Wiz Reviews

We are delighted to have Wiz Cloud revealing our cloud security posture across our development, QA and production systems for both Azure and AWS. We share access to the results widely with our technical staff. It's great that Wiz permits unlimited user accounts. Our professional services and support can use Wiz to demonstrate to individual customers the security posture of the systems we are hosting for them. 

Mika, the built-in AI, is easy to use. The query creation is intuitive.

The attack surface findings initially revealed numerous vulnerable systems. Upon investigation we learned that 100% of them were stale DNS entries. We deleted those but this gave us confidence that our security posture is better than the general industry.  If we were to have a vulnerable system, we're confident that Wiz will quickly surface the finding.

To someone who is looking at buying Wiz but concerned they already have too many products that give them a lot of alerts, the overview dashboard does a great job of raising the issues that matter. It intelligently filters the signal from the noise.  Interns on our team were immediately as productive with Wiz as experienced security experts.

Wiz allowed us to cancel two other tools with noticeably superior results.

Our Technical Account Manager set up weekly meetings, but we have switched it to monthly. We dove into self-training with Wiz Academy so there wasn't much value for us in the meetings. Anytime we need something, we open a support ticket and they are responsive. 

We acquired Wiz Cloud in September, 4 months ago.

As for stability, we have seen some issues where our results changed radically from one day to the next, but we had not made radical changes, so we opened a case with support. It didn't cause us any downtime.

Scalability is not an issue for us because we have a constant load. It quickly took on our substantially large workload.

I have contacted Wiz technical support frequently.

The support is excellent. We contact via an in-application portal. We can see the support cases we personally open, and also the cases that other people have opened from our company. I appreciate that feature. Generally, support gets back to us within a few days with a good answer. There was one fellow in particular who has been knocking it out of the park. He is a great support person to deal with. We are happy with the support experience.

If I were to put Wiz support on a scale from one to ten, I would give them a ten.

Positive

Wiz distinguished itself immediately in the PoC, surfacing important issues that were entirely missed by both the products we were already using and other CNAPP's that we tested. We dropped both products.

For configuration management we had been using another product that we were happy with that was much cheaper, but it did not do any of the other things Wiz does. We also had what was formerly a leading CNAPP that was priced similar to Wiz, but the support and upgrades declined rapidly. In head to head comparison Wiz stood out as the superior solution.

The initial deployment of Wiz was super easy. It only took a few hours, so we were getting results the next day.  There are still a few minor settings that Wiz scripts don't handle so we have to manually apply and then we will be fully deployed.

The deployment of Wiz is spread across different teams with different areas of responsibility on AWS and Azure. 

Quickly identified around $40K in unneeded annual expenses that we were able to drop.

Wiz is expensive, but it offers good value for the money.

I feel confident that we are learning of the issues that matter. I rate Wiz nine out of ten.

Public Cloud

Microsoft Azure

Wiz is being tested to compare against Checkmarx, examining scanning capabilities, native visibility, ease of deployment, and code-level analysis. The proof of concept has completed, and we had interaction with the user interface, gaining the ability to use some of the features and functionality of Wiz. The scanning process was very easy, with a single pane of glass making it simple to move from one feature to another. There is significant customization involved, allowing for bespoke configuration to meet specific requirements. Wiz provided many advantages, and the proof of concept was very impressive. The interface was simple to use and quick to become familiar with.

We were able to examine risks and vulnerabilities very easily, which was the main focus of the initiative—to identify exactly where the vulnerabilities, risks, and threats were located and to detect and identify those immediately within the framework provided. Multi-cloud risk mapping proved very useful because we could see everything with no hidden elements. Everything was visible and transparent. In terms of prioritization, we could identify which specific area of the cloud or container contained vulnerabilities. When critical issues appeared, we could develop metrics to understand where specific problems lay. If a certain area had multiple critical vulnerabilities, we looked deeper into that area to find underlying causes. There was immediate information available, as well as information that could be gleaned after conducting root cause analysis. Trends and trend analysis have improved, helping us build a clearer picture of what is happening, where it is happening, and why. Robust static application security testing (SAST) and SCA analysis at the code level proved very useful. Catching vulnerabilities early was a key highlight and takeaway from the proof of concept.

The best feature Wiz offers is the ability to identify different threats, weaknesses, and vulnerabilities, with vulnerabilities being the main focus because that is what we have to communicate to our coders and developers. We were able to see what specific vulnerabilities contained in terms of root cause analysis, such as whether libraries needed updating, whether certain CVEs were related to those vulnerabilities, and how common those vulnerabilities were, including whether patches or fixes were available. Significant information was available that could help remediate numerous issues. Vulnerabilities identification and detection were very important; we were immediately able to see through drilling down exactly what was available in terms of remediation, whether it was possible immediately or what could be done afterward.

In terms of posture management, it was fantastic because we could see how risks were mapped across multi-cloud infrastructure seamlessly. The threat detection algorithms and mapping prioritized vulnerabilities based on actual exposure, allowing us to see critical, high, medium, or low priorities instantly. The deployment was also very easy.

Wiz has positively impacted our organization with improved remediation speed and efficiencies in terms of time saved, as well as reducing false positives. We are currently conducting deep code scanning alongside posture management, and we have seen improvements and efficiencies in both areas. Final metrics have not been established, and I am certain that will be completed in October once analysis is finished. However, the initial findings and recommendations are very positive, indicating benefits in time saved and efficiency, as well as economies of scale in performing tasks more easily and quickly while eradicating false positives and achieving a clearer picture of real vulnerabilities.

Wiz has met my expectations in terms of accuracy and reliability of output, with the co-pilot functionality being very good. The assistant services from AI exceeded what I had anticipated. Although the full range has not been tested, my experiences, along with my colleagues', have been very impressive regarding the outputs generated by AI.

While Checkmarx may perform better in some deep code scanning aspects, Wiz is considerably easier to use, has a better user interface, and offers a more compelling argument for its use. It is more robust and stable, making these positive points quite clear. The only slight negative is its scanning capability compared to Checkmarx, but it is still very good. Additional comments regarding needed improvements around scanning capabilities or any other area where Wiz could catch up to Checkmarx are not necessary.

Wiz has been used for a proof of concept over the course of a few weeks. A decision regarding adoption will be made by our company based on the findings and recommendations from the participants in the proof of concept initiative.

Wiz is stable based on proof of concept experience, and it is certainly much more stable than Checkmarx.

I am very impressed with Wiz's scalability. We began with 50 licenses and quickly increased that number to 200. It was efficient in scaling up. While we anticipate needing in excess of 200 licenses moving forward, we are confident Wiz can handle that demand.

Customer support receives a rating of 10 because we had a few initial questions, and they responded quickly and professionally, resolving all our issues regarding identity and access management in a short period.

The main solution currently in use is Checkmarx. We considered switching because Checkmarx experienced several outages and failures in service delivery, prompting us to explore other options in the marketplace.

During the proof of concept, there was minimal interaction with other applications. There was a link to Jira and Confluence for ticket creation, but since it was a proof of concept, much of the information was dummy data. Wiz was used primarily in isolation to see how the product would function on its own, without integration with other products.

Post-sale support services were not used during the proof of concept. The next step will be to collect all findings and make recommendations to senior management, who will decide whether to implement Wiz within the company.

A return on investment has not been technically realized yet, but efficiencies have been achieved in terms of fewer false positives and reduced analyst time on resolving vulnerabilities. These metrics will become clearer in October after assessing how Wiz performed against Checkmarx. The initial findings are encouraging, and we are optimistic about future assessments.

No involvement occurred with pricing, setup cost, and licensing for Wiz since it was a free proof of concept. Approximately 200 licenses were provided for the initiative, but pricing moving forward is unknown. It is expected to be more expensive than Checkmarx; however, the overall feeling is that Wiz is the more stable and user-friendly product, strong with features and functionality, potentially favoring the decision to move forward.

The recommendations provided by Wiz were valuable. This functionality is not available with Checkmarx currently. The concept of using the co-pilot and large language models, along with agentic AI, is refreshing and potentially very beneficial for future operations, particularly in troubleshooting and root cause analysis.

Multi-cloud risk mapping was very useful because we could see everything with no hidden elements. Everything was visible and transparent. In terms of prioritization, we could identify which specific area of the cloud or container contained vulnerabilities. When critical issues appeared, we could develop metrics to understand where specific problems lay. If a certain area had multiple critical vulnerabilities, we looked deeper into that area to find underlying causes. Significant immediate information was available, as well as information that could be gleaned after conducting root cause analysis. Trends and trend analysis have improved, helping us build a clearer picture of what is happening, where it is happening, and why. Robust static application security testing (SAST) and SCA analysis at the code level proved very useful. Catching vulnerabilities early was a key highlight and takeaway from the proof of concept.

The recommendations provided by Wiz were valuable. This functionality is not available with Checkmarx currently. The concept of using the co-pilot and large language models, along with agentic AI, is refreshing and potentially very beneficial for future operations, particularly in troubleshooting and root cause analysis.

My overall rating for this review is 9.

Public Cloud

Microsoft Azure

My main use case for Wiz includes utilizing Wiz Code, Wiz Defend, and Wiz Cloud Security Posture Management.

A quick specific example of how I use Wiz Cloud Security Posture Management in my day-to-day work is analyzing all the issues we see within the cloud and infrastructure as a code over our SOC team and security engineering.

I have been using Wiz during these years and think it is a great product; I can review in depth when the need is being requested, and I have been doing POCs of other vendors out there compared with Wiz.

I did create a custom dashboard in Wiz, and my experience with it is that it works well, has a flexible widget system, good query-based customization, and easy cloning for multi-team environments, but it could work better with limited visualization types.

Wiz runtime sensor has helped in identifying active threats more effectively compared to previous solutions by providing increased visibility and accuracy, especially when correlating runtime behavior with cloud posture; it offers better context around runtime activity, faster detection of critical threats, improved detection accuracy, increased visibility across assets we previously missed, and stronger support for incident response, with the overall impact rated 10 out of 10.

Before adopting Wiz, we relied on multiple disconnected tools for CSPM, vulnerability scanning, and infrastructure as a code review, which each provided partial visibility; Wiz replaced most of these functions with one unified security graph that brings together configuration, risk, identity, workload vulnerability, data sensitivity, and exposure path in one way.

The standout features of Wiz that make it valuable for me include good multi-cloud environment support, data governance, shadow IT detection, DevSecOps governance, automation, level reporting, threat detection, and good infrastructure detection.

Wiz has positively impacted my organization by implementing zero trust authorization, providing good reporting that shows the top attack path, critical assets, overall risk posture, and demonstrating AI and ML workload capabilities towards my team, as well as good infrastructure detection and vulnerability detection accuracy with security posture management at massive scale and identity exposure. There is a massive reduction in risk exposure, immediate visibility across the entire cloud estate, reduced noise and better prioritization, stronger DevSecOps collaboration, continuous compliance instead of ad hoc panic, faster incident response with real context, significant cost savings through tool consolidation, and stronger AI and data governance.

Wiz can be improved with better maturity in code scanning and developer workflows, expanding secret detection to full lifecycle management, stronger IAM across multi-account environments, more transparent attack path scoring and risk modeling, improved AI and ML security scanning, reduced false positives in runtime threat detection, more fine-grained access control and tenant separation, and better integration for serverless workloads.

I have been using Wiz for around two years.

In my experience, Wiz is very stable.

Wiz is very scalable.

I do use Wiz's post-sale support services, and I am improving every quarter the performance of the tool with their assistance.

The customer support for Wiz is very good.

Positive

I have evaluated multiple solutions before Wiz, including Palo Alto Prisma Cloud, Orca Security, Lacework, Check Point, Qualys cloud solution, Snyk, Checkmarx, and other DevSecOps platforms.

I have seen a return on investment with Wiz by reducing our budget spent on other tools, saving time, and needing fewer employees.

Wiz has reduced alert fatigue in my organization by around 90% over a given time period.

My experience with pricing, setup cost, and licensing for Wiz was through an RFP where they offered us a good price, and the licensing was a flexible solution based on our business.

My advice for others looking into using Wiz is to try it not just as another security tool, but as a foundational visibility and risk prioritization platform for your entire cloud environment; to get the full value, you need to think strategically about adoption, ownership, and cross-team alignment. I would rate this review as a 9 out of 10.

Hybrid Cloud

Amazon Web Services (AWS)

I use Wiz for visibility, cloud visibility, and inventory. We will be using it for prioritizing toxic combinations like risk analysis or vulnerability management and compliance and governments.

The best features in Wiz are visibility and the security graph, which is one of the main core components of Wiz. Instead of flat results, Wiz builds a digital twin of your entire cloud environment such as AWS and Azure. A site scanning option is also available. One of the main features is automated compliance mapping in Wiz.

As a security analyst, I would say automated compliance mapping is one of the important features because many companies do not actually know everything they have running in the cloud. Wiz provides a single pane of glass to see shadow IT, discovering any forgotten database or server created by developers during unmonitored periods. Multi-cloud management allows seeing assets across different providers, such as AWS and Azure, and maintaining a real-time list of virtual machines, serverless functions, buckets, and containers.

Wiz is a full-scale cloud detection and response platform. Agentless scanning is taking a high-resolution photo of your house once an hour to check for unlocked windows. Runtime is having a motion-activated security camera or a guard on site for twenty-four seven. Unlike other traditional agents that slow down servers, Wiz uses extended Berkeley Packet Filter, which is one of the major key features. It is incredibly lightweight and provides deep visibility into containers and Kubernetes nodes, where agentless snapshots might miss live execution details compared to the previous tool I have worked with.

The security graph takes you to zero through the toxic combination filter, which is the fastest way to clear the queue by focusing on the security graph and its logic with a high CVSS score, vulnerability that is exposed and has server identity that can reach sensitive data. Resolving those specific combinations first means that once the path is broken, for example by closing a port or stripping a permission, the issue moves to zero. To automate that remediation and keep the queue at zero, you cannot rely on manual clicks, so you can set up automation rules that automatically resolve critical issues in Jira or ServiceNow. Serverless cleanup will trigger a Lambda function to automatically remove any permissive IAM role and quarantine any suspicious container the moment Wiz detects it.

Wiz reduces alert fatigue. Unlike traditional scanners, Wiz uses a security graph to filter out the noise. Time to value is achieved through agentless deployment. Wiz connects via API rather than requiring software installation on every server. It provides one hundred percent visibility in minutes, which is one of the key benefits.

For time saving, I have reduced around forty to fifty percent time reduction in investigation by using the Security Graph to show exactly how an attacker could reach a database. That almost saves seventy percent of my time. Instead of manually tracking, which would take much time, it saves overall around forty to fifty percent. The alert volume will decrease almost eighty to ninety percent. SLA issues are also addressed. While using this, I do not have to be afraid of facing any SLA issues since it will reduce almost all the backlogs, ensuring all the critical vulnerabilities are fixed within their required policy window. For cost saving, replacing several point solutions with one platform is absolutely cost saving compared to many other products in the market.

Everything Wiz has in place is good enough to analyze things.

Nothing has to be added in the future.

The alert fatigue zero issues and priority-based consolidation security graph and anything that has in it easily make it rate eight, including its customer service and support team service. Two percent would be that the loading time is taking a bit longer while loading the graph, and while navigating to other links, that is also taking some time. That is why I am giving it an eight instead of a ten.

I have been working with Wiz for almost five years.

I have not faced any stability issues during my use of Wiz.

I have not experienced any scalability issues.

The customer support in Wiz is really good. They are super quick to answer the queries that I am facing or any kind of issues that I am facing. They are responsive over time. The onboarding was easy and smooth.

The support team is really helpful, and whenever I raise any kind of ticket about issues I am facing, they will immediately respond to it.

Positive

It was easy while onboarding Wiz.

Wiz was purchased from the same marketplace. I did not buy it from a different place.

Wiz is absolutely cost-effective.

The setup cost is somewhere around twenty-four thousand dollars based on your organization's size.

Wiz does consolidate the issue and the priorities and the containers. I would recommend Wiz because of its time-saving ability. You can almost see what are the criticalities that are there and the consolidation feature that is also there in Wiz. Majorly, the security graph will give you a deep information to analyze things in a much better way.

Traditional scanners and other tools do not treat every vulnerability as a priority. Wiz has the security graph to filter out the noise and by only surfacing toxic combinations, security teams can stop chasing thousands of low-risk patches and focus on the few that actually matter. It allows a small security team to manage a massive complex cloud environment without hiring dozens of additional users to look into it.

For any organization who want to think of moving to Wiz, the Security Graph feature is amazing and awesome. It will give you deeper information than any other tools does. That is the main thing to consider. Overall, I rate this product an eight.

Hybrid Cloud

Amazon Web Services (AWS)

My main use case for Wiz is in my report, where I use it when we push any code changes on GitHub. The DevOps team sets one pipeline that includes Wiz scanning. When we push any changes, if there are any vulnerabilities or security issues related to the code, Wiz raises a vulnerability that stops the pipeline execution and prevents deploying any changes. When we need to deploy, we fix those changes first and then proceed to deploy.

Wiz fits into our workflow as a very good tool, which I can affirm because of the many levels of scans they offer. As developers, we focus on completing tasks and may overlook security aspects, but we have a Wiz plugin in VS Code and IntelliJ IDEA. We run scans locally to fix any issues before pushing code to GitHub, ensuring that we resolve potential problems upfront.

Wiz is deployed in my organization through a private cloud setup, and as a developer, I use it with integration provided by the Infosec and DevOps teams during code changes and deployment processes.

The best features Wiz offers include its comprehensive scanning capabilities, which are essential for my work.

In addition to the good features, Wiz scanning is integrated into our repo. The DevOps team added that functionality, and the reporting aspect alerts us via email when vulnerabilities are raised, indicating deployment failures due to those issues. We receive timely notifications after deployment failures and have good integration with our DevOps team and pipelines, along with a user-friendly interface that provides details and hints for fixing vulnerabilities.

Wiz positively impacts my organization, especially since we are in the insurance sector where data security is paramount. Cybercriminals and cyberattacks are constant threats; thus, Wiz's scanning helps ensure we do not expose vulnerabilities, enhancing my organization's security and trust with clients.

Regarding specific outcomes or metrics, compliance has notably improved in my organization. With the Wiz plugin at the local level, we identify vulnerabilities before pushing changes, allowing us to fix them ahead of time. While I cannot claim faster development cycles outright, I can say that Wiz helps mitigate issues that might arise post-deployment, reducing pressure and ensuring security upfront.

While Wiz provides excellent data and reports, sometimes the suggested fixes for vulnerabilities are not always accurate based on our code compatibility. For example, if Wiz recommends upgrading from log4j to log8j but our code only supports log6j, this can lead to issues. Additionally, I suggest incorporating AI to provide real-time hints for fixing vulnerabilities during scans, as this would enhance usability significantly.

Regarding needed improvements in Wiz, the integration and usability are quite effective, though adding AI-driven features could significantly assist developers in addressing vulnerabilities more efficiently, thereby improving deployment times and adherence to deadlines.

I have been using Wiz from last two years.

Wiz is stable and scalable, with no downtimes experienced during changes, ensuring that any vulnerabilities found are addressed without affecting my workflow.

Customer support from Wiz is quite good. While I have not directly engaged with them, our Infosec and DevOps teams liaise with Wiz and receive prompt responses, indicating a positive experience overall.

I am unsure about post-sales support services and whether my organization utilizes them. We typically raise tickets through the DevOps team, which handles communication with Wiz, and I find that process works well.

I am not certain about other solutions evaluated before Wiz, but we also use Snyk alongside Wiz. Both tools have their strengths, but I find Wiz to be more advantageous due to its detailed summaries and team support.

I have seen a return on investment with significant effort reduction, as Wiz vulnerabilities allow us to detect risks before cyberattacks can occur, building trust with my clients because we prevent sensitive data exposure.

I do not have detailed information about pricing, setup costs, or licensing as I am just a user. However, I have heard the setup cost is low and that we subscribe on a yearly basis.

Wiz reduces alert fatigue within my organization effectively, as we perform local scans before pushing changes to GitHub, which minimizes issues at the production level and alleviates the stress of resolving errors late in the deployment process.

Wiz runtime sensor effectively helps in identifying active threats, allowing us to recognize and address serious issues at the development and local levels before they reach production, thus ensuring security and reliability.

The cloud security democratization aspect of Wiz is significant, as it enhances my organization's security management by ensuring standards are upheld through local and repo-level scans, even though I do not manage cloud security directly.

My advice for others looking into using Wiz is that it is crucial for building trust with clients and securing products, as it addresses vulnerabilities effectively before production, thus helping prevent cyberattacks and enhancing organizational reputation.

My company only has a customer relationship with Wiz, and I do not have additional information regarding other business relationships they may have.

I rated this review 8.5 out of 10.

Private Cloud

Amazon Web Services (AWS)

Wiz allows us to get a view into what's happening in our cloud environments, helping us see the gaps, how things are connected, and it aids in CVE monitoring, especially during incident response as we're able to look at what that environment or host might look like, how it connects, and how big of an issue this might be versus how small it could be, along with other indications gathered from Wiz's reporting that help us better understand what's happening and how it might have all started.

We have created a couple of custom dashboards and charts for Wiz to help keep track of specific environments. One example is when we were looking for certain types of activities; it allowed us to create a singular place to see the events in the subscriptions of interest that needed remediation, bringing it together quickly, allowing us to take action and track progress as things were fixed.

Zero Criticals is the dream for us; that's our goal, and we've made good progress, with Wiz allowing us to see everything together in an easy-to-understand way, giving us a path to have conversations with the business about what can be done from policy or user education standpoints to prevent recurring issues that need remediation, resulting in improved numbers and positively impacting our approach over time.

Wiz has enabled us to consolidate tools. Having multiple cloud providers presents challenges as each has its own versions of security products, leading to the problem of needing to monitor three different tools, which do different things. Wiz helps standardize alerting and responses while allowing us to fill in the gaps since many tools don't do CVE analysis and reporting, resulting in time savings and less effort in creating detections to fill those gaps.

Wiz helps us consolidate our alerting process. I am a strong advocate for avoiding alerts that do not add value to our environment. It's especially crucial to eliminate alerts that are single-instance or one-off occurrences. Instead, we need detections that tell a comprehensive story. Additionally, we require a way to drill down into these detections to understand them fully. Wiz has surpassed other tools across the multi-cloud landscape in alerting us to the issues that truly matter. It presents the information in a manner that allows us to address and remediate those issues effectively.

Wiz also includes excellent remediation steps within the detection, helping us understand what is happening. Our SOC team comprises individuals with varying levels of seniority and experience in the cloud, which can present challenges for skill development. Therefore, it is vital that we don’t just receive a barrage of noise in our SOC; we need information that clarifies what actually happened. Being able to communicate to the business how to resolve these issues is extremely important to us. Wiz has filled the gaps where other tools excelled in one or two areas but failed to provide a complete picture.

My favorite feature of Wiz is how it gathers information together; instead of generating a thousand independent signals, it rolls that up and shows you within that environment how all the different toxic combinations contribute to a critical alert, making it an issue worth responding to, unlike many other vendors or tools that show singular things which may appear small, but when looked at holistically, are actually part of a much bigger issue needing attention.

Wiz has significantly reduced alert fatigue in our organization. One of the key functions is that it groups together elements that can form toxic combinations. Instead of treating a policy violation and a critical CVE as separate issues that would generate two different alerts requiring two different tools, it consolidates them into a single event. This allows us to identify problems more effectively. For example, if I see a high or critical CVE alongside a policy misconfiguration tied to an account, I know I need to address both issues. This grouping enables us to take action rather than approaching it as a simple decision of whether or not to act on a single alert. Previously, I might see a policy issue and wonder if it’s significant enough to warrant attention. However, when these issues are combined, I can assess the full scope of what’s happening, allowing me to take appropriate action. I can also determine quickly whether something might be a false positive, preventing unnecessary investigations.With the critical issues we identify, we can confidently fix them and reach out to the right people without relying on a "hope" strategy or waiting for an hour of research to see if it turns into something actionable. Based on my experience with other tools, Wiz helps us bypass that frustrating process.

I believe they are on the right path. However, Wiz has a unique way of identifying issues. As part of its growth and maturity, I'm noticing that it is taking an approach where it not only detects problems but also provides solutions to fix them. This expansion into a more comprehensive ecosystem allows it to become a 360-degree product. Instead of just continuously pointing out findings and detections, it starts to integrate with existing solutions, reducing the cycle of repeated issues. We can learn from these mistakes, and ideally, they will only occur once, allowing us to address them effectively. I appreciate the continued growth in this partnership, as it aims to reduce the number of findings over time by tackling the root of the problem.

One significant area for improvement would be increasing automation. While they excel at identifying issues, we need assistance in minimizing the human hours required for tasks. Ideally, the process would become more automated, allowing us to quickly respond with steps such as: we found an issue, reached out, and fixed it immediately. In cybersecurity, if it takes several hours to address a concern and a human attacker is present, that delay can lead to severe consequences. We need more immediate measures in our response strategies.

I have been using Wiz for almost two years.

Regarding stability, I was pleasantly surprised by the performance of this SaaS provider. We haven't encountered any outages or issues with reports not running, finishing, or data being incomplete or inaccurate.

Scalability is great. We haven't faced any problems. There were no requirements like, “once you get to this point, you have to do this or that.” We were simply able to connect our accounts, and during our last round, our environment quadrupled in size. We didn’t have to make any adjustments or configuration changes; it just accommodated the growth. Even as some environments scaled back down, the service scaled back down with us, which has been a great benefit.

Regarding technical support, we haven't needed to contact them. All the questions and issues we encountered were addressed by our account team. It was very helpful not having to open a ticket and wait for assistance; our account team was knowledgeable about the tool and could provide immediate answers. This level of support was refreshing, as we didn’t have to deal with delays or uncertainty. Overall, we were very satisfied with the support we received.

For support, I would rate them a ten out of ten. They have great documentation and excellent support from the account team, which reduces how much you have to rely on technical support. I've dealt with other tools where the account team couldn't answer any questions, and the only option was to open a ticket and wait, sometimes for a day or two, for someone to respond. However, with this service, we received answers immediately and at the level we needed. Additionally, we received plenty of training and education without having to pay for expensive classes. So, I would definitely give them a ten in that area.

Positive

It was very easy to deploy. We were able to get everything set up quickly during a call with our Wiz account team. They walked us through the process, and once we connected the accounts, it was off and running. From that standpoint, it was great to easily tap into the different cloud providers. The experience was positive overall.

After the initial setup, the team also assisted us with health checks to ensure everything was functioning properly. They provided feedback and helped us make any necessary adjustments to permissions so that the tool would work effectively.

As for the setup time, we had a 30-minute call scheduled, and we managed to complete the setup within that timeframe. It mostly involved connecting the parent account and giving Wiz access to deploy the tool. After that, we were able to start viewing the results. So, in total, we spent about 10 to 15 minutes actually configuring it during that 30-minute window.

I’m familiar with their pricing. I believe it aligns well with what we typically see for security tools. It’s not unreasonable or outrageous. They have a great product that works effectively and fulfills its intended purpose. I don’t think there’s anyone else out there offering the same level, scale, or efficiency. While their pricing may be a bit on the premium side, it also enables users to consolidate tools, which can offset some of those costs.

A significant alternative out there is AWS GuardDuty. It operates within a single scope, analyzing your logs and identifying signals of potential issues. However, this can lead to high alert fatigue because it focuses on individual events. Instead of grouping and triaging alerts, it may send you multiple separate notifications for a single host or device performing several actions.

In addition, we've utilized scanners for Common Vulnerabilities and Exposures (CVEs) like Rapid7. This tool effectively scans for CVEs, but it requires thorough configuration, continuous monitoring of output, and the creation of reports to take necessary actions. This process is not on the same level as Wiz, which consolidates all of these tools into one platform.

We haven't used Wiz Runtime Sensor; we've seen demos and it looks really cool, but it's not something we have implemented.

I believe there isn't a perfect tool, but Wiz comes very close, continuously growing and expanding to add more value into its ecosystem, and I'm happy with it. I would rate Wiz a nine out of ten.

Public Cloud

Amazon Web Services (AWS)

Our primary use case for Wiz is Cloud Security Posture Management and Cloud Native Application Protection.

One of our clients was preparing for a security assessment, so Wiz identified an internet-facing EC2 instance with excessive IAM permissions and outdated software containing critical vulnerabilities. Instead of reviewing multiple security tools separately, Wiz correlated the exposure, vulnerability, and privilege information into a single risk finding. That allowed us to remediate the issue quickly before the audit.

We use Wiz daily to monitor cloud resources, investigate security findings, and prioritize remediation based on actual business risk instead of simply focusing on CVE severity.

The best features offered by Wiz are the Attack Path Analysis and the risk prioritization and agentless cloud security scanning.

The Security Graph and Attack Path Analysis have been the most valuable in our organization because rather than generating thousands of alerts, Wiz helps us to understand which findings represent real risk and should be addressed first.

Wiz has improved our visibility into cloud risk, reduced manual security assessments, and helped us prioritize remediation efforts more effectively.

It reduced the time spent investigating cloud security findings by around 40% and also accelerates the process of identification of critical cloud risk.

The findings from Wiz are generally accurate and well prioritized, and I appreciate that Wiz focuses on contextual risk rather than overwhelming us with every possible vulnerability.

More customizable executive dashboards can be created, and better reporting for non-technical stakeholders can also be improved in Wiz platform.

Overall, it is a mature platform and most enhancements I would like are around reporting automation and simplifying executive level reporting.

I have been using Wiz for approximately one and a half years.

Our companies are currently processing terabytes of data, and Wiz is very stable.

Wiz is very scalable, so there is no problem in that regard.

We have used the support services after purchase, and they are very good. Their teams are very knowledgeable and very supportive, and their team can handle all issues.

Customer support is very good, and they are very knowledgeable and always ready to help you out from any difficult situation or if you face any complexity in Wiz platform.

Before using Wiz, we relied on multiple tools for vulnerability scanning, cloud configuration checks, and cloud native security services. Each tool generated its own findings, so correlating risks required manual effort, but with Wiz, we get a unified view of combined vulnerabilities, misconfigurations, exposed assets, IAM permissions, and runtime context all in a single platform.

Previously, we were using multiple tools for cloud security, cloud native application management, AWS monitoring, and similar tasks, but we wanted a single platform that encompasses all these capabilities, so we switched to Wiz.

Setup is very easy, and if you feel any difficulty while setting up anything, their support team is ready to help you out with that.

We have used the support services after purchase, and they are very good. Their teams are very knowledgeable and very supportive, and their team can handle all issues.

Customer support is very good, and they are very knowledgeable and always ready to help you out from any difficult situation or if you face any complexity in Wiz platform.

We have seen the ROI from this because it reduced our engineer's time by 50% and also saved time on addressing false positives, allowing us to be very confident in our posture.

The pricing is a bit higher than the market rate, but the value it provides is more valuable than the pricing. Setup is very easy, and if you feel any difficulty while setting up anything, their support team is ready to help you out with that. We are running it on a monthly license basis, so we have not purchased the enterprise version.

We have not evaluated any other option.

AI security posture management in the cloud is very important because risks are increasing, and to reduce the manual effort of every department, AI agents can be deployed in cloud security posture to directly find AI security as connected within the organization.

Wiz has reduced the alert fatigue in our organization, and if you are fully migrated with Wiz, within a week you can see the difference.

Before Wiz, we used Falcon as a runtime sensor, and after using Wiz, we are now 100% sure that Wiz's Runtime Sensor is very accurate and helped us to identify active threats more effectively compared to our previous solution.

Teams currently using multiple platforms for security assessments, compliance monitoring, cloud native application posture management, and cloud security posture management can directly switch to Wiz without any hassle, and it will be a very valuable decision for their teams.

Wiz is very scalable, so there is no problem in that regard.

Wiz is a very mature platform that we use daily as an end-to-end cloud management tool. It is great as it reduces your company's security risk and actively monitors your entire cloud infrastructure, so you do not need to worry about any cloud risks affecting your organization. I would rate this product a 9 out of 10.

I have been using Wiz for approximately three years in my career. Our first use case is Cloud Security Posture Management. We needed that because we are a multi-cloud company. We have most of our infrastructure in AWS, but we also have some in Azure and some in GCP. So we needed a CSPM to cover all three environments.

The feature I appreciate most about Wiz as a CSPM is the vulnerability detection and misconfiguration identification. It helps us to ensure that we know if there are misconfigured cloud workloads and what those are, as well as if there are vulnerabilities. That is one of the key value adds for us.

What we have done is create a tool that is not just a security tool but is actually used by other teams. We have created dashboards for other teams, for product teams who are developing code. They can see their assets, or our cloud team or other teams that own different assets can view their own team's vulnerabilities and misconfigurations through per-team dashboards.

For us, the value add when considering Wiz is that I would rather consolidate under fewer tools to get to a platform. This allows for alerts, administration, and dashboards to all be under one platform, simplifying the environment. It makes operations easier and ultimately enhances our ability to use the platform more effectively.

Wiz allows us to consolidate tools, particularly in vulnerability management. We used to use a technology called Tenable to do our vulnerability scans, not just on-prem but in the cloud, and we replaced Tenable with Wiz's capabilities as well as the capabilities of an endpoint protection technology we use called CrowdStrike.

Regarding scalability, we have connected to all our cloud accounts and have never had any capacity or performance issues, so scalability really has not been a topic of conversation for us because we have never had any issues.

I have contacted customer support for Wiz. They are aware of our discussions about it. We have talked about it during our quarterly business reviews.

I have never seen any instability with Wiz, such as lagging, crashing, or downtime.

We have connected to all our cloud accounts and have never had any capacity or performance issues, so scalability really has not been a topic of conversation for us because we have never had any issues.

I have contacted customer support for Wiz. They are aware of our discussions about it. We have talked about it during our quarterly business reviews.

I am a few steps removed from the details about the support quality and speed, but my impression through the team and talking with the account team directly is that when we raise issues, they are addressed thoughtfully, professionally, and quickly. I do not think there have been any lingering support issues we have had. We have also surfaced feature requests or changes, and they have implemented those and rolled those out within a few weeks. Wiz does a good job of listening to the feedback of their customers and using that to help shape the platform.

Positive

I have not used any alternatives to Wiz. Wiz was our choice; although we evaluated different technologies when we were looking for a CSPM, we went with Wiz, so we went from nothing to Wiz.

The initial deployment of Wiz was easy from my point of view. Essentially, once we connected Wiz to our AWS account, all the data starts to flow in and telemetry on our cloud assets, any vulnerabilities, and misconfigurations. So the dashboards light up with red, yellow, and green indicators. After deciding to go with Wiz, our proof of concept ended up becoming our production implementation, and we just expanded Wiz to more accounts, then to Azure and GCP. So it was very easy.

I do not know exactly how long it took to fully deploy to a working condition because it has been so long ago, but I will say that getting the visibility was in a matter of weeks to connect the accounts, probably within a week. Then it was a few months to build some of the dashboards and operationalize what we were seeing.

Feature-wise, I cannot tell you that it is a bit expensive compared to its peers, but I do think the premium is worth it. One of the things that Wiz has done well is that there are no agents for the CSPM, at least from what we are doing. It is very easy to roll out, easy to configure, maintain, and generally it does what it says it does with few issues. We had more overhead and more issues with other competing CSPM platforms.

From the team standpoint, I do not think Wiz requires much maintenance on our end because it is all cloud-based and Wiz does a great job of providing almost weekly updates. The ongoing maintenance itself of Wiz is low. We do have integrations which require some care and feeding. We have an integration with ServiceNow, but Wiz's ServiceNow integration is not the best. I have been told there have been issues getting the data out of Wiz and plugged into ServiceNow effectively, so that has taken a little bit more attention.

We are working on achieving zero criticals in our issue queues with Wiz. It has helped us gain visibility into our critical issues, but we still have a few dozen left to work through. A lot of that actually has to do with some older infrastructure and workloads that applications use. So we have some application migrations in the works, but we have not quite got to the zero critical status.

I would rate this review as a 9 overall.

Public Cloud

Amazon Web Services (AWS)

The product was implemented for AWS monitoring and cloud infrastructure monitoring. Our goal was to conduct security monitoring of cloud infrastructure. Wiz was the first product we selected, and we were not using any other product, so this was not a consolidation effort.

The installation and configuration process was straightforward, and the onboarding was smooth. The user interface of Wiz, including the graphics, dashboards, and overall design, is user-friendly. The customization capabilities are excellent, allowing us to tailor the tool based on our requirements.

When someone worked from another country and connected with an unusual IP address, the system provided us with a notification, which was valuable.

Wiz significantly helped with our compliance requirements. The tool makes it easy to generate compliance reports by selecting a specific compliance framework, and it creates the report automatically.

The product provides an overview of our entire company through dashboards, and access was not limited to our security team. We provided access to other departments and software developers, allowing them to monitor the dashboards as well. This broader accessibility made Wiz a valuable tool for our organization.

During the initial setup, obtaining support was not easy initially. When assistance was needed, response times were longer than desired. However, the documentation was comprehensive, so there were no major blocking challenges.

After purchasing the product, support quality improved significantly. As a paying customer with a license fee, we found that support was responsive and easy to reach.

From a technical perspective, Wiz is excellent, but the pricing is too expensive.

We experienced pressure to monitor license costs constantly because they increased automatically. There was no way to limit these increases, which was a significant stress point.

Wiz is very reliable. The services were stable, and we did not experience any downtime. During monitoring operations, we did not encounter any issues that required attention or fixes. From the first day of implementation, the product worked well and remained stable.

Wiz scales easily. The platform automatically scales itself, though this automatic scaling also increased our license costs, which required monitoring. The scalability happens in the background without requiring manual intervention.

After purchasing the product, support was satisfactory. As a paying customer with a license fee, we received good support and found it easy to reach out to the team. Overall, the support experience was satisfactory.

I used this product at my previous company but am no longer a customer.

The installation and configuration process was straightforward, and the onboarding was smooth.

During the initial setup, obtaining support was not easy initially. When assistance was needed, response times were longer than desired. However, the documentation was comprehensive, so there were no major blocking challenges. Overall, we did not experience any significant blocker challenges with Wiz.

We did not experience any security threats, but the monitoring of our infrastructure was valuable. We did not use any other solution, though it was reassuring to know that Wiz was operational and running.

We conducted proof-of-concept evaluations with different tools. Wiz was easy to onboard to our infrastructure. We did not want to spend excessive time on integrations and configurations during the initial phase. The process was straightforward, which was a key factor in our decision. Additionally, because we were using AWS infrastructure, Wiz could be purchased directly through the AWS Marketplace, which was another reason we selected it.

The setup process takes approximately fifteen to twenty minutes. If you are not using artificial intelligence, you may not need this capability. However, if you are using artificial intelligence in your portfolio, it is important.

Control is essential when using artificial intelligence because there are instances where you feel out of control. You do not know what is happening in the background, and artificial intelligence agents are working and performing tasks. When you have a security tool controlling everything, it is truly useful.

We used filters that Wiz provides while configuring alerts. You can avoid false positives, excessive noise, or alert spam by using these rules and alert configurations.

The company was a startup in its initial phase, and I was involved in choosing the technology tools stack from the beginning.

We did use the features available. Our goal was not to avoid using the product's capabilities. I would rate this review nine out of ten.

Public Cloud

Amazon Web Services (AWS)

My use case for Wiz is basically for overall security, focusing on vulnerability management, infrastructure security, and application security, all of that combined. I have my AWS accounts where I run multiple services, so that's where I'm utilizing Wiz to the core optimum, utilizing all of its capabilities. Even as an inventory management tool, I think it has been really helpful because it keeps a record of every change, making it very functional.

Wiz has helped me consolidate some tools, as it is not just doing the job of the security tool alone. It has good inventory management, good vulnerability management, and we do not need to invest in multiple tools. All aspects such as infrastructure, application, vulnerabilities, and the regular security scoring patterns are in-built into Wiz along with the inventory manager, which has helped us reduce one or two tools here and there.Wiz has reduced alert fatigue in my organization, as it is very accurate in terms of reporting the issues, which has definitely improved, and I don't see a concern.

The best features of Wiz that I appreciate the most include trends of security, such as how we have been getting issues reported and how frequently we are closing them, along with the capabilities to notify a user and a channel on Slack, which have all been really helpful beyond just doing its main job as a security framework.The extent to which the Wiz runtime sensor has helped identify active threats more effectively compared to other solutions I've used is significant, as it refreshes based on a schedule in terms of the latest findings. It has been pretty effective for our use case, as I keep checking for anything new reported there. We also have a ticketing mechanism attached to it, so as soon as a security issue is figured out, it creates a ticket on Jira, allowing us to keep track of issues, and it is pretty responsive in terms of catching the latest issues.Wiz has helped me achieve zero criticals in issue queues, as it detects a range of issues whether it is the end of life of a product or an actual security issue, such as an exposed port or a compromised service.

In Wiz, the areas that have room for improvement would include some autonomous capabilities, such as having an agent declare where, since we are in the era of AI, it can auto-solve some low or medium alerts. High and critical issues would still need manual handling, but some level of alerts being handled autonomously would be good. More or less, Wiz is doing well, but the false alerts at random times would be another area for improvement. I would also appreciate seeing it go deeper on the security aspect, expanding beyond just infrastructure and application to include potential issues stemming from APIs, as currently it focuses more on the infrastructure pieces. Having more visibility in API endpoints, microservices, and application code running on the infrastructure would be beneficial.

I have been using Wiz for the past 18 months.

The stability of Wiz has been good, with no downtime, bugs, or glitches. Just today I was not able to load it, but I wouldn't blame it that much as I have always been able to access the application when reaching out. I would rate the stability out of 10 as about nine or 10.

Wiz is scaling well for our use case, so I would rate scalability a 10 out of 10.

I would rate technical support as about nine, as we had a couple of cases where the responses were delayed quite a bit, but apart from that, they have been spot on.

Positive

I cannot name the vendor I used previously, but the reason for switching to Wiz was the added features that we were getting, which offered more control on cloud security.

The deployment process of Wiz was easy and not complex. It was fairly straightforward, honestly. The internal configurations took time due to the different applications we have, but I don't think there was any delay from the Wiz side.It took about three to four weeks to deploy Wiz, as the time taken was more about how we wanted to structure the projects and boxes inside Wiz from our perspective. We were operational from the first week and integrated with SSO projects by the third or fourth week.

The integration capabilities of Wiz were generally seamless, although we had some complications with Oracle accounts. Integration with AWS was pretty straightforward, but with Azure and Oracle, Oracle had some limitations regarding what it could report to Wiz. However, I think there was some more fine-tuning and adjustments done by the Wiz team to ensure Oracle could also be onboarded correctly, so that worked out.

The purchase of Wiz was a direct purchase rather than through the AWS marketplace or a partner purchase.

My thoughts on the pricing of Wiz is that for our use case, it has been moderate, as I was using a different tool earlier, so it's not been a very large jump. I would say it resides in that moderate zone, and it's not something that raises eyebrows, so I think we're good.

I would say Wiz is in the top tier, and it might just be the leading product as well. While there are a couple more products out there, I think Wiz is definitely leading the course at this point.

I have created some custom dashboards, charts, and counters, and I have created some custom reports that are sent out, including a lot of widgets for my reporting of all the accounts that I have. I have almost seven to eight accounts where very large workloads are running, and in total, there are almost 20 accounts, so it gives a very good view to summarize all of the accounts in one place.My business is a medium enterprise with about 5,000 employees.The maintenance of Wiz is fairly easy, with a few people looking into it, but it's not as though their whole time is dedicated to Wiz, which is a good part.I absolutely recommend Wiz to other users because of its ease, features, and user-friendliness, allowing anyone to come in, configure all the things they want out of Wiz, and start using it. There is no doubt about that. I would rate this review an 8 out of 10 overall.

Public Cloud

Amazon Web Services (AWS)