cyber.hendryadrian.com
Security News · wiz.io

Wiz Makes Its AI Penetration-Testing Red Agent Generally Available

· Original article ↗

Summary

Wiz says its Red Agent is generally available for continuous AI-assisted testing of applications and APIs. The company reports finding exploitable risks and describes examples involving exposed credentials, passenger data, and unauthorized flight-booking changes.

Key points

  • Wiz says Red Agent continuously tests applications and APIs for logic flaws, authorization bypasses, and other exploitable risks.
  • The product includes an API crawler, an API testing module, and checks to validate the impact of exposed secrets.
  • Wiz reports that preview scans found more than 10,000 critical exploitable risks; these are company-reported results.
  • In one example, testing bypassed URL restrictions in a GCP Cloud Run application and accessed service-account credentials and source code.
  • Another example involved broken object-level authorization in an airline GraphQL API, exposing passenger information and enabling flight-booking changes.
  • A third example involved bypassing a B2B platform's credit system to retrieve unmasked contact details.

Article Details

Event Type
Wiz announced that Red Agent is generally available.
Impact
During preview, Red Agent reportedly discovered more than 10,000 validated critical exploitable risks; 70% of organizations that enabled it found an previously unknown High or Critical vulnerability, and 35% found their first verified Critical vulnerability within one hour. The article also describes vulnerabilities discovered in live environments that exposed passenger personal information, enabled flight-booking changes, and bypassed a B2B platform's paid access controls.

People

Emil VaaglandIdentified as Head of Product Security at Vend; provided a testimonial about Red Agent.Patrick O’BoyleIdentified as Founding security engineer and Head of GRC at Rogo; provided a testimonial about Red Agent.

Vendors

WizThe Red Agent for attack surface management and automated penetration testing is incredibly valuable. We didn't have coverage over infrastructure-related automated pen testing prior to Wiz.

Products

Green AgentAutomated remediation loop: Paired with Green Agent and Wiz Workflows, Red Agent customers can generate precise fix guidance with the Green Agent and scale response with Wiz Workflows.Red AgentWe are excited to announce that Red Agent is now generally available (GA). Customers have rapidly adopted our AI attacker to close the widening gap between traditional security scanners and the speed at whichRuntime SensorAgent automatically ingests context from different Wiz sources: across API schemas, cloud resources, Runtime Sensor, code repositories, and network layers, and its own AI API Crawler. It being enriched by the WizWiz WorkflowsAutomated remediation loop: Paired with Green Agent and Wiz Workflows, Red Agent customers can generate precise fix guidance with the Green Agent and scale response with Wiz Workflows.

Industries

airlineRed Agent POV series documents how Red Agent identified these logic flaws in live environments across airline, financial, and technology companies:financialPOV series documents how Red Agent identified these logic flaws in live environments across airline, financial, and technology companies:Technologyhow Red Agent identified these logic flaws in live environments across airline, financial, and technology companies:

Related Articles