prioritization

Fully understand the impact and architecture behind any threat to streamline and speed effective response with a first-of-its-kind integration combining the Wiz Security Graph’s deep cloud and multi-cloud risk context with Google Cloud’s Security Command Center’s advanced threat detection...

Securing AWS Lambda function URLs

Learn about the security risks of misconfigured Lambda function URLs and how to properly secure them...

Wiz integrates with the new Amazon Inspector for enhanced security insights, context, and accuracy

Wiz is excited to announce it is a launch partner for the new Amazon Inspector, bringing Amazon Inspector findings together with Wiz insights to give our customers actionable, prioritized and contextually rich security insights...

300 WINtegrations Strong: An Open Security Ecosystem Built for the Speed of AI

As AI accelerates how organizations build and how attackers operate, a deeply connected security ecosystem is how defenders keep up...

The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API

Part 2: How the Red Agent bypassed backend resolvers to expose an entire airline booking database in fifteen minutes...

Introducing the Red Agent POV Series

An inside look at how the Red Agent, our AI-Powered Attacker, uncovers complex, exploitable risks in the wild...

Wiz at Wiz: Reducing Risk through Service Ownership

How Wiz security uses Service Catalog to turn cloud risk into service ownership...

Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign

LiteLLM is the latest victim of TeamPCP’s open-source attack spree. Malicious versions 1.82.7 and 1.82.8 abuse Python’s .pth mechanism for stealthy persistence. The malware exfiltrates cloud credentials, CI/CD secrets, and keys to attacker-controlled domains...