Wiz Promotes Unified Runtime and Agentless Security for Cloud and AI Workloads
Summary
Wiz describes how its Runtime Sensor and Security Graph combine live workload telemetry with cloud context, highlighting recent detection, forensics, and AI-security capabilities alongside customer examples.
Key points
- Wiz says its eBPF-based Runtime Sensor monitors activity across containers, Kubernetes, VMs, serverless, Windows, and AI infrastructure, feeding signals into its Security Graph.
- Recent updates include Windows runtime detection, Google Cloud Run coverage, automated forensic capture, and a Blue Agent that investigates threats and links activity to source code.
- Wiz says runtime network telemetry surfaced high- or critical-severity attack paths missed by prior analysis in one in six environments it monitors at runtime.
- The article describes AI threat detection across model inputs and outputs, workload behavior, and cloud identities and resources.
- A simulated AI-agent attack illustrates how runtime evidence and cloud context can help identify prompt injection leading to a reverse shell and data exfiltration.
- Customer examples describe using runtime context to validate loaded vulnerabilities and consolidate detection; Redis reports 85.7% Blue Agent accuracy across 431 cases, with a false negative rate below 2%.
Article Details
- Event Type
- Wiz product and platform capability announcements for runtime security, including runtime telemetry, threat detection, forensics, AI-assisted investigation, and expanded workload coverage.
- Impact
- Wiz says its Runtime Sensor and Security Graph combine runtime observations with cloud context to detect and investigate live threats, validate vulnerabilities against what is loaded in memory, and identify potential attack paths. The article reports that runtime context surfaced a high- or critical-severity attack path missed by prior analysis in 1 in 6 monitored environments. Customer-reported outcomes include Blue Agent accuracy of 85.7% across 431 cases and a false negative rate below 2%.
People
Vendors
Amazon Web ServicesCompletes our serverless container coverage alongside AWS Fargate and Azure Container Apps.AzureCompletes our serverless container coverage alongside AWS Fargate and Azure Container Apps.GoogleRuntime threat detection for Google Cloud Run (May 19, 2026).VMwareThe Sensor Workload Scanner extends runtime-aware scanning to VMs in private cloud environments like VMware and OpenStack, self-hosted Kubernetes clusters like OpenShift, and bare metal and edge workloads, validatingWiz"Does Wiz actually do runtime, or is it just risk prevention?"
Products
AWS FargateCompletes our serverless container coverage alongside AWS Fargate and Azure Container Apps.Azure Container AppsCompletes our serverless container coverage alongside AWS Fargate and Azure Container Apps.GKEbefore committing. They proved it didn't degrade performance, and the Sensor now runs across their managed GKE clusters. What sold them was seeing a vulnerability validated by the Sensor as loaded into memory, whichGoogle Cloud RunRuntime threat detection for Google Cloud Run (May 19, 2026).OpenShiftto VMs in private cloud environments like VMware and OpenStack, self-hosted Kubernetes clusters like OpenShift, and bare metal and edge workloads, validating vulnerabilities against what is actually loaded in memoryWiz Blue AgentThe Wiz Blue Agent, now GA for all Wiz Defend customers (March 30, 2026).Wiz Defendexecuting on your workloads: containers, Kubernetes, VMs, serverless, Windows, and AI infrastructure. Wiz Defend is the detection and response layer built on top of it. Together they detect and respond to liveWiz ForensicsWiz Forensics, now GA (May 27, 2026).Wiz Runtime SensorSo we built for that. The Wiz Runtime Sensor is a lightweight eBPF sensor that observes what is actually executing on your workloads: containers, Kubernetes, VMs, serverless, Windows, and AI infrastructure. Wiz DefendWiz Security Graphon every workload. So we built agentless Cloud Connectors and mapped all resources and risks on the Wiz Security Graph, and gave teams a way to see the toxic combinations of risks across an entire cloud estate inWiz WorkflowsVerdicts feed straight into Wiz Workflows for escalation and containment.