Wiz Details Red and Blue AI Agents for Proactive SOC Security
Summary
Wiz describes Red Agent for validating exploitable risks before a breach and Blue Agent for investigating active threats using cloud, code, and runtime context. The article also outlines a pre-breach response workflow.
Key points
- Wiz says Red Agent continuously tests attack-surface risks, including CVEs, misconfigurations, and logic flaws in custom applications.
- Red Agent findings reportedly include exploit proof, reproduction steps, blast-radius context, ownership, and remediation guidance.
- In a proof-of-value example, Red Agent found an unauthenticated path to a financial-services company's production cloud API, exposing credentials and source code.
- Wiz's suggested response includes checking for prior use, rotating exposed credentials, restricting the endpoint, assigning remediation, and retesting the risk.
- Blue Agent combines Security Graph, code-to-cloud, and runtime context to investigate active threats; a forensics sub-agent analyzes evidence captured by Wiz Sensor.
- Wiz says Blue Agent explains the questions and evidence behind its verdicts, which teams can use to trigger workflows such as escalation or containment.
Article Details
- Event Type
- Wiz product announcement and capability overview for its Red Agent and Blue Agent, AI agents intended to support proactive security operations and threat investigation.
- Impact
- Wiz says Red Agent continuously finds and validates exploitable risks before a breach, while Blue Agent investigates active threats using cloud, code, and runtime context. In an example from its POV series, Red Agent found an unauthenticated path into a financial services company's production cloud API that exposed live cloud credentials and source code; the article does not identify the company or report a confirmed breach.
People
Vendors
Products
Blue Agent• The Blue Agent, our AI investigator that works alongside analysts to investigate active threats with full cloud, code, and runtime context, and reach a confident verdict fast.Green AgentEach finding arrives with proof of exploitability, reproduction steps, blast radius context from the Security Graph, and a clear owner and remediation guidance from the Green Agent.Red Agent• The Red Agent, our AI-powered attacker that continuously finds and validates exploitable risk across your attack surface, and delivers it as pre-breach, SOC-level alerts.Security GraphEach finding arrives with proof of exploitability, reproduction steps, blast radius context from the Security Graph, and a clear owner and remediation guidance from the Green Agent.Wiz Attack Surface Management (ASM)exploitable risks and remove them before attackers find them, at machine speed. It works alongside Wiz ASM to cover all types of risks- from known risks, such as CVEs and misconfigurations, to the unknown,Wiz SensorFor example, the Forensics sub-agent analyzes forensic evidence captured at detection time by the Wiz Sensor to uncover the root cause of suspicious activity and analyze what actually ran on a machine.Wiz Workflowsshaped the verdict. This ensures analysts can stay in control and trust the delivered verdict. With Wiz Workflows, teams can turn verdicts into action, automatically escalating incidents, notifying response teams, or