Wiz Explains Its Security Approach to Agentless Cloud Scanning
Summary
Wiz describes its agentless cloud scanner, emphasizing least-privilege access, regional scanning, redacted results, and SaaS or customer-hosted deployment options.
Key points
- The article says agentless scanning uses cloud APIs and vendor-granted permissions; it advises assessing those privileges and how data is shared.
- Wiz says its scanner avoids running third-party agents in production environments and does not require changes to networking configuration or routing.
- Wiz says scans run in the data’s origin region and only scan results are sent to the central customer tenant.
- The scanner is described as stateless and able to scan multiple resource types across cloud environments.
- In both deployment models, Wiz says results are redacted and hashed before being sent to its backend.
- With the SaaS model, Wiz’s scanner has limited permissions, including creating, sharing, and deleting snapshots; with customer-hosted deployment, scanning occurs in the customer’s environment and Wiz does not directly access snapshots.
Article Details
- Topic
- Wiz’s security and privacy approach to agentless cloud workload scanning