What is your primary use case for Wiz Code?

Wiz's main use case is to assess the security posture of our infrastructure, discovering vulnerabilities and detecting any threats or attacks. We discovered misconfigurations in our infrastructure related to IAM roles and bucket access, which we fixed. We also discovered numerous vulnerabilities in our application code. This is how we use Wiz. We recently started using Wiz code, so we do not have an assessment of the impact yet.

The main use case for which I use Wiz is managing a company's cloud security posture. A concrete example of how I use Wiz in my day-to-day work for this purpose is defining custom controls, custom frameworks, and doing follow-up with the development teams to improve the security posture. In these processes, I would like to add that the platform allows me to make use of several automations directly from it, which is quite useful. I do consider AI-based security posture management important within my cloud security strategy because we need, at least, to keep up with offensive actors which seems unatainable without AI. Wiz is deployed in my organization primarily for public clouds( AWS, Azure, GCP, and Oracle)

Wiz is primarily used for cloud security monitoring and risk assessment. I use it to identify security vulnerabilities and misconfigurations and potential risks across cloud environments and to prioritize critical issues and improve overall security visibility. In my day-to-day work, I use Wiz to review cloud security findings and identify misconfigurations and vulnerabilities and prioritize high-risk issues. For example, when a resource has excessive permissions or an exposed configuration, I review the finding and assess its potential impact and coordinate with the responsible team to address it. This helps improve cloud security and visibility and reduce risk. Wiz also helps improve visibility across cloud environments by bringing security findings into one place.

Wiz is being tested to compare against Checkmarx, examining scanning capabilities, native visibility, ease of deployment, and code-level analysis. The proof of concept has completed, and we had interaction with the user interface, gaining the ability to use some of the features and functionality of Wiz. The scanning process was very easy, with a single pane of glass making it simple to move from one feature to another. There is significant customization involved, allowing for bespoke configuration to meet specific requirements. Wiz provided many advantages, and the proof of concept was very impressive. The interface was simple to use and quick to become familiar with. We were able to examine risks and vulnerabilities very easily, which was the main focus of the initiative—to identify exactly where the vulnerabilities, risks, and threats were located and to detect and identify those immediately within the framework provided. Multi-cloud risk mapping proved very useful because we could see everything with no hidden elements. Everything was visible and transparent. In terms of prioritization, we could identify which specific area of the cloud or container contained vulnerabilities. When critical issues appeared, we could develop metrics to understand where specific problems lay. If a certain area had multiple critical vulnerabilities, we looked deeper into that area to find underlying causes. There was immediate information available, as well as information that could be gleaned after conducting root cause analysis. Trends and trend analysis have improved, helping us build a clearer picture of what is happening, where it is happening, and why. Robust static application security testing (SAST) and SCA analysis at the code level proved very useful. Catching vulnerabilities early was a key highlight and takeaway from the proof of concept.

I have been using Wiz for approximately three to four weeks, and I find that Wiz is an amazing cloud security platform that helps the organization identify, prioritize, and remediate security issues across cloud environments such as AWS, Azure, and various types of clouds, Kubernetes, and containers. My main use cases for Wiz include cloud security posture management, or CSPM, because admins continuously monitor the cloud environment for misconfigurations and if any misconfiguration is found, Wiz will correct them. Additionally, there is the Vulnerability Management feature because it prioritizes vulnerabilities based on real-world risks and exploitability, also identifying vulnerabilities that could impact real-world risk within organizations. The Identity security feature also detects excessive permissions and identifies related risk, along with Kubernetes security which scans the Kubernetes clusters and workloads. These are my use cases of Wiz in my role. We use Wiz in a cloud risk assessment because we scan client cloud environments to identify exposed resources and misconfigurations, generate security assessment reports, and perform vulnerability management and compliance audits which validate adherence to industry frameworks and produce audit-related reports for customers. This eases their workload, and it is also used for incident response to investigate attack paths, identify compromised resources, and reduce investigation time with centralized visibility. These are my use cases in my work.

Our primary use case for Wiz is Cloud Security Posture Management and Cloud Native Application Protection. One of our clients was preparing for a security assessment, so Wiz identified an internet-facing EC2 instance with excessive IAM permissions and outdated software containing critical vulnerabilities. Instead of reviewing multiple security tools separately, Wiz correlated the exposure, vulnerability, and privilege information into a single risk finding. That allowed us to remediate the issue quickly before the audit. We use Wiz daily to monitor cloud resources, investigate security findings, and prioritize remediation based on actual business risk instead of simply focusing on CVE severity.

I am an end user of Wiz Code and I use it for personal projects. I use Wiz Code for Kubernetes baseline and for security CNAPP projects. As a security engineer using Wiz Code, I can say that when running my Kubernetes on the AWS cloud and on Azure, I haven't had any errors, so my production teams operate smoothly with a zero failure rate. From the Kubernetes baseline focus I have with Wiz Code, I think it's perfect, and from the CNAPP focus, it has been serving me exceptionally with zero failure rate since I've been using it. I have strong models that I work with when setting up Wiz Code; I use AI to enhance my security projects, so most of the challenges I face, I fix from a security engineering perspective, and the installation process was smooth. I use Wiz Code on-premises because I work with Active Directory, while I do have a cloud that I'm running on Azure, but I'm considering deploying most of my EC2 instances on AWS while thinking about the pricing.

Wiz Code is designed for scanning code repositories for vulnerabilities, whether through static scans, dynamic security scans, or by identifying vulnerabilities in third-party libraries. Overall, it's a complete package that can help scan code repositories and code bases while flagging findings that are not beneficial for organizations. We have integrated Wiz Code with our GitHub repositories and have been tracking the findings. With real-time code tracking, developers and security engineers from our team are able to see findings and misconfigurations within the code in real-time, and they can reach out to specific developers for remediation of those findings. Automated code reviews are something we have in process. We have developed a CI/CD pipeline automation that can be integrated with the code repository and utilize Wiz Code for this purpose, so that pull requests can be triggered to lead to automatic remediation. However, this is specific to organizational needs. Some teams do require prior review before implementing any changes, whether minor or major, and they do require proper peer review for those pull requests. As far as automations are concerned, we have tested this within our environment, but it is specific to developer and team needs.

The main use case for Wiz Code is its unique selling proposition, which is the dashboarding. What you want is to see what is wrong within your environment, and that is where Wiz Code picks up the market value with a unified dashboard for all your code-to-cloud issues under a single umbrella, something missing in other products like Prisma Cloud or Aquasec. Aquasec does not have DAST and does not compete with the entire solution, while Prisma Cloud does DAST but lacks in dashboarding and recategorization of the vulnerabilities, which is the USP of Wiz Code.

Folks deploying infrastructure with Terraform code need to verify that those deployments do not have vulnerability concerns, and if they do, they need to be remediated, which is the main use case for Wiz Code.

I mainly use Wiz Code to evaluate the codebase on AWS. Wiz Code is used to run security scans on registry images as a specific example of how I evaluate my AWS codebase.

My main use case for Wiz Code is to find vulnerabilities in my code. I perform penetration testing on my code to find any issues like SQL injection with Wiz Code. Penetration testing and finding vulnerabilities is the main focus for me when using Wiz Code.