Wiz Outlines Layered AI System for Continuous Application Security Scanning
Summary
Wiz describes a layered application-security system combining rule-based scans, continuous AI analysis and targeted agentic testing, using cloud and runtime context to prioritize deeper investigation. AI SAST is in private preview.
Key points
- Wiz proposes three scanning layers: deterministic baseline checks, continuous AI reasoning, and targeted deep analysis for higher-risk applications.
- The system is intended to identify complex logic flaws that traditional pattern-based scanners may miss.
- Wiz says cloud, identity, exposure and runtime context will help prioritize which findings warrant deeper investigation.
- Wiz AI SAST, for continuous analysis of first-party code, is in private preview; the article describes Wiz Red Agent and rule-based scanning as generally available.
- Wiz plans to use its Atlas system as a specialized deep-analysis engine and says the platform can orchestrate third-party engines, including Google CodeMender.
- The article presents this as Wiz’s product approach; it does not report independent evaluations of the announced system’s effectiveness.
Article Details
- Event Type
- Wiz announced its layered, agentic application security system, combining deterministic scanning, continuous AI analysis, and targeted AI pentesting.
- Impact
- The system is designed to help organizations identify and prioritize code and application vulnerabilities by combining code, cloud, identity, exposure, and runtime context. Wiz says it can prevent known risks before code is merged, surface complex logic flaws, prioritize actionable fixes, and direct deeper analysis toward higher-risk applications. Wiz AI SAST is in private preview; other capabilities described include GA products.
Vendors
Googlealso orchestrate specialized third-party engines where they add differentiated capability. For example, Google CodeMender, is an early example, contributing complementary analysis and remediation. Over time, Wiz willWizEarlier this week, we shared results from Wiz Atlas, our AI vulnerability research system that achieved a 90.8% success rate on CyberGym and uncovered more than 200 previously unknown vulnerabilities. Atlas demonstrated
Products
Google CodeMenderorchestrate specialized third-party engines where they add differentiated capability. For example, Google CodeMender, is an early example, contributing complementary analysis and remediation. Over time, Wiz will routeWiz AI SASTCode — Wiz AI SAST (Private Preview): This brings AI-powered analysis to your first-party code, surfacing the complex business logic flaws that traditional pattern-matching misses. It works the way a security researcherWiz ASMCloud — Wiz ASM (GA): Continuously identifies exposed assets, weak credentials, misconfigurations, and other known attack-surface risks.Wiz AtlasEarlier this week, we shared results from Wiz Atlas, our AI vulnerability research system that achieved a 90.8% success rate on CyberGym and uncovered more than 200 previously unknown vulnerabilities. Atlas demonstratedWiz CodeThat is the role of Wiz Code. Powered by the Wiz Security Graph, it connects code with runtime, identities, deployments, and attack surface to determine which applications need deterministic scanning, which needWiz Red AgentCloud — Wiz Red Agent (GA): Complements continuous ASM scans by autonomously testing live environments and applications using AI, helping teams understand which exposures can lead to real attack paths.Wiz Rule-Based SASTCode — Wiz Rule-Based SAST (GA): Automatically blocks known patterns, insecure code, and hardcoded secrets before they are merged into your repository.Wiz Security Graphcontinuous, and deep scanning run across both code and the live application environment, with the Wiz Security Graph connecting them into a single system.