From Detection to Remediation: It’s Time to Rethink AppSec Around Exploitability and Root Cause Fixes

Learn how Wiz is fundamentally changing AppSec by using the Security Graph to connect validated runtime vulnerabilities directly back to source code. Stop chasing alerts and fix what’s truly exploitable...

The Agile FedRAMP Playbook, Part 1: Why Risk is Your Best Starting Point

Compliance shouldn't mean a standstill for innovation. The first of our four-part series explores how Wiz quickly reached FedRAMP High through a "risk-first" philosophy. In parts 2-4 we’ll explore how Wiz helps with FedRAMP requirements through proactive, preventative, and reactive risk managemen...

Introducing AI Cyber Model Arena: A Real-World Benchmark for AI Agents in Cybersecurity

Wiz Research’s AI Cyber Model Arena benchmarks offensive AI security on 257 real-world challenges zero-days, CVEs, API/web, and cloud across AWS/Azure/GCP/K8s demonstrating what AI models and agents can really do...

Wiz + Spotify Backstage: Security at the Developer’s Desk

Bring Wiz Issues directly into Backstage, so developers can act on security issues in the tools they use everyday...

Building AI Security Together: New Ways to Partner with Wiz for AI Security in 2026

Enhancing the Wiz Integration Network with a new WIN MCP, developer AI agent, WIN AI security category, and partner AI hackathon...

Hacking Moltbook: The AI Social Network Any Human Can Control

1 exposed database. 35,000 emails. 1.5M API keys. And 17,000 humans behind the not-so-autonomous AI network...

The Year in Wiz Research: 2025 Most Read Blogs

A look back at the cloud security investigations and vulnerabilities that defined the year, from AI breakthroughs to supply chain shifts...

AI Agents vs Humans: Who Wins at Web Hacking in 2026?

Wiz Research teamed up with Irregular, a frontier AI security lab, to settle this once and for all...

Introducing the WIN Partner Index: The Integrations That Powered Modern Cloud Security in 2025

A data-driven industry benchmark showing how integrations are adopted, gain traction, and deliver value across modern cloud security programs...

AI-Powered Forensics, at Cloud Speed

Reviewing Wiz’s approach to forensics in the cloud era, and announcing the public preview of AI-powered, context-aware forensics capabilities...

Introducing SITF: The First Threat Framework Dedicated to SDLC Infrastructure

Moving beyond simple checklists to visualize, map, and block attacks on production SDLC infrastructure...

WizExtend is Here: AI and Cloud Security Insights in Your Daily Workflow

Get risk insights and take remediation actions right from your in-browser CSP portal, VCS console, or as you’re reading up on the latest threat research...

From Detection to Remediation: Wiz in Your JetBrains IDE

The Wiz JetBrains IDE plugin is now generally available, enabling developers to fix risks before code leaves their local environment...

Agentic Browser Security: 2025 Year-End Review

Are agentic browsers the new Flash? A 2025 review of new attacks, vendor security layers, and a roadmap for navigating AI browser risks...

CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild

Wiz Research discovered a critical supply chain vulnerability that abused a CodeBuild misconfiguration to take over key AWS GitHub repositories - including the JavaScript SDK powering the AWS Console...

A 90-Day Action Plan to Turn Resolutions into Results with Wiz

Whether you’re new to Wiz or early in your cloud security journey, start the year strong by turning cloud security resolutions into real impact in your first 90 days with Wiz...

Introducing the Wiz Partner Alliance: A New Chapter for Partner Success

Building the future of cloud security, together...

Preparing for Post-Quantum Cryptography

Learn what you can do today to prepare for Q-Day...

Wiz Recognized as a 2025 Customers’ Choice in the Gartner® Peer Insights™ Voice of the Customer for CNAPP

Wiz is proud to be the only vendor recognized as a Customers’ Choice for two consecutive years...

Expanding the Zero Critical Club to set a new standard for AppSec and SecOps teams

We are introducing Zero Code Criticals and Zero Time to Respond clubs to give every team a clear north star for secure development and rapid response...

Snipping the Long Tail of Shai-Hulud 2.0

Wiz Research reveals the data behind Shai-Hulud's 2.0 long tail, the massive gap in cloud credential rotation, a potential link to the Trust Wallet incident, and how we finally "snipped the tail" on a month of ongoing infections...

Protecting Against Zero-Day Vulnerabilities with SOC-Level ASM Alert

Outpacing React2Shell using pre-breach alerts from Wiz ASM to eliminate exploitable risk before attackers find them...

MongoBleed (CVE-2025-14847) exploited in the wild: everything you need to know

Detect and mitigate CVE-2025-14847, an unauthenticated information leak vulnerability in MongoDB. Exploitation has been observed in the wild. Organizations should patch urgently...

The Kenna Transition: Your Strategic Shift to Exposure Management

How the Kenna sunset is giving security leaders the opportunity to outgrow vulnerability silos and adopt a unified exposure management model...

From MCP to Vibe Coding: Full Endpoint Visibility in Wiz AI Security

How Wiz AI-SPM delivers a complete view of exposed AI application endpoints — from Vibe Coding to MCP — and why that visibility matters...

Bringing Oracle Cloud Identity to Wiz

Unified visibility into OCI identities, permissions, and policies — mapped into Wiz’s Security Graph...

Zero‑Days in the Age of AI: Behind the Scenes of ZeroDay.cloud 2025, with a Record High of CVEs in Critical Cloud Infra

ZDC awarded hackers $320,000 and uncovered a record‑breaking tally of critical CVEs for core cloud infrastructure, underscoring the scale and urgency of securing the open‑source software that underpins the modern cloud...

Gogs 0-Day Exploited in the Wild

Wiz Threat Research has observed exploitation in-the-wild of CVE-2025-8110...

Code to Cloud Attacks: From Github PAT to Cloud Control Plane

How attackers are leveraging compromised employee GitHub Personal Access Tokens to compromise cloud environments...

Top AWS re:Invent Announcements for Security Teams in 2025

The re:Invent announcements that are most impactful to security teams...

React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182

We break down the exploit mechanics and detail active in-the-wild attacks observed by our team, from credential harvesting to sophisticated cloud backdoors...

React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability

Detect and mitigate React2Shell CVE-2025-55182, critical RCE vulnerability in React and Next.js exploited in the wild. Organizations should patch urgently...

Wiz Product Announcements at re:Invent 2025: Expanding Visibility from Code to Cloud

Check out new product releases that help security and engineers work together to keep cloud environments secure...

Introducing Wiz SAST: Where Code Risk Meets Cloud Context

Modern code runs in complex and distributed cloud environments. Wiz SAST meets this complexity by correlating code flaws with real cloud context–including where workloads run, what they can access, and how exposed they are...

Wiz Becomes Fastest Security ISV to Reach $1 Billion in AWS Marketplace Lifetime Sales

A milestone fueled by customer trust and a partnership built for scale...

It's Here! Wiz Exposure Management is Now GA

Moving beyond CVE counts to true exposure management everywhere with new UVM and ASM capabilities, now GA...

Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact

A deeper look at the Shai-Hulud 2.0 supply chain attack: reviewing the infection spread, victimology, leaked secrets distribution, and community response so far...

Service Catalog is Here: Expand Risk Visibility for Your Service and Its Dependencies, Simplify Issue Ownership

Give security and developers a shared view of cloud risk, aligned to the way applications are built and maintained...

WizOS: Powering Secured Image Adoption with AI

WizOS is now GA to help every organization reduce CVEs and build on a trusted foundation...

3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs

How OAuth tokens, JWT fields and Entra sign-in logs reveal attacker behavior, and how to turn those signals into reliable detections...

Mastering Software Governance with Hosted Technologies Inventory

Gain visibility into every technology in your environment and eliminate governance gaps...

Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets

Detect and mitigate malicious npm packages linked to the recent Shai-Hulud-style campaign. Over 25,000 affected repositories across 350 unique users...

Get Certified on Wiz Defend for Threat Detection and Response

Wiz Defend Certification validates skills in cloud threat detection and response for SOC, IT, and security professionals...

Blueprint for Security: A Guide to Code, Governance, and Response Frameworks

Building a Foundation for Security and Compliance...

Google Unified Security Recommended Program Names Wiz Among First 3 Strategic Partners

Inaugural partner program reflects commitment to building an open, unified future for security...

Introducing Posture Issues: Transform Security Findings into Actionable Outcomes

Streamline Security Backlogs by Grouping Vulnerabilities, Secrets, and Data Findings into Posture Issues...

Empower and Accelerate Your SOC with the Wiz SecOps AI Agent

Meet the SecOps AI Agent: AI-powered threat triage built on the Wiz platform. Investigate every threat with speed and transparency...

Empower and Accelerate Your SOC with the Blue Agent

Meet the Blue Agent: AI-powered threat triage built on the Wiz platform. Investigate every threat with speed and transparency...

Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks

How secure are top private AI companies? Find out from our scans and disclosures...

Wizdom 2025 Product Announcements: Extending the Cloud Operating Model

At Wizdom 2025, we’re unveiling two new AI agents alongside new product innovations that deepen and extend the graph across SaaS, workloads, AI infrastructure, and external exposures. Together, these advances enable teams to secure everything they build and run in the cloud and beyond...