NotLegit: Azure App Service vulnerability exposed hundreds of source code repositories

Read about the NotLegit vulnerability discovered by the Wiz Research Team, where the Azure App Service exposed hundreds of source code repositories...

How AI Is Rewriting the SecOps Playbook

The threat landscape has changed. Adversaries operate at machine speed, shrinking attacks from days to minutes. Defenders can no longer investigate and respond before damage occurs. In this new era, Security Operations must prioritize speed, automation, and continuous decision-making...

The President’s Executive Actions on AI Have a Lot to Say on Cybersecurity

The spotlight has been on frontier models, but the goals are more far reaching -- including supercharging cyber defense and remediating risk at machine speed...

AI Threat Readiness Pillar 3: Perform AI Code Analysis Natively in Wiz

Your guide to operationalizing AI-powered code analysis with Wiz to stay ahead of AI driven development and adversaries...

AI Threat Readiness Pillar 2: Accelerate Patching and Response

Your guide to operationalizing ownership, remediation, and response with Wiz to keep pace with the AI threat landscape...

Eliminate Critical API Attack Paths with Wiz API SPM

Wiz API SPM is now GA, enabling customers to discover APIs, assess APIs for exploitability, and prioritize remediation to mitigate the risk of an API-related breach...

It's Time to Go After Achieving Zero Code Criticals

Ready to hit Zero Code Criticals? Here's how Wiz helps you get there and stay there, with the badge to prove you did...

Red Agent and Claude Opus: Securing Production Targets at Scale

Delivering enterprise-grade continuous AI-powered risk assessment to hundreds of customers through the combined power of Wiz and Anthropic...

Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)

Details on CVE-2026-3854: A critical flaw in GitHub’s internal git infrastructure enabling RCE on GitHub.com and GitHub Enterprise Server...

KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack

Checkmarx KICS scanner is the latest victim of a credential-stealing supply chain attack by TeamPCP. Between 12:58–16:50 UTC on March 23, 35 tags were hijacked. Learn how to audit your workflows, identify malicious activity, and secure your GitHub Actions...

From MCP to Vibe Coding: Full Endpoint Visibility in Wiz AI Security

How Wiz AI-SPM delivers a complete view of exposed AI application endpoints — from Vibe Coding to MCP — and why that visibility matters...

React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182

We break down the exploit mechanics and detail active in-the-wild attacks observed by our team, from credential harvesting to sophisticated cloud backdoors...

Lean and Mean: How We Fine-Tuned a Small Language Model for Secret Detection in Code

Building an efficient small language model for cybersecurity, from data prep to deployment...

Research Briefing: MCP Security

The present and future of security for the Model Context Protocol...

Ultralytics AI Library Hacked via GitHub for Cryptomining

A supply chain attack on Ultralytics exploited GitHub Actions to inject malicious PyPI packages. Discover how it unfolded and the steps to mitigate the risk...

Introducing pattern-based agentless malware detection using YARA rules

Wiz is expanding our existing detection capabilities to include pattern-based malware detection using YARA rules written by the Wiz Research team...

The magic of inclusion: Wiz’s journey to democratize cloud security

Empowering every cloud security stakeholder by eliminating barriers...

Stay safe with Wiz's winning hand for securing Kubernetes

Ensure that your Kubernetes environments are secure and follow OWASP's Kubernetes Top 10 framework. Generate reports quickly and easily and remediate any issues with actionable insights...

Midnight Blizzard attack on Microsoft corporate environment: a detailed analysis, detections and recommendations

Get a detailed analysis of the entire attack chain of Microsoft's breach by Midnight Blizzard APT29, as well as detection and mitigation recommendations...

New EKS Access Management and Pod Identity features: a security analysis

The Wiz research team unpacks the security implications of the new EKS access and identity management features and recommends best practices when using them...

Wiz Research presents its latest report: “State of AI in the Cloud 2024”

Get a sneak peek at the Wiz research team’s new report examining key observations about AI use in the cloud...

Choosing an AI-SPM tool: The four questions every security organization needs to ask

Ensure you are staying secure as your organization adopts AI by following these four guiding questions...

Fortify your cloud security with Wiz as it integrates with Microsoft Sentinel

Lock down your cloud infrastructure with the new Wiz integration with Microsoft Sentinel. Gain full context, support thorough investigations, and automate your response for ultimate security...

Kubernetes API limitations in finding non-standard pods and containers

Gain a deeper understanding of why it's essential to monitor non-standard pods and containers, including static pods, mirror pods, init containers, pause containers, and ephemeral containers within your Kubernetes environment...

Wiz becomes the first CNAPP to provide end-to-end cloud forensics experience

Wiz helps simplify incident response in the cloud for faster investigation of security incidents...

Hell’s Keychain: Supply-chain vulnerability in IBM Cloud Databases for PostgreSQL allows potential unauthorized database access

How IBM Cloud caught us exploring its infrastructure and how a hardcoded secret eventually led to build artifact access and manipulation...

Meet new Wiz board member Emily Heath

Q&A: Why Wiz caught the attention of DocuSign’s Former CTSO...

See the best of Wiz at AWS re:Inforce

Visit our booth and attend one of our many sessions at re:Inforce this week...

Wiz extends CNAPP leadership with protection for Alibaba Cloud

Support for Alibaba Cloud follows just weeks after launch of Oracle Cloud Infrastructure OCI integration, providing organizations the broadest coverage of any cloud native application protection platform CNAPP...

Announcing the 2026 Wiz Partner Alliance Award Winners

Recognizing the partners, integrators, and visionaries driving cloud security transformation, AI risk management, and SOC modernization across AMER, EMEA, and ANZ...

Black Hat 2026におけるWiz：AI脅威への備えを推進

可視性を拡大し、対応を加速させることで、組織が AI 時代に備え、セキュリティ チームがマシン スピードで防御できるように支援する新機能を発表します。...

Atlasのご紹介：WizのAI脆弱性リサーチャー

実証可能なリアルなエクスプロイトを用いてすべての検出結果を検証する、脆弱性調査のための自律型AIシステム「Atlas」をWizがどのように構築したかをご覧ください。...

M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

Detect and mitigate malicious @asyncapi npm packages linked to the latest npm supply chain attack...

MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension

By automatically loading MCP servers from workspace files, Amazon Q enabled attackers to execute code and access sensitive cloud environments...

Critical Buffer Overflow Vulnerability in PAN-OS Exploited in-the-Wild

Detect and mitigate CVE-2026-0300, a critical vulnerability in Palo Alto Networks PAN-OS User-ID Authentication Portal that allows unauthenticated attackers to achieve remote code execution RCE with root privileges...

AI Agents vs Humans: Who Wins at Web Hacking in 2026?

Wiz Research teamed up with Irregular, a frontier AI security lab, to settle this once and for all...

Agentic Browser Security: 2025 Year-End Review

Are agentic browsers the new Flash? A 2025 review of new attacks, vendor security layers, and a roadmap for navigating AI browser risks...

Introducing Wiz Incident Response: Your Expert Partner for Cloud Security Incidents

Announcing the public preview of Wiz’s in-house Incident Response service—empowering customers to investigate, contain, and resolve cyber incidents with confidence...

NVIDIAScape - Critical NVIDIA AI Vulnerability: A Three-Line Container Escape in NVIDIA Container Toolkit (CVE-2025-23266)

New critical vulnerability with 9.0 CVSS presents systemic risk to the AI ecosystem, carries widespread implications for AI infrastructure...

Critical vulnerabilities in NetScaler ADC exploited in-the-wild: everything you need to know

Detect and mitigate CVE-2025-5349, CVE-2025-5777, and CVE-2025-6543, Citrix Netscaler ADC and Gateway vulnerabilities being exploited in the wild. Organizations should patch urgently...

Wiz Expands Runtime Protection to Serverless Containers

Wiz extends its cloud-native runtime sensor to secure serverless containers, providing deep visibility, blocking, and hunting capabilities for AWS Fargate and Azure Container Apps...

CISOs share their top 7 strategies for gaining C-Suite buy-in

In a recent webinar hosted by Wiz, three esteemed CISOs shared their strategies for getting C-suite executives on board with plans for a comprehensive security program...

Biden's AI Executive Order: What it says, and what it means for security teams

The 2023 Executive Order has far-reaching implications for companies relying on AI. Here is a breakdown of it through the lens of a Security Engineer, including an analysis, a summary of the impact on AI safety and privacy protection, and a look at how the order will affect security teams...

Wiz launches data center in Mumbai, supporting the growing operations of global organizations in India

Wiz is proud to announce the opening of its data center in Mumbai, India...

I know what you mined last summer: summarizing Summer '23 cryptomining activity

During the summer of 2023, using the Wiz Sensor, Wiz Research detected several different cryptomining campaigns targeting cloud workloads. Learn about these campaigns and their associated IoCs, and how to detect and prevent similar threats...

How to leverage generative AI in cloud apps without putting user data at risk

Learn security best practices to deploy generative AI models as part of your multi-tenant cloud applications and avoid putting your customers’ data at risk...

Three tips for building your CISO career in today’s evolving security industry

CISOs share how to build effective, collaborative teams and land your next role...

BingBang: How a simple developer mistake could have led to Bing.com takeover

How a misconfiguration in a Microsoft Bing.com application allowed Wiz Research to modify Bing’s search results – and potentially compromise the private data of millions of Bing users...

Wiz and AWS CloudTrail Lake: Cloud security and compliance posture audits made easy

Simplify and centralize security and compliance management by sending audit-worthy events from Wiz into AWS CloudTrail Lake...

Detect and prioritize CISA Known Exploited Vulnerabilities in the cloud with Wiz

For each CVE, the Wiz Research team maintains data from multiple threat intelligence sources and our own independent research. Now that we’ve added support for the new CISA KEV catalog, learn how you can use it in your cloud environment...