Wiz Adds Runtime Network Signals to Cloud Security Graph to Reveal Attack Paths
Summary
Wiz says its Runtime Sensor now feeds live workload network activity into its Security Graph, correlating connections with existing cloud risks to surface attack paths, including links to sensitive data and remote MCP servers.
Key points
- The Wiz Runtime Sensor captures workload DNS queries and active network connections, and now adds that telemetry to the Wiz Security Graph.
- The graph correlates observed connections with risks such as vulnerabilities, internet exposure, and access to sensitive resources.
- Wiz says runtime context surfaced a high- or critical-severity attack path missed by prior analysis in 1 in 6 environments it monitors.
- Examples include vulnerable, internet-facing workloads with observed connections to sensitive databases, storage, or secrets vaults.
- The capability can reveal AI workloads connecting to remote MCP servers, including connections not defined in configuration or policy.
- Wiz says the feature is available to its Cloud and Runtime Sensor customers and can support targeted remediation recommendations.
Article Details
- Event Type
- Wiz announced a capability that correlates runtime network telemetry from the Wiz Runtime Sensor with risk findings in the Wiz Security Graph to surface validated attack paths as Issues.
- Impact
- The capability gives Wiz customers visibility into active connections between workloads and sensitive destinations, including connections to remote MCP servers, and helps prioritize remediation. Wiz reports that runtime risk context surfaced a high- or critical-severity attack path missed by prior analysis in 1 in 6 monitored environments.
Vendors
Products
Wiz CloudAs of today Wiz Cloud and Runtime Sensor customers both automatically have access to runtime context across Graph Controls and Issues in their environment today. Find more information on this capability in our docsWiz Green Agentwe provide is specific to all three. For the security engineer or developer who picks this up the Wiz Green Agent does the investigation for an active network connection to secrets in Vault - tracing the attack pathWiz Runtime SensorToday, we're adding a new layer of runtime telemetry on top of that foundational risk analysis. The Wiz Runtime Sensor now takes the live network signals it collects directly from your workloads - the active connectionsWiz Security Graphto databases, AI workloads communicating with remote MCP servers and feeds this context into the Wiz Security Graph. The result: attack paths that were never visible before, surfaced as critical Issues alongside the