Wiz Launches Cloud Detection and Response Product in Public Preview
Summary
Wiz announced the public preview of Wiz Defend, a cloud detection and response product that combines telemetry, threat detection, investigation context, and response automation for SecOps teams.
Key points
- Wiz Defend is now available in public preview as a cloud detection, investigation, and response suite.
- The product combines telemetry from cloud control planes, identity, data, networks, infrastructure SaaS, and workload runtime, including through an eBPF-based sensor.
- Wiz says the platform includes thousands of detections and uses the MITRE ATT&CK framework to identify visibility gaps and map telemetry.
- Its investigation features include AI-generated incident stories and suggested follow-up questions; response features include runtime blocking, containment playbooks, and integrations with SIEM and SOAR tools.
- A hypothetical Selenium attack example shows detection of a reverse shell, credential theft, lateral movement, and attempted data exfiltration, with suggested containment steps.
- The announcement describes integrations with security workflow vendors and presents Wiz Defend as a way to connect cloud security, SecOps, and development teams.
Article Details
- Event Type
- Public preview launch of Wiz Defend, a cloud detection, investigation, and response product.
- Impact
- Wiz says the product provides cross-layer cloud threat detection, investigation context, and automated response and containment. The article illustrates its capabilities with a SeleniumGreed attack scenario involving a vulnerable Selenium service, a reverse shell, stolen AWS credentials, lateral movement to the control plane, and attempted data exfiltration; this is an example scenario, not a reported incident.
People
Nate StevensIdentified as Cloud Security Engineer at Matillion and quoted describing his experience with Wiz Defend.Susanne SenoffIdentified as CISO at PROS and quoted describing her experience with Wiz Defend.Tyler ShieldsIdentified as Principal Analyst at Enterprise Strategy Group and quoted commenting on Wiz Defend.
Vendors
Amazon Web ServicesImagine an attacker targeting a Selenium service running in an AWS Kubernetes environment. The attacker would exploit the Selenium service to open a reverse shell and establish a foothold on the compromised host. FromWizToday, we’re excited to announce the public preview of Wiz Defend, the future of cloud detection and response (CDR). Defend marks the latest addition to our platform to help organizations secure their cloud at cloud
Products
KubernetesImagine an attacker targeting a Selenium service running in an AWS Kubernetes environment. The attacker would exploit the Selenium service to open a reverse shell and establish a foothold on the compromised host. FromSeleniumattack, first documented in January 2024 by the Wiz research team. It exploits vulnerabilities in the Selenium application testing framework, estimated to be present in 30% of cloud environments, to achieve remoteWiz CloudWith Wiz Cloud, we empowered cloud security and development teams to burn down their most critical risks fast. With Wiz Code, we enabled development and application security teams to rapidly build securely from theWiz Codewe empowered cloud security and development teams to burn down their most critical risks fast. With Wiz Code, we enabled development and application security teams to rapidly build securely from the first line ofWiz DefendToday, we’re excited to announce the public preview of Wiz Defend, the future of cloud detection and response (CDR). Defend marks the latest addition to our platform to help organizations secure their cloud at cloud