Wiz Launches AI-Assisted Program to Find and Fix Public-Sector and Critical Infrastructure Exposures
Summary
Wiz’s Scan for Good uses AI and human researchers to identify and help remediate public exposures at critical infrastructure, public services, nonprofits, and technology providers, reporting hundreds of fixes from authorized testing.
Key points
- The initiative combines Wiz’s AI-powered Red Agent and Gemini models with human validation to identify exposed systems and connected attack paths.
- Wiz says the program has helped remediate hundreds of public exposures through collaboration with affected organizations.
- Reported examples include exposed archive administrator access, hospital data and alert systems, residents’ sensitive information, and a rail operator’s production database.
- Technology-provider cases included risks to AI-training data, payment information, CI/CD credentials, and container images.
- Testing is limited to authorized settings; serious findings are privately disclosed, validated by researchers, and tested only as far as needed to confirm impact.
- Wiz plans to publish anonymized findings after remediation to share vulnerability patterns and lessons for defenders.
Article Details
- Event Type
- Launch of Scan for Good, an authorized AI-assisted security research initiative to identify and help remediate public exposures.
- Impact
- Wiz reports that the initiative has helped organizations remediate hundreds of public exposures, including risks involving sensitive data, administrative access, hospital systems, transportation operations, and production infrastructure. Findings were privately disclosed and validated with human oversight; the article does not report confirmed exploitation.
People
Vendors
Google DeepMindWe would like to thank the team at Google DeepMind for partnering with us to ensure the success of Scan for Good. We’d also like to thank the Cybersecurity and Infrastructure Security Agency (CISA) for engaging with usWizvulnerabilities, which they do largely by reasoning over and analyzing code. Through our work building the Wiz Red Agent – an AI-powered, context-aware pentester – we saw another gap, with more immediate implications:
Products
Tools
Industries
Critical infrastructureresearchers - to uncover public exposures and complex attack paths across public services, critical infrastructure, and nonprofits. HealthcareScan for Good brings these capabilities to organizations where successful exploitation could have an outsized impact, including critical infrastructure, public services, healthcare, and nonprofits.