Wiz Cloud Security

This skill covers the Wiz cloud security platform — the CNAPP that pioneered agentless scanning and Security Graph-based risk correlation. It has deep knowledge of the Wiz architecture, capabilities, configuration, and operational patterns across CSPM, CWPP, CIEM, DSPM, CDR, shift-left (Wiz Code), and AI-SPM.

Wiz was acquired by Google for $32B in 2025, making it part of Google Cloud — though it remains a standalone multi-cloud product.

How to Approach Tasks

When you receive a request:

Classify the request type:
- Deployment/Onboarding -- Load references/architecture.md; cover connector setup and scanning scope
- Policy/Detection -- Explain Wiz rule types, policy framework, and best practices for tuning
- Risk Investigation -- Walk through Security Graph traversal, toxic combinations, attack path analysis
- Remediation -- Discuss Wiz remediation workflow, JIRA/ticketing integration, auto-remediation
- Integration -- Cover Wiz APIs, SIEM/SOAR integration, CI/CD integration (Wiz Code)
- Runtime/CDR -- Cover Wiz Defend and runtime sensor deployment
- Compliance -- Walk through framework mapping, compliance reports, custom frameworks
Identify environment -- Which cloud providers (AWS, Azure, GCP, OCI, Alibaba)? What workload types (EC2/VM, containers, EKS/AKS/GKE, serverless, PaaS)? Multi-tenant (separate connectors per account/subscription)?
Load context -- Read references/architecture.md for deep architectural knowledge when needed.
Analyze -- Apply Wiz-specific reasoning. Wiz's key differentiator is correlating findings across the Security Graph — don't answer questions about individual findings in isolation; understand the full context.
Recommend -- Provide actionable configuration, workflow, and operational guidance.
Verify -- Suggest how to validate in the Wiz console (Explorer, Dashboards, Reports).

Core Capabilities

Agentless Architecture

Wiz scans without deploying agents. The core mechanism:

Cloud API Scanning:

Wiz reads cloud provider APIs to collect resource inventory, configuration, IAM policies, network topology
Covers: EC2/VMs, S3/Blob/GCS, RDS/Managed DBs, Lambda, ECS/EKS, Azure AKS, GKE, IAM policies, VPCs, Security Groups/NSGs, CloudTrail logs (for CDR)
Near real-time: Wiz polls APIs continuously and processes change events

Snapshot Scanning (CWPP):

Wiz creates read-only snapshots of cloud storage volumes (EBS snapshots, managed disk snapshots)
Mounts snapshots in Wiz's own cloud environment for offline scanning
Scans: installed packages (OS + language), running services, configuration files, secrets on disk, malware
No performance impact on the scanned workload — scanning happens outside the workload

Container Image Scanning:

Pulls images from registries (ECR, ACR, GCR, Docker Hub, private registries)
Scans image layers for vulnerable packages, hardcoded secrets, misconfigurations
Also scans running container workloads via snapshot of the underlying storage

Security Graph

The Security Graph is Wiz's core data model — a property graph where nodes are cloud resources and edges are relationships:

Node types: Cloud accounts, VMs, containers, images, IAM entities, data stores, networks, secrets, vulnerabilities, cloud services

Edge types (relationships):

Network connectivity (can reach, exposed to internet)
IAM relationships (has permission, can assume, has role)
Data relationships (contains, classifies as PII/PCI/PHI)
Vulnerability relationships (has CVE, exploitable via)
Infrastructure relationships (runs on, deployed in, uses)

Graph traversal for toxic combinations: Wiz's rules traverse multiple hops in the graph to find correlated risks. Example rule logic:

Find: Virtual Machine
Where:
  - has critical CVE with public exploit
  - is accessible from internet
  - has attached IAM role
  - IAM role has permissions on data store
  - data store contains sensitive data

This finds "publicly-reachable VM with exploitable CVE, whose IAM role can access sensitive data" — a complete attack path.

Wiz Rule Framework

Built-in rules (Wiz Policies):

Wiz ships 1,400+ built-in detection rules across CSPM, CWPP, CIEM, DSPM
Rules are tagged by framework (CIS, NIST, PCI DSS, HIPAA, etc.)
Severity: Critical, High, Medium, Low, Informational

Custom rules (Wiz Query Language / WQL): Wiz uses a graph query language for custom rules:

FIND VirtualMachine
WHERE virtualMachineType = "EC2"
  AND networkExposure = "WidelyOpen"
  AND operatingSystem.isEndOfLife = true

Cloud Configuration Rules: Detect misconfigurations (CSPM) Vulnerability Rules: Detect CVEs and vulnerable packages (CWPP) Threat Detection Rules: Detect behavioral anomalies for CDR (requires Wiz Defend or cloud log integration) Secrets Rules: Detect exposed secrets in cloud storage and workloads (DSPM) Data Rules: Detect sensitive data exposure (DSPM)

Toxic Combinations (Attack Paths)

Wiz popularized the concept of "toxic combinations" — the single biggest differentiation from point-tool CSPM:

What makes something toxic:

Internet exposure -- reachable from the public internet (network path exists)
Vulnerability or exploitable condition -- CVE with public exploit, privilege escalation path, misconfiguration enabling compromise
Blast radius amplifier -- IAM permissions, lateral movement ability, privileged access
High-value target -- sensitive data, production databases, secrets, privileged accounts

Wiz Attack Path visualization:

Attack paths are shown as a graph walk in the Wiz console
Each step is labeled with the specific technique or condition
Wiz scores each attack path by estimated impact and exploitability

Example toxic combination:

Internet Gateway
  --> EC2 Instance (port 8080 open)
       |-- running unpatched Log4Shell (CVE-2021-44228, CVSS 10)
       |-- IMDSv1 enabled
       |-- IAM Role: ec2-app-role
            |-- s3:* on bucket: prod-customer-data
                 |-- contains: 2.4M PII records (SSN, DOB, email)

Wiz surfaces this as a Critical toxic combination with suggested remediations at each step.

Wiz CSPM

Coverage across all major cloud providers:

AWS: 400+ checks across all AWS services — IAM, EC2, S3, RDS, EKS, Lambda, CloudTrail, GuardDuty status, KMS, Secrets Manager, VPC, Route53, CloudFront

Azure: 350+ checks — RBAC, Azure AD, VM security, AKS, SQL, Key Vault, Storage, Defender for Cloud status, NSG, Activity Log

GCP: 300+ checks — Cloud IAM, GKE, Compute Engine, Cloud Storage, Cloud SQL, KMS, Logging, VPC, Cloud Functions

Compliance frameworks: Wiz maps rules to CIS, NIST 800-53, SOC 2, PCI DSS, HIPAA, ISO 27001, FedRAMP, GDPR, and custom frameworks

Framework score: Wiz provides a compliance score per framework per account with trend tracking

Wiz CWPP

Vulnerability Management:

OS packages: DEB, RPM, APK, Windows MSI/installed programs
Language packages: npm, pip, gem, Maven, NuGet, Go modules, Cargo
Container images: full layer-by-layer scanning
EPSS scores: Wiz shows Exploit Prediction Scoring System scores alongside CVSS
"In use" context: Wiz can correlate vulnerabilities with whether the package is actually loaded at runtime (reduces noise)

Runtime Protection (Wiz Defend):

Optional lightweight sensor deployed in workloads
Captures: process execution, file system events, network connections, syscalls
Detection: crypto mining, reverse shells, web shell activity, lateral movement, privilege escalation, credential theft
Requires sensor installation — contrasts with the rest of Wiz's agentless approach

Wiz CIEM

Identity analysis:

Enumerates all cloud identities: IAM users, roles, groups, service accounts, managed identities, federated identities, OIDC providers
Calculates net-effective permissions (AWS: evaluates service control policies + permission boundaries + identity policies + resource policies)
Identifies: overprivileged identities, stale credentials, cross-account trust chains, shadow admins, unused permissions

Key CIEM findings:

"IAM role has administrator access and is attached to a publicly reachable EC2"
"Service account with owner role on GCP project assigned to Cloud Function accessible from internet"
"Cross-account role assumption chain: dev account --> staging account --> prod account"

Wiz DSPM

Discovers all data stores in connected cloud accounts
Classification: PII (names, SSNs, emails, addresses), PCI (card numbers), PHI (health data), secrets (API keys, passwords), intellectual property
Data exposure: who has access, is data encrypted, is data publicly accessible, is data logged
Shadow data: discovers data stores that security teams didn't know about

Wiz Code (Shift-Left)

Integrates security into the development lifecycle:

IaC scanning: Terraform, CloudFormation, ARM, Bicep, CDK — detect misconfigurations before deployment
Secrets detection: Scans source code for hardcoded credentials, API keys, tokens
SCA: Vulnerable open-source dependencies in application code
Container image scanning in CI/CD: Scan before images are pushed to production
Pull request integration: Surface security findings as PR comments in GitHub/GitLab/Bitbucket
Policy as code: Enforce CSPM policies in CI/CD pipelines (fail builds for critical misconfigs)

Wiz Connector Setup

Connectors authenticate Wiz to cloud providers:

AWS Connector:

Creates an IAM role with ReadOnly + SecurityAudit policies (plus Wiz-specific permission set)
Wiz assumes the role via cross-account role assumption from Wiz's AWS account
Deployed via CloudFormation template or Terraform
One connector per AWS account, or use AWS Organizations for automated multi-account discovery

Azure Connector:

Creates an App Registration (service principal) in Azure AD
Assigns Reader + additional roles (Security Reader, Key Vault Reader)
One connector per subscription, or management group for bulk enrollment

GCP Connector:

Creates a Service Account with custom role
Enables required APIs (CloudResourceManager, Compute, Container, etc.)
One connector per project, or organization-level service account

Wiz Integrations

SIEM/SOAR:

Wiz Issues → Splunk (via Wiz Splunk app or webhook)
Wiz Issues → Microsoft Sentinel (via Wiz data connector)
Wiz Issues → ServiceNow, JIRA for ticketing
Wiz Events → generic webhooks to any SOAR platform

CI/CD:

Wiz CLI (wizcli) — scan images, IaC, and code directories locally or in pipelines
GitHub Actions, GitLab CI, Jenkins, CircleCI integrations
Admission controller (Wiz Admission Controller for Kubernetes) — block non-compliant images from running

Notification:

Slack, Teams, PagerDuty, email
Configurable per severity and rule type

Wiz Remediation Workflow

Guided remediation:

Each finding includes step-by-step remediation instructions with CLI commands
Terraform/IaC remediation examples provided where applicable
Links to provider documentation

Auto-remediation:

Wiz can trigger auto-remediation via AWS SSM Automation, Azure Automation, or custom Lambda/Function integrations
Recommended only for high-confidence, low-blast-radius remediations (e.g., disabling public access on S3 bucket)
Require approval workflows for production remediations

Ticketing integration:

Wiz Issues sync to JIRA tickets automatically
Two-way sync: resolving ticket updates Wiz status
SLA tracking within Wiz

Common Configuration Tasks

Tuning false positives:

Create exceptions (suppressions) for specific resources or accounts with documented justification
Exceptions have expiry dates and require approval workflow
Bulk exception management for known-good configurations

Custom frameworks:

Build custom compliance frameworks by mapping existing Wiz rules to custom controls
Import external frameworks not yet built into Wiz

Scoping:

Include/exclude specific accounts, subscriptions, projects from scanning
Tag-based scoping (e.g., scan only resources tagged env:production)
Sensitivity levels for DSPM data classification

Reference Files

Load these when you need deep architectural knowledge:

references/architecture.md -- Wiz platform architecture: agentless scanning mechanism, Security Graph data model, connector types, toxic combination logic, Wiz Defend runtime sensor, multi-cloud coverage details.
references/vulnerability-management.md -- Vulnerability-management-specific angle: WQL query examples for vuln prioritization, agentless CWPP scanning mechanics. Read when the user's intent is vuln scanning/prioritization rather than CSPM/CNAPP posture.

wiz

SKILL.mdplugins/security/skills/wiz/SKILL.md