Wiz Opens Public Preview of SAST Tool With Code-to-Cloud Risk Context
Summary
Wiz says its SAST tool is in public preview for Wiz Code customers, with repository and pull request scanning, Security Graph context, AI-assisted triage and remediation, and integrations for findings from other scanners.
Key points
- Wiz SAST is available in public preview to Wiz Code customers, with repository and pull request scanning.
- The tool connects code findings to deployment context, including where code runs, exposure, permissions, and access to sensitive data.
- Wiz says its Security Graph correlates SAST findings with runtime and cloud context to prioritize potentially higher-risk issues.
- Examples include path traversal in workloads with sensitive hostPath mappings, code injection in privileged containers, and SQL injection in internet-exposed workloads.
- The tool links findings to repositories, code owners, and source locations, and offers AI-assisted triage and remediation suggestions.
- Wiz says its platform can also ingest findings from scanners including Checkmarx, Semgrep, and Snyk Code.
Article Details
- Event Type
- Wiz announced Wiz SAST in Public Preview, adding static application security testing to its Wiz Code platform with cloud-context enrichment and AI-assisted triage and remediation.
- Impact
- Wiz SAST connects code findings to deployment and runtime context to help teams prioritize vulnerabilities based on exposure, privileges, and access to sensitive data, and links findings to repositories and code owners for remediation. It is available to Wiz Code customers in Public Preview.
People
Vendors
Products
Wiz CodeWiz Code was built from day one as a complete ASPM platform to keep pace with that speed, combining native scanning for SCA, secrets, sensitive data, IaC, and supply chain posture with the flexibility to ingest findingsWiz SASTToday, we’re expanding that foundation with Wiz SAST in Public Preview, enabling teams to scan their applications' code, understand its runtime impact, and fix issues using the same unified graph and workflows.Wiz Security Graphto ingest findings from popular code scanners. By bringing these signals together in the Wiz Security Graph, customers can correlate issues from code to cloud and drive action through the tools and workflows
Tools
CheckmarxAnd for organizations using other scanners, Wiz ingests findings from tools like Checkmarx, Semgrep, Snyk Code, and others, enriching them with the same cloud context to deliver a unified view of risk.SemgrepAnd for organizations using other scanners, Wiz ingests findings from tools like Checkmarx, Semgrep, Snyk Code, and others, enriching them with the same cloud context to deliver a unified view of risk.Snyk CodeAnd for organizations using other scanners, Wiz ingests findings from tools like Checkmarx, Semgrep, Snyk Code, and others, enriching them with the same cloud context to deliver a unified view of risk.