Wiz Reviews

We are delighted to have Wiz Cloud revealing our cloud security posture across our development, QA and production systems for both Azure and AWS. We share access to the results widely with our technical staff. It's great that Wiz permits unlimited user accounts. Our professional services and support can use Wiz to demonstrate to individual customers the security posture of the systems we are hosting for them. 

Mika, the built-in AI, is easy to use. The query creation is intuitive.

The attack surface findings initially revealed numerous vulnerable systems. Upon investigation we learned that 100% of them were stale DNS entries. We deleted those but this gave us confidence that our security posture is better than the general industry.  If we were to have a vulnerable system, we're confident that Wiz will quickly surface the finding.

To someone who is looking at buying Wiz but concerned they already have too many products that give them a lot of alerts, the overview dashboard does a great job of raising the issues that matter. It intelligently filters the signal from the noise.  Interns on our team were immediately as productive with Wiz as experienced security experts.

Wiz allowed us to cancel two other tools with noticeably superior results.

Our Technical Account Manager set up weekly meetings, but we have switched it to monthly. We dove into self-training with Wiz Academy so there wasn't much value for us in the meetings. Anytime we need something, we open a support ticket and they are responsive. 

We acquired Wiz Cloud in September, 4 months ago.

As for stability, we have seen some issues where our results changed radically from one day to the next, but we had not made radical changes, so we opened a case with support. It didn't cause us any downtime.

Scalability is not an issue for us because we have a constant load. It quickly took on our substantially large workload.

I have contacted Wiz technical support frequently.

The support is excellent. We contact via an in-application portal. We can see the support cases we personally open, and also the cases that other people have opened from our company. I appreciate that feature. Generally, support gets back to us within a few days with a good answer. There was one fellow in particular who has been knocking it out of the park. He is a great support person to deal with. We are happy with the support experience.

If I were to put Wiz support on a scale from one to ten, I would give them a ten.

Positive

Wiz distinguished itself immediately in the PoC, surfacing important issues that were entirely missed by both the products we were already using and other CNAPP's that we tested. We dropped both products.

For configuration management we had been using another product that we were happy with that was much cheaper, but it did not do any of the other things Wiz does. We also had what was formerly a leading CNAPP that was priced similar to Wiz, but the support and upgrades declined rapidly. In head to head comparison Wiz stood out as the superior solution.

The initial deployment of Wiz was super easy. It only took a few hours, so we were getting results the next day.  There are still a few minor settings that Wiz scripts don't handle so we have to manually apply and then we will be fully deployed.

The deployment of Wiz is spread across different teams with different areas of responsibility on AWS and Azure. 

Quickly identified around $40K in unneeded annual expenses that we were able to drop.

Wiz is expensive, but it offers good value for the money.

I feel confident that we are learning of the issues that matter. I rate Wiz nine out of ten.

Public Cloud

Microsoft Azure

The main use case for Wiz Code is its unique selling proposition, which is the dashboarding. What you want is to see what is wrong within your environment, and that is where Wiz Code picks up the market value with a unified dashboard for all your code-to-cloud issues under a single umbrella, something missing in other products like Prisma Cloud or Aquasec. Aquasec does not have DAST and does not compete with the entire solution, while Prisma Cloud does DAST but lacks in dashboarding and recategorization of the vulnerabilities, which is the USP of Wiz Code.

The best features of Wiz Code that I appreciate the most include their entire dashboarding and the seamless integration with different DevOps tooling like GitHub or Azure DevOps. It seamlessly integrates, allowing you to run scanners directly onto the machines without consuming too many resources, and the recategorization of vulnerabilities is absolutely wonderful, giving you a complete attack path, which is something I love about Wiz Code because it details the entire lateral movement of the issue, whether it is a complete shift-left or shift-right, serving as the differentiators compared to other tools in the market.

When I talk about ROI with Wiz Code, it almost cuts you down to 20% to 25% of the daily effort needed in terms of FTE. If you are working with around 100 developers or engineers, you might come down to 60 to 70 engineers, with the rest completely automated by removing false positives, showcasing where the USP comes in.

The areas that have room for improvement in Wiz Code are their IaC policies, which require a little more maturity. When discussing IaC policies, you want to ensure engineers cannot merge anything non-compliant to your environment, and they need to streamline these with different cloud service providers, as every cloud has its own policies, such as Azure's policies. They need to mature their IaC policies and provide more custom policies for better integration.

Aside from the policies, that is the main area for improvement.

I started using Wiz Code as part of one of the client engagements where they wanted to do some market research around the SaaS, DAST, IaC, and container scanning tools. From that point in time, I have been using this for more than a year.

In terms of stability, I rate it a nine, as I did not observe any instability within the product. The best part is that their entire solution is built on APIs, allowing for easy integration without a codeless approach.

For scalability, I rate it nine.

I would rate the technical support of Wiz Code an eight. It is not bad, but the response time or RTO is longer than expected, indicating where they need to improve.

In terms of deployment, I would not say there were any challenges. The documentation is absolutely excellent and easy to follow, although they have locked the documentation, requiring minimum access called document reader, which is available only if you take a solution from them.

The deployment took just a day. You only need to be ready with your service principal to authenticate your environment, and then you can onboard the entire system, where results typically need at least 24 to 48 hours to start populating on the dashboard, but integration is quite seamless.

During my POC, I observed that the automated code reviews reduce human error by approximately 47%, which is the exact number we found out, reflecting a 50-50 ratio.

Regarding pricing, I would say that the pricing model is a little bit hefty on the pocket. For instance, Wiz Code scans your containers twice, first during runtime and then during shift-left when you build the Kubernetes manifest, which causes Wiz Code to charge separately for running the agent on the containers to give runtime posture, as well as for scanning images in the environment during shift-left, which I feel is not good for the client, although I understand it is a marketing strategy.

My thoughts on Wiz Code's error detection feature is that it is an add-on that makes life easier. Though I personally did not find it a path-breaking solution, it adds value where you are already getting the ROI of the product.

My thoughts on the real-time code tracking in Wiz Code is that it is very important because you cannot expect developers to use a repo on a daily basis, as there can be a release cycle for each application causing some days when the repo is dormant, making shift-left only applicable when you trigger the pipeline. That is where agentless scanning comes into play to ensure you have a continuous state of your repository, especially for picking up zero-day vulnerabilities which can pop up within 15 to 20 days.

If you ask me for advice regarding Wiz Code, I would definitely recommend it. Google already bought Wiz Code in a 32 billion dollar deal, improving it significantly, but it still depends on how customers choose to use it. If you want a single view of your entire code-to-cloud, then Wiz Code is the product, but for more mature needs in CSPM, CWPP, ASPM, or DSPM, you may need a POC to determine the best fit for your environment.

Approximately, we had a team strength of about 2,000 to 2,500 developers using Wiz Code.

Wiz Code does not require any maintenance unless it is an on-prem solution where you are managing the underlying machine within your environment.

I would rate this review overall a 9.5.

Public Cloud

Other

Wiz is being tested to compare against Checkmarx, examining scanning capabilities, native visibility, ease of deployment, and code-level analysis. The proof of concept has completed, and we had interaction with the user interface, gaining the ability to use some of the features and functionality of Wiz. The scanning process was very easy, with a single pane of glass making it simple to move from one feature to another. There is significant customization involved, allowing for bespoke configuration to meet specific requirements. Wiz provided many advantages, and the proof of concept was very impressive. The interface was simple to use and quick to become familiar with.

We were able to examine risks and vulnerabilities very easily, which was the main focus of the initiative—to identify exactly where the vulnerabilities, risks, and threats were located and to detect and identify those immediately within the framework provided. Multi-cloud risk mapping proved very useful because we could see everything with no hidden elements. Everything was visible and transparent. In terms of prioritization, we could identify which specific area of the cloud or container contained vulnerabilities. When critical issues appeared, we could develop metrics to understand where specific problems lay. If a certain area had multiple critical vulnerabilities, we looked deeper into that area to find underlying causes. There was immediate information available, as well as information that could be gleaned after conducting root cause analysis. Trends and trend analysis have improved, helping us build a clearer picture of what is happening, where it is happening, and why. Robust static application security testing (SAST) and SCA analysis at the code level proved very useful. Catching vulnerabilities early was a key highlight and takeaway from the proof of concept.

The best feature Wiz offers is the ability to identify different threats, weaknesses, and vulnerabilities, with vulnerabilities being the main focus because that is what we have to communicate to our coders and developers. We were able to see what specific vulnerabilities contained in terms of root cause analysis, such as whether libraries needed updating, whether certain CVEs were related to those vulnerabilities, and how common those vulnerabilities were, including whether patches or fixes were available. Significant information was available that could help remediate numerous issues. Vulnerabilities identification and detection were very important; we were immediately able to see through drilling down exactly what was available in terms of remediation, whether it was possible immediately or what could be done afterward.

In terms of posture management, it was fantastic because we could see how risks were mapped across multi-cloud infrastructure seamlessly. The threat detection algorithms and mapping prioritized vulnerabilities based on actual exposure, allowing us to see critical, high, medium, or low priorities instantly. The deployment was also very easy.

Wiz has positively impacted our organization with improved remediation speed and efficiencies in terms of time saved, as well as reducing false positives. We are currently conducting deep code scanning alongside posture management, and we have seen improvements and efficiencies in both areas. Final metrics have not been established, and I am certain that will be completed in October once analysis is finished. However, the initial findings and recommendations are very positive, indicating benefits in time saved and efficiency, as well as economies of scale in performing tasks more easily and quickly while eradicating false positives and achieving a clearer picture of real vulnerabilities.

Wiz has met my expectations in terms of accuracy and reliability of output, with the co-pilot functionality being very good. The assistant services from AI exceeded what I had anticipated. Although the full range has not been tested, my experiences, along with my colleagues', have been very impressive regarding the outputs generated by AI.

While Checkmarx may perform better in some deep code scanning aspects, Wiz is considerably easier to use, has a better user interface, and offers a more compelling argument for its use. It is more robust and stable, making these positive points quite clear. The only slight negative is its scanning capability compared to Checkmarx, but it is still very good. Additional comments regarding needed improvements around scanning capabilities or any other area where Wiz could catch up to Checkmarx are not necessary.

Wiz has been used for a proof of concept over the course of a few weeks. A decision regarding adoption will be made by our company based on the findings and recommendations from the participants in the proof of concept initiative.

Wiz is stable based on proof of concept experience, and it is certainly much more stable than Checkmarx.

I am very impressed with Wiz's scalability. We began with 50 licenses and quickly increased that number to 200. It was efficient in scaling up. While we anticipate needing in excess of 200 licenses moving forward, we are confident Wiz can handle that demand.

Customer support receives a rating of 10 because we had a few initial questions, and they responded quickly and professionally, resolving all our issues regarding identity and access management in a short period.

The main solution currently in use is Checkmarx. We considered switching because Checkmarx experienced several outages and failures in service delivery, prompting us to explore other options in the marketplace.

During the proof of concept, there was minimal interaction with other applications. There was a link to Jira and Confluence for ticket creation, but since it was a proof of concept, much of the information was dummy data. Wiz was used primarily in isolation to see how the product would function on its own, without integration with other products.

Post-sale support services were not used during the proof of concept. The next step will be to collect all findings and make recommendations to senior management, who will decide whether to implement Wiz within the company.

A return on investment has not been technically realized yet, but efficiencies have been achieved in terms of fewer false positives and reduced analyst time on resolving vulnerabilities. These metrics will become clearer in October after assessing how Wiz performed against Checkmarx. The initial findings are encouraging, and we are optimistic about future assessments.

No involvement occurred with pricing, setup cost, and licensing for Wiz since it was a free proof of concept. Approximately 200 licenses were provided for the initiative, but pricing moving forward is unknown. It is expected to be more expensive than Checkmarx; however, the overall feeling is that Wiz is the more stable and user-friendly product, strong with features and functionality, potentially favoring the decision to move forward.

The recommendations provided by Wiz were valuable. This functionality is not available with Checkmarx currently. The concept of using the co-pilot and large language models, along with agentic AI, is refreshing and potentially very beneficial for future operations, particularly in troubleshooting and root cause analysis.

Multi-cloud risk mapping was very useful because we could see everything with no hidden elements. Everything was visible and transparent. In terms of prioritization, we could identify which specific area of the cloud or container contained vulnerabilities. When critical issues appeared, we could develop metrics to understand where specific problems lay. If a certain area had multiple critical vulnerabilities, we looked deeper into that area to find underlying causes. Significant immediate information was available, as well as information that could be gleaned after conducting root cause analysis. Trends and trend analysis have improved, helping us build a clearer picture of what is happening, where it is happening, and why. Robust static application security testing (SAST) and SCA analysis at the code level proved very useful. Catching vulnerabilities early was a key highlight and takeaway from the proof of concept.

The recommendations provided by Wiz were valuable. This functionality is not available with Checkmarx currently. The concept of using the co-pilot and large language models, along with agentic AI, is refreshing and potentially very beneficial for future operations, particularly in troubleshooting and root cause analysis.

My overall rating for this review is 9.

Public Cloud

Microsoft Azure

My main use case for Wiz includes utilizing Wiz Code, Wiz Defend, and Wiz Cloud Security Posture Management.

A quick specific example of how I use Wiz Cloud Security Posture Management in my day-to-day work is analyzing all the issues we see within the cloud and infrastructure as a code over our SOC team and security engineering.

I have been using Wiz during these years and think it is a great product; I can review in depth when the need is being requested, and I have been doing POCs of other vendors out there compared with Wiz.

I did create a custom dashboard in Wiz, and my experience with it is that it works well, has a flexible widget system, good query-based customization, and easy cloning for multi-team environments, but it could work better with limited visualization types.

Wiz runtime sensor has helped in identifying active threats more effectively compared to previous solutions by providing increased visibility and accuracy, especially when correlating runtime behavior with cloud posture; it offers better context around runtime activity, faster detection of critical threats, improved detection accuracy, increased visibility across assets we previously missed, and stronger support for incident response, with the overall impact rated 10 out of 10.

Before adopting Wiz, we relied on multiple disconnected tools for CSPM, vulnerability scanning, and infrastructure as a code review, which each provided partial visibility; Wiz replaced most of these functions with one unified security graph that brings together configuration, risk, identity, workload vulnerability, data sensitivity, and exposure path in one way.

The standout features of Wiz that make it valuable for me include good multi-cloud environment support, data governance, shadow IT detection, DevSecOps governance, automation, level reporting, threat detection, and good infrastructure detection.

Wiz has positively impacted my organization by implementing zero trust authorization, providing good reporting that shows the top attack path, critical assets, overall risk posture, and demonstrating AI and ML workload capabilities towards my team, as well as good infrastructure detection and vulnerability detection accuracy with security posture management at massive scale and identity exposure. There is a massive reduction in risk exposure, immediate visibility across the entire cloud estate, reduced noise and better prioritization, stronger DevSecOps collaboration, continuous compliance instead of ad hoc panic, faster incident response with real context, significant cost savings through tool consolidation, and stronger AI and data governance.

Wiz can be improved with better maturity in code scanning and developer workflows, expanding secret detection to full lifecycle management, stronger IAM across multi-account environments, more transparent attack path scoring and risk modeling, improved AI and ML security scanning, reduced false positives in runtime threat detection, more fine-grained access control and tenant separation, and better integration for serverless workloads.

I have been using Wiz for around two years.

In my experience, Wiz is very stable.

Wiz is very scalable.

I do use Wiz's post-sale support services, and I am improving every quarter the performance of the tool with their assistance.

The customer support for Wiz is very good.

Positive

I have evaluated multiple solutions before Wiz, including Palo Alto Prisma Cloud, Orca Security, Lacework, Check Point, Qualys cloud solution, Snyk, Checkmarx, and other DevSecOps platforms.

I have seen a return on investment with Wiz by reducing our budget spent on other tools, saving time, and needing fewer employees.

Wiz has reduced alert fatigue in my organization by around 90% over a given time period.

My experience with pricing, setup cost, and licensing for Wiz was through an RFP where they offered us a good price, and the licensing was a flexible solution based on our business.

My advice for others looking into using Wiz is to try it not just as another security tool, but as a foundational visibility and risk prioritization platform for your entire cloud environment; to get the full value, you need to think strategically about adoption, ownership, and cross-team alignment. I would rate this review as a 9 out of 10.

Hybrid Cloud

Amazon Web Services (AWS)

I use Wiz for visibility, cloud visibility, and inventory. We will be using it for prioritizing toxic combinations like risk analysis or vulnerability management and compliance and governments.

The best features in Wiz are visibility and the security graph, which is one of the main core components of Wiz. Instead of flat results, Wiz builds a digital twin of your entire cloud environment such as AWS and Azure. A site scanning option is also available. One of the main features is automated compliance mapping in Wiz.

As a security analyst, I would say automated compliance mapping is one of the important features because many companies do not actually know everything they have running in the cloud. Wiz provides a single pane of glass to see shadow IT, discovering any forgotten database or server created by developers during unmonitored periods. Multi-cloud management allows seeing assets across different providers, such as AWS and Azure, and maintaining a real-time list of virtual machines, serverless functions, buckets, and containers.

Wiz is a full-scale cloud detection and response platform. Agentless scanning is taking a high-resolution photo of your house once an hour to check for unlocked windows. Runtime is having a motion-activated security camera or a guard on site for twenty-four seven. Unlike other traditional agents that slow down servers, Wiz uses extended Berkeley Packet Filter, which is one of the major key features. It is incredibly lightweight and provides deep visibility into containers and Kubernetes nodes, where agentless snapshots might miss live execution details compared to the previous tool I have worked with.

The security graph takes you to zero through the toxic combination filter, which is the fastest way to clear the queue by focusing on the security graph and its logic with a high CVSS score, vulnerability that is exposed and has server identity that can reach sensitive data. Resolving those specific combinations first means that once the path is broken, for example by closing a port or stripping a permission, the issue moves to zero. To automate that remediation and keep the queue at zero, you cannot rely on manual clicks, so you can set up automation rules that automatically resolve critical issues in Jira or ServiceNow. Serverless cleanup will trigger a Lambda function to automatically remove any permissive IAM role and quarantine any suspicious container the moment Wiz detects it.

Wiz reduces alert fatigue. Unlike traditional scanners, Wiz uses a security graph to filter out the noise. Time to value is achieved through agentless deployment. Wiz connects via API rather than requiring software installation on every server. It provides one hundred percent visibility in minutes, which is one of the key benefits.

For time saving, I have reduced around forty to fifty percent time reduction in investigation by using the Security Graph to show exactly how an attacker could reach a database. That almost saves seventy percent of my time. Instead of manually tracking, which would take much time, it saves overall around forty to fifty percent. The alert volume will decrease almost eighty to ninety percent. SLA issues are also addressed. While using this, I do not have to be afraid of facing any SLA issues since it will reduce almost all the backlogs, ensuring all the critical vulnerabilities are fixed within their required policy window. For cost saving, replacing several point solutions with one platform is absolutely cost saving compared to many other products in the market.

Everything Wiz has in place is good enough to analyze things.

Nothing has to be added in the future.

The alert fatigue zero issues and priority-based consolidation security graph and anything that has in it easily make it rate eight, including its customer service and support team service. Two percent would be that the loading time is taking a bit longer while loading the graph, and while navigating to other links, that is also taking some time. That is why I am giving it an eight instead of a ten.

I have been working with Wiz for almost five years.

I have not faced any stability issues during my use of Wiz.

I have not experienced any scalability issues.

The customer support in Wiz is really good. They are super quick to answer the queries that I am facing or any kind of issues that I am facing. They are responsive over time. The onboarding was easy and smooth.

The support team is really helpful, and whenever I raise any kind of ticket about issues I am facing, they will immediately respond to it.

Positive

It was easy while onboarding Wiz.

Wiz was purchased from the same marketplace. I did not buy it from a different place.

Wiz is absolutely cost-effective.

The setup cost is somewhere around twenty-four thousand dollars based on your organization's size.

Wiz does consolidate the issue and the priorities and the containers. I would recommend Wiz because of its time-saving ability. You can almost see what are the criticalities that are there and the consolidation feature that is also there in Wiz. Majorly, the security graph will give you a deep information to analyze things in a much better way.

Traditional scanners and other tools do not treat every vulnerability as a priority. Wiz has the security graph to filter out the noise and by only surfacing toxic combinations, security teams can stop chasing thousands of low-risk patches and focus on the few that actually matter. It allows a small security team to manage a massive complex cloud environment without hiring dozens of additional users to look into it.

For any organization who want to think of moving to Wiz, the Security Graph feature is amazing and awesome. It will give you deeper information than any other tools does. That is the main thing to consider. Overall, I rate this product an eight.

Hybrid Cloud

Amazon Web Services (AWS)

I have been using Wiz Code for the past one and a half years.

The main use case for Wiz Code is to write the security guardrails for our environment. For example, I need to write infrastructure guardrails such as S3 buckets must not be public, security groups must not allow 0.0.0.0 on SSH port 22, and RDS databases must have encryption enabled. These are examples for which we use Wiz Code to write these guardrails.

We also use Wiz Code to write Identity and Access Management guardrails such as detecting overly permissive permissions. For instance, no IAM policy should contain action star, and no role should have administrator access unless approved. Cross-account trust relationships must be justified.

Some of the best features Wiz Code offers is code-to-cloud mapping. Most tools will tell us that you have a vulnerable package, but Wiz tells us this vulnerable package is running in a production workload that is internet-facing and has access to sensitive data. This context dramatically improves the prioritization because I can focus on exploitable risk instead of thousands of theoretical findings. For AWS environments, this is extremely useful. Wiz Code can scan Terraform, CloudFormation, Kubernetes manifests, and can catch issues before deployment such as public S3 buckets, unencrypted databases, overly permissive security groups, containers running as root, and hardcoded secrets. This is where I can codify architecture standards into enforceable controls. The ability to define guardrails and fail builds is a major strength.

One of the best features I have been using day to day, which is the lowest effort win, is finding AWS keys, tokens, passwords, and certificates before they hit GitHub or production, which prevents many incidents. There is a unique capability in Wiz Code that instead of viewing cloud findings, vulnerability findings, IAM findings, and code findings in separate tools, Wiz Code correlates them through its security graph, allowing us to trace an issue from code all the way to the business impact. This is where I think Wiz Code is the strongest.

Wiz Code provides a unified developer experience where developers can see findings in IDEs, pull requests in GitHub, and in CI/CD pipelines, which reduces the back-and-forth effort. Wiz Code has impacted the organization positively by providing these features, the ease of work, and all these security graph correlation, unified developer experience, secrets detection, and security policies that block bad deployments. With all these, it has actually helped us prevent a lot of vulnerabilities in the environment, which has had a positive impact on the organization. The incident count has reduced almost 35 to 40 percent with the Wiz Code guardrails that we have been using for a long time now.

First, Wiz Code's areas of improvement can be better architecture-aware analysis. Today, most findings are resource-centric; for example, a security group is public, an IAM role is over-permissive, or an S3 bucket is exposed. What architects want is for Wiz Code to understand that this design violates the organization's reference architecture and to identify deviations from approved patterns such as hub-and-spoke networking and shared services. It would be beneficial to move from configuration review to architecture review.

Another improvement area is that many organizations struggle to translate security standards into policies, so Wiz Code could generate and validate the policy automatically. That would actually benefit the organization in faster guardrail creation and maintenance. Imagine uploading Terraform architecture diagrams and design documents and asking Wiz Code to review this architecture against enterprise security standards; the output could include risks, missing controls, compensating controls, and recommended guardrails, bridging architecture governance and automated security. This point needs to be worked on and improved by Wiz Code.

From Wiz Code's AI capabilities, I would say Wiz Code has been investing heavily in AI-driven workflows, security agents, remediation, guidance, and AI-powered investigation. I appreciate that AI recommendations are grounded in actual cloud context, and they can trace risk from code to cloud to resource to exposure. There are areas of improvement; more architecture-level reasoning is required, better explanations of why a design violates the enterprise standards, and more what-if analysis before deployment. Governance is the area where Wiz Code actually shines; for large enterprises, governance is not just finding vulnerabilities; it includes ownership, accountability, exceptions, policies, risk acceptance, and auditability. For a financial bank, the most valuable governance capabilities are mapping risk to business owners, consistent guardrails across cloud accounts, evidence for auditors, policy-driven enforcement, and risk prioritization based on context. Security is, again, Wiz Code's strongest area.

I rate the accuracy and reliability as good, but not yet at a level where I trust it without validation. It does well with security explanations; the AI is quite good at explaining why a finding matters, potential attack paths, impact to cloud resources, and security best practices. For example, if it finds a public S3 bucket, overly permissive IAM roles, or public security group, the explanations are usually accurate and aligned with security principles. The remediation suggestions for common issues such as restricting IAM permissions, enabling encryption, and removing public exposure save engineers time because they do not have to research the fix themselves. However, I am cautious with least privilege recommendations because the AI may suggest removing permissions or tightening IAM policies, but it does not always fully understand business requirements, operational dependencies, and future use cases. As an architect, I never approve IAM changes solely based on AI output. Additionally, complex architecture decisions such as shared VPC models can be problematic; AI often lacks the broader organizational context needed to judge whether a design is appropriate, and it might recommend practices that do not align with organization-approved patterns.

I have been using Wiz Code for the past one and a half years.

Wiz Code is really stable.

Wiz Code scales quite well from an enterprise perspective, and I would consider scalability one of its stronger attributes. When evaluating scalability, I look at repository scalability; Wiz Code is designed to integrate with major SCM platforms and can scan thousands of repositories across multiple business units and development teams. Secondly, in terms of cloud environment scalability, this is where Wiz Code generally excels, being built to handle thousands of AWS accounts, multi-cloud environments, and millions of cloud resources. The code-to-cloud correlation capability benefits from this large-scale architecture.

Customer support is really helpful with immediate responses and quick turnaround times.

Before Wiz Code, the security team manually correlated the cloud assets, vulnerabilities, IAM permissions, and internet exposure, with critical issues identified in five days. Now, with the security graph automatically correlating findings, critical issues are identified in 30 minutes, resulting in a 90 percent plus reduction in investigation effort. There is also a reduction in security review effort relevant to the architecture review role, where previously three hours were needed for security review and 20 manual checks; now, Wiz Code validates all this and does it for us.

I was not actively involved in the setup cost and licensing, but I definitely know the pricing was something good given the usage and benefits it provides. I would say the pricing is not too high.

My team evaluated Palo Alto Networks Prisma Cloud, Microsoft Defender for Cloud, Checkmarx One, and Snyk when choosing Wiz Code.

One must give some time to using Wiz Code initially, and they will definitely have a positive experience with using it. Wiz Code was purchased through the AWS Marketplace. Wiz Code is deployed in my organization on public cloud. AWS is our cloud provider. I rate this product 8 out of 10.

public cloud

Amazon Web Services (AWS)

My main use case for Wiz is in my report, where I use it when we push any code changes on GitHub. The DevOps team sets one pipeline that includes Wiz scanning. When we push any changes, if there are any vulnerabilities or security issues related to the code, Wiz raises a vulnerability that stops the pipeline execution and prevents deploying any changes. When we need to deploy, we fix those changes first and then proceed to deploy.

Wiz fits into our workflow as a very good tool, which I can affirm because of the many levels of scans they offer. As developers, we focus on completing tasks and may overlook security aspects, but we have a Wiz plugin in VS Code and IntelliJ IDEA. We run scans locally to fix any issues before pushing code to GitHub, ensuring that we resolve potential problems upfront.

Wiz is deployed in my organization through a private cloud setup, and as a developer, I use it with integration provided by the Infosec and DevOps teams during code changes and deployment processes.

The best features Wiz offers include its comprehensive scanning capabilities, which are essential for my work.

In addition to the good features, Wiz scanning is integrated into our repo. The DevOps team added that functionality, and the reporting aspect alerts us via email when vulnerabilities are raised, indicating deployment failures due to those issues. We receive timely notifications after deployment failures and have good integration with our DevOps team and pipelines, along with a user-friendly interface that provides details and hints for fixing vulnerabilities.

Wiz positively impacts my organization, especially since we are in the insurance sector where data security is paramount. Cybercriminals and cyberattacks are constant threats; thus, Wiz's scanning helps ensure we do not expose vulnerabilities, enhancing my organization's security and trust with clients.

Regarding specific outcomes or metrics, compliance has notably improved in my organization. With the Wiz plugin at the local level, we identify vulnerabilities before pushing changes, allowing us to fix them ahead of time. While I cannot claim faster development cycles outright, I can say that Wiz helps mitigate issues that might arise post-deployment, reducing pressure and ensuring security upfront.

While Wiz provides excellent data and reports, sometimes the suggested fixes for vulnerabilities are not always accurate based on our code compatibility. For example, if Wiz recommends upgrading from log4j to log8j but our code only supports log6j, this can lead to issues. Additionally, I suggest incorporating AI to provide real-time hints for fixing vulnerabilities during scans, as this would enhance usability significantly.

Regarding needed improvements in Wiz, the integration and usability are quite effective, though adding AI-driven features could significantly assist developers in addressing vulnerabilities more efficiently, thereby improving deployment times and adherence to deadlines.

I have been using Wiz from last two years.

Wiz is stable and scalable, with no downtimes experienced during changes, ensuring that any vulnerabilities found are addressed without affecting my workflow.

Customer support from Wiz is quite good. While I have not directly engaged with them, our Infosec and DevOps teams liaise with Wiz and receive prompt responses, indicating a positive experience overall.

I am unsure about post-sales support services and whether my organization utilizes them. We typically raise tickets through the DevOps team, which handles communication with Wiz, and I find that process works well.

I am not certain about other solutions evaluated before Wiz, but we also use Snyk alongside Wiz. Both tools have their strengths, but I find Wiz to be more advantageous due to its detailed summaries and team support.

I have seen a return on investment with significant effort reduction, as Wiz vulnerabilities allow us to detect risks before cyberattacks can occur, building trust with my clients because we prevent sensitive data exposure.

I do not have detailed information about pricing, setup costs, or licensing as I am just a user. However, I have heard the setup cost is low and that we subscribe on a yearly basis.

Wiz reduces alert fatigue within my organization effectively, as we perform local scans before pushing changes to GitHub, which minimizes issues at the production level and alleviates the stress of resolving errors late in the deployment process.

Wiz runtime sensor effectively helps in identifying active threats, allowing us to recognize and address serious issues at the development and local levels before they reach production, thus ensuring security and reliability.

The cloud security democratization aspect of Wiz is significant, as it enhances my organization's security management by ensuring standards are upheld through local and repo-level scans, even though I do not manage cloud security directly.

My advice for others looking into using Wiz is that it is crucial for building trust with clients and securing products, as it addresses vulnerabilities effectively before production, thus helping prevent cyberattacks and enhancing organizational reputation.

My company only has a customer relationship with Wiz, and I do not have additional information regarding other business relationships they may have.

I rated this review 8.5 out of 10.

Private Cloud

Amazon Web Services (AWS)

Wiz allows us to get a view into what's happening in our cloud environments, helping us see the gaps, how things are connected, and it aids in CVE monitoring, especially during incident response as we're able to look at what that environment or host might look like, how it connects, and how big of an issue this might be versus how small it could be, along with other indications gathered from Wiz's reporting that help us better understand what's happening and how it might have all started.

We have created a couple of custom dashboards and charts for Wiz to help keep track of specific environments. One example is when we were looking for certain types of activities; it allowed us to create a singular place to see the events in the subscriptions of interest that needed remediation, bringing it together quickly, allowing us to take action and track progress as things were fixed.

Zero Criticals is the dream for us; that's our goal, and we've made good progress, with Wiz allowing us to see everything together in an easy-to-understand way, giving us a path to have conversations with the business about what can be done from policy or user education standpoints to prevent recurring issues that need remediation, resulting in improved numbers and positively impacting our approach over time.

Wiz has enabled us to consolidate tools. Having multiple cloud providers presents challenges as each has its own versions of security products, leading to the problem of needing to monitor three different tools, which do different things. Wiz helps standardize alerting and responses while allowing us to fill in the gaps since many tools don't do CVE analysis and reporting, resulting in time savings and less effort in creating detections to fill those gaps.

Wiz helps us consolidate our alerting process. I am a strong advocate for avoiding alerts that do not add value to our environment. It's especially crucial to eliminate alerts that are single-instance or one-off occurrences. Instead, we need detections that tell a comprehensive story. Additionally, we require a way to drill down into these detections to understand them fully. Wiz has surpassed other tools across the multi-cloud landscape in alerting us to the issues that truly matter. It presents the information in a manner that allows us to address and remediate those issues effectively.

Wiz also includes excellent remediation steps within the detection, helping us understand what is happening. Our SOC team comprises individuals with varying levels of seniority and experience in the cloud, which can present challenges for skill development. Therefore, it is vital that we don’t just receive a barrage of noise in our SOC; we need information that clarifies what actually happened. Being able to communicate to the business how to resolve these issues is extremely important to us. Wiz has filled the gaps where other tools excelled in one or two areas but failed to provide a complete picture.

My favorite feature of Wiz is how it gathers information together; instead of generating a thousand independent signals, it rolls that up and shows you within that environment how all the different toxic combinations contribute to a critical alert, making it an issue worth responding to, unlike many other vendors or tools that show singular things which may appear small, but when looked at holistically, are actually part of a much bigger issue needing attention.

Wiz has significantly reduced alert fatigue in our organization. One of the key functions is that it groups together elements that can form toxic combinations. Instead of treating a policy violation and a critical CVE as separate issues that would generate two different alerts requiring two different tools, it consolidates them into a single event. This allows us to identify problems more effectively. For example, if I see a high or critical CVE alongside a policy misconfiguration tied to an account, I know I need to address both issues. This grouping enables us to take action rather than approaching it as a simple decision of whether or not to act on a single alert. Previously, I might see a policy issue and wonder if it’s significant enough to warrant attention. However, when these issues are combined, I can assess the full scope of what’s happening, allowing me to take appropriate action. I can also determine quickly whether something might be a false positive, preventing unnecessary investigations.With the critical issues we identify, we can confidently fix them and reach out to the right people without relying on a "hope" strategy or waiting for an hour of research to see if it turns into something actionable. Based on my experience with other tools, Wiz helps us bypass that frustrating process.

I believe they are on the right path. However, Wiz has a unique way of identifying issues. As part of its growth and maturity, I'm noticing that it is taking an approach where it not only detects problems but also provides solutions to fix them. This expansion into a more comprehensive ecosystem allows it to become a 360-degree product. Instead of just continuously pointing out findings and detections, it starts to integrate with existing solutions, reducing the cycle of repeated issues. We can learn from these mistakes, and ideally, they will only occur once, allowing us to address them effectively. I appreciate the continued growth in this partnership, as it aims to reduce the number of findings over time by tackling the root of the problem.

One significant area for improvement would be increasing automation. While they excel at identifying issues, we need assistance in minimizing the human hours required for tasks. Ideally, the process would become more automated, allowing us to quickly respond with steps such as: we found an issue, reached out, and fixed it immediately. In cybersecurity, if it takes several hours to address a concern and a human attacker is present, that delay can lead to severe consequences. We need more immediate measures in our response strategies.

I have been using Wiz for almost two years.

Regarding stability, I was pleasantly surprised by the performance of this SaaS provider. We haven't encountered any outages or issues with reports not running, finishing, or data being incomplete or inaccurate.

Scalability is great. We haven't faced any problems. There were no requirements like, “once you get to this point, you have to do this or that.” We were simply able to connect our accounts, and during our last round, our environment quadrupled in size. We didn’t have to make any adjustments or configuration changes; it just accommodated the growth. Even as some environments scaled back down, the service scaled back down with us, which has been a great benefit.

Regarding technical support, we haven't needed to contact them. All the questions and issues we encountered were addressed by our account team. It was very helpful not having to open a ticket and wait for assistance; our account team was knowledgeable about the tool and could provide immediate answers. This level of support was refreshing, as we didn’t have to deal with delays or uncertainty. Overall, we were very satisfied with the support we received.

For support, I would rate them a ten out of ten. They have great documentation and excellent support from the account team, which reduces how much you have to rely on technical support. I've dealt with other tools where the account team couldn't answer any questions, and the only option was to open a ticket and wait, sometimes for a day or two, for someone to respond. However, with this service, we received answers immediately and at the level we needed. Additionally, we received plenty of training and education without having to pay for expensive classes. So, I would definitely give them a ten in that area.

Positive

It was very easy to deploy. We were able to get everything set up quickly during a call with our Wiz account team. They walked us through the process, and once we connected the accounts, it was off and running. From that standpoint, it was great to easily tap into the different cloud providers. The experience was positive overall.

After the initial setup, the team also assisted us with health checks to ensure everything was functioning properly. They provided feedback and helped us make any necessary adjustments to permissions so that the tool would work effectively.

As for the setup time, we had a 30-minute call scheduled, and we managed to complete the setup within that timeframe. It mostly involved connecting the parent account and giving Wiz access to deploy the tool. After that, we were able to start viewing the results. So, in total, we spent about 10 to 15 minutes actually configuring it during that 30-minute window.

I’m familiar with their pricing. I believe it aligns well with what we typically see for security tools. It’s not unreasonable or outrageous. They have a great product that works effectively and fulfills its intended purpose. I don’t think there’s anyone else out there offering the same level, scale, or efficiency. While their pricing may be a bit on the premium side, it also enables users to consolidate tools, which can offset some of those costs.

A significant alternative out there is AWS GuardDuty. It operates within a single scope, analyzing your logs and identifying signals of potential issues. However, this can lead to high alert fatigue because it focuses on individual events. Instead of grouping and triaging alerts, it may send you multiple separate notifications for a single host or device performing several actions.

In addition, we've utilized scanners for Common Vulnerabilities and Exposures (CVEs) like Rapid7. This tool effectively scans for CVEs, but it requires thorough configuration, continuous monitoring of output, and the creation of reports to take necessary actions. This process is not on the same level as Wiz, which consolidates all of these tools into one platform.

We haven't used Wiz Runtime Sensor; we've seen demos and it looks really cool, but it's not something we have implemented.

I believe there isn't a perfect tool, but Wiz comes very close, continuously growing and expanding to add more value into its ecosystem, and I'm happy with it. I would rate Wiz a nine out of ten.

Public Cloud

Amazon Web Services (AWS)

Our primary use case for Wiz is Cloud Security Posture Management and Cloud Native Application Protection.

One of our clients was preparing for a security assessment, so Wiz identified an internet-facing EC2 instance with excessive IAM permissions and outdated software containing critical vulnerabilities. Instead of reviewing multiple security tools separately, Wiz correlated the exposure, vulnerability, and privilege information into a single risk finding. That allowed us to remediate the issue quickly before the audit.

We use Wiz daily to monitor cloud resources, investigate security findings, and prioritize remediation based on actual business risk instead of simply focusing on CVE severity.

The best features offered by Wiz are the Attack Path Analysis and the risk prioritization and agentless cloud security scanning.

The Security Graph and Attack Path Analysis have been the most valuable in our organization because rather than generating thousands of alerts, Wiz helps us to understand which findings represent real risk and should be addressed first.

Wiz has improved our visibility into cloud risk, reduced manual security assessments, and helped us prioritize remediation efforts more effectively.

It reduced the time spent investigating cloud security findings by around 40% and also accelerates the process of identification of critical cloud risk.

The findings from Wiz are generally accurate and well prioritized, and I appreciate that Wiz focuses on contextual risk rather than overwhelming us with every possible vulnerability.

More customizable executive dashboards can be created, and better reporting for non-technical stakeholders can also be improved in Wiz platform.

Overall, it is a mature platform and most enhancements I would like are around reporting automation and simplifying executive level reporting.

I have been using Wiz for approximately one and a half years.

Our companies are currently processing terabytes of data, and Wiz is very stable.

Wiz is very scalable, so there is no problem in that regard.

We have used the support services after purchase, and they are very good. Their teams are very knowledgeable and very supportive, and their team can handle all issues.

Customer support is very good, and they are very knowledgeable and always ready to help you out from any difficult situation or if you face any complexity in Wiz platform.

Before using Wiz, we relied on multiple tools for vulnerability scanning, cloud configuration checks, and cloud native security services. Each tool generated its own findings, so correlating risks required manual effort, but with Wiz, we get a unified view of combined vulnerabilities, misconfigurations, exposed assets, IAM permissions, and runtime context all in a single platform.

Previously, we were using multiple tools for cloud security, cloud native application management, AWS monitoring, and similar tasks, but we wanted a single platform that encompasses all these capabilities, so we switched to Wiz.

Setup is very easy, and if you feel any difficulty while setting up anything, their support team is ready to help you out with that.

We have used the support services after purchase, and they are very good. Their teams are very knowledgeable and very supportive, and their team can handle all issues.

Customer support is very good, and they are very knowledgeable and always ready to help you out from any difficult situation or if you face any complexity in Wiz platform.

We have seen the ROI from this because it reduced our engineer's time by 50% and also saved time on addressing false positives, allowing us to be very confident in our posture.

The pricing is a bit higher than the market rate, but the value it provides is more valuable than the pricing. Setup is very easy, and if you feel any difficulty while setting up anything, their support team is ready to help you out with that. We are running it on a monthly license basis, so we have not purchased the enterprise version.

We have not evaluated any other option.

AI security posture management in the cloud is very important because risks are increasing, and to reduce the manual effort of every department, AI agents can be deployed in cloud security posture to directly find AI security as connected within the organization.

Wiz has reduced the alert fatigue in our organization, and if you are fully migrated with Wiz, within a week you can see the difference.

Before Wiz, we used Falcon as a runtime sensor, and after using Wiz, we are now 100% sure that Wiz's Runtime Sensor is very accurate and helped us to identify active threats more effectively compared to our previous solution.

Teams currently using multiple platforms for security assessments, compliance monitoring, cloud native application posture management, and cloud security posture management can directly switch to Wiz without any hassle, and it will be a very valuable decision for their teams.

Wiz is very scalable, so there is no problem in that regard.

Wiz is a very mature platform that we use daily as an end-to-end cloud management tool. It is great as it reduces your company's security risk and actively monitors your entire cloud infrastructure, so you do not need to worry about any cloud risks affecting your organization. I would rate this product a 9 out of 10.

Wiz Code is used for vulnerability management by scheduling a scan for the entire infrastructure, then exporting the report and sharing it with the remediation team. Sometimes, zero-day vulnerabilities are discovered, and remediation steps are checked to see if they have been released. The scan status for scheduled or on-demand scans is monitored, and once a scan is complete, verification is performed to ensure correct data is being retrieved. The main use case for Wiz Code is vulnerability management for infrastructure.

Wiz Code offers minimum false positive vulnerabilities, which is the best feature and meets expectations for the tool. Another valuable feature is remediation, where remediation steps are provided and remediation status can be tracked.

The remediation tracking helps the workflow by making it faster to track and making remediation easier. For example, one report is created for everything, and then the steps for remediation are provided.

Scanning in Wiz Code takes a lot of time. When running 50, 100, or 1,000 assets at one time, it takes nine or ten hours, and the reason is unclear. If the scanning time could be improved, it would be helpful.

Slowness is sometimes experienced when accessing Wiz Code, which is on the cloud. Connection timeout errors occur sometimes, and sometimes it is not available, so that needs to be resolved. Feature-wise, compared to zero-day vulnerability remediation steps, remediation steps are received faster on Qualys and Tenable. In Wiz Code, it takes five, six, or seven days, and zero-day vulnerability remediation steps are not provided that quickly.

Wiz Code has been used for the last two years.

Wiz Code is stable now.

Wiz Code's scalability is good now.

Timely responses from customer support for Wiz Code are not being received. Service requests are raised, but proper responses are not provided. It takes 24 to 48 hours to get a response, even after asking for updates multiple times, so customer support needs to be improved.

Tenable was used previously, and the management decided to switch to Wiz Code because it was costly. The decision was made to go with Wiz Code as a more affordable alternative.

A return on investment has been seen with Wiz Code, as it is money-saving. Management provided the update that it is money-saving.

Before choosing Wiz Code, Tenable Security Center was evaluated, and the decision was made to go with Wiz Code.

Wiz Code's implementation positively impacted the organization, and the decision to go with it was made because of the billing. Feature-wise, it is not much different, but the billing is impacting. Tenable and Qualys are more costly compared to Wiz Code, which is why the organization decided to go with Wiz Code.

Wiz Code has a feature for the dashboard, and dashboards are created to give the status for business metrics. These metrics include what the critical assets are, how many worldwide spread vulnerabilities there are, how many assets per location, what the remediation is, how old the vulnerabilities are, and how many are end of life. The dashboard is very easy to create and creates a business metrics overview for everyone to see what the risk is in the organization. The metrics feature is very good.

Wiz Code's governance and security regarding AI capabilities are pretty good, and there is no issue with that.

The accuracy of Wiz Code is understood to be up to 95% or 96%.

If you are mostly on the cloud, Wiz Code is recommended. If you are mostly on-premises, it is not recommended.

This review receives a rating of 8.

Hybrid Cloud

Amazon Web Services (AWS)