How Wiz’s Product Security Team Uses Cloud Security Controls and Detection
Summary
Wiz describes how its Product Security team uses the platform for CI/CD scanning, cloud configuration guardrails, custom threat detection, alert triage, threat modeling, and security testing.
Key points
- Wiz CLI and cloud configuration rules scan code, infrastructure-as-code, and build artifacts in CI/CD workflows to flag risks before deployment.
- Custom Rego policies and Kubernetes admission controls can enforce organization-specific requirements and block non-compliant configurations.
- The team uses Wiz Blue Agent to investigate detections and provide initial triage, verdicts, confidence levels, and reasoning.
- Custom detections identify environment-specific anomalies, while alerts and risk issues can be routed into Jira workflows for assessment and tracking.
- Threat modeling and an AI-assisted review agent help identify security-control gaps and potential blast radius during design.
- ProdSec tests security guardrails and uses Red Agent attack simulations to evaluate and refine detection coverage.
Article Details
- Defense Focus
- Operationalize cloud security across development and runtime through CI/CD guardrails, custom threat detection, alert triage, threat modeling, and testing detection coverage.
- Detection Methods
- Use built-in and custom Cloud Configuration Rules (CCRs) to detect cloud posture drift and risky configurations in deployed resources, IaC, and build artifacts.
- Define custom Rego policy-as-code rules for organization-specific resources and compliance needs.
- Build behavioral baselines of activity and alert on deviations, including unexpected access to or creation of resources normally handled only through automation or known machine identities.
- Correlate CCRs and TDRs to monitor Issues involving combinations of vulnerabilities, misconfigurations, and other risk factors.
- Use AI-assisted initial triage to assess detections against telemetry, findings, and risk context, returning a verdict, confidence level, and reasoning.
- Simulate attacks and test detection capabilities against the organization’s infrastructure to identify coverage gaps.
- Data Sources
- Cloud activity telemetry and behavioral baselines
- Cloud resources, findings, and risk context
- Pull requests, secrets, IaC, and build artifacts
- Security graph, resource relationships, CCRs, and TDRs
- Issues combining vulnerabilities, misconfigurations, and other risk factors
- Rule Types
- Cloud Configuration Rules (CCRs)
- Custom Rego policy-as-code rules
- Custom environment-specific threat detections and alerting
- Threat Detection and Response (TDR) rules
- Platforms
- CI/CD pipelines
- Kubernetes clusters
- Cloud environments
- Defensive Actions
- Scan every pull request and block merges when checks identify risky configurations or other issues.
- Enforce configuration requirements with Kubernetes Admission Controllers.
- Route Issues through automated workflows for triage, assessment, and SLA tracking.
- Use AI-assisted triage to prioritize alerts for human investigation.
- Use threat modeling during design to identify trust boundaries, risks, blast radius, and required controls before release.
- Pressure-test guardrails and detection capabilities, then refine rules and deployments based on identified blind spots.
Vendors
Products
Red AgentA concrete example of this partnership is Red Agent, Wiz's AI-powered attack simulation feature, where ProdSec works directly with the product team to test, validate, and refine its detection capabilities against Wiz’sWiz Blue Agentautomation is an essential cornerstone of security operations. The ProdSec team relies on the Wiz Blue Agent to investigate new detections and perform initial triage and assessment: for every threat, it mimicsWiz CLIcausing friction. To catch vulnerabilities and misconfigurations at the source, ProdSec embeds the Wiz CLI directly into developer workflows.Wiz DefendIn addition to the built-in capabilities of Wiz Defend, the ProdSec team needs custom detections that are specific to Wiz’s environment which, similarly to CCR, can be defined as code and used to identifyWiz Workflowsmisconfigurations, and other risk factors that need to be addressed based on severity. Through Wiz Workflows, each Issue triggers automation to put the work in Jira for triaging, assessment, and SLA tracking.