What is Wiz? Wiz cyber security explained for Australian organisations

What is Wiz? The short answer

Wiz is a cloud and AI security platform, now part of Google Cloud. In Wiz's own words, it connects code, cloud and runtime into a single security graph. It connects to cloud accounts through their APIs without installing agents, builds an inventory of everything running there, and checks it for misconfigurations, vulnerabilities, network exposure, excessive permissions, exposed secrets, malware and sensitive data. It then links those findings in the Wiz Security Graph to show which ones combine into a real path an attacker could use, so teams fix the risks that matter first. Wiz also scans code before it is deployed and detects threats in running workloads. This kind of platform is known as a cloud-native application protection platform, or CNAPP, and Wiz now describes its platform as an AI Application Protection Platform (AI-APP).

Who makes Wiz

Wiz began as an independent cloud security company whose stated mission is to help organisations create secure cloud and AI environments that accelerate their businesses. Google completed its acquisition of Wiz in March 2026, and the Wiz team joined Google Cloud. Google has said it will keep the Wiz brand and that Wiz products will continue to work and be available across the major clouds, including Amazon Web Services, Microsoft Azure and Oracle Cloud, as well as Google Cloud, offered through a range of partner solutions (Google Cloud's announcement). For an organisation that runs mostly on AWS or Azure, Wiz is still a multi-cloud product, not a Google-only one.

Google has also said it intends to combine Wiz's cloud and AI security platform with Google Threat Intelligence and Google Security Operations, so that threats can be detected, prevented and responded to across environments. For Wiz customers, that is a direction to watch rather than a requirement: Wiz continues to send findings to whichever SIEM and ticketing tools an organisation already uses.

How Wiz cyber security works

Most cloud security problems are not caused by a single exotic flaw. They come from ordinary issues that line up: a server that is reachable from the internet, running software with a known vulnerability, with a role attached that can read a database full of customer records. Each issue on its own might sit low on a list. Together they are a breach waiting to happen. Wiz is designed around finding those combinations.

• Agentless connection. Wiz is given read-only access to a cloud account, subscription or project through the provider's APIs. From there it discovers resources (virtual machines, containers, Kubernetes clusters, serverless functions, storage, databases, managed AI services) and reads their configuration. To look inside workloads for vulnerable packages, secrets and malware, it scans read-only snapshots rather than running software on each machine.
• The Security Graph. Everything Wiz finds goes into a graph: which resource can reach which, which identity can do what, where sensitive data lives, what is exposed to the internet, and which code produced which resource. Because the relationships are stored, not just the individual findings, Wiz can answer questions such as "which internet-facing workloads can reach this data store?"
• Attack paths and toxic combinations. Wiz uses the graph to trace how an attacker could move from an entry point to something valuable. When several weaknesses combine on one path, Wiz calls this a toxic combination and raises it as a single, high-priority issue with the context needed to fix it. That is the main answer to alert overload: a short list of issues that actually connect to something an attacker would want.
• Optional runtime sensor. Agentless scanning shows what could go wrong. To see what is happening right now inside a workload, Wiz offers a lightweight sensor based on eBPF, a Linux kernel technology, which adds real-time detection on hosts and in Kubernetes.

Wiz describes this approach on its platform overview.

Where Wiz works

Wiz connects agentlessly to the major public clouds: Amazon Web Services, Microsoft Azure, Google Cloud, Oracle Cloud Infrastructure and Alibaba Cloud. It also covers Kubernetes and OpenShift container platforms and private clouds built on VMware vSphere. For servers on premises and at the edge, where there is no cloud API to read, Wiz extends coverage with its sensor, so hybrid estates can be seen in the same inventory as cloud accounts.

Agentless and agent-based, and why both matter

The agentless model is what most people mean by Wiz: no software to roll out, coverage of every connected account from day one, and no blind spots where an agent was never installed. Its limit is that snapshot scanning describes what could go wrong, not what is happening this second. That is why Wiz pairs it with the optional sensor for runtime detection and blocking on the workloads that matter most. Most organisations start agentless and add the sensor where the risk justifies it.

The Wiz products

Wiz is sold as a platform with several products on a shared data model. Wiz now presents the whole platform as an AI Application Protection Platform (AI-APP), reflecting how much of the cloud now runs AI services, but the core products are the same.

Wiz also includes integrations and no-code workflows for routing findings to the right people and tools, which matters as much as the scanning itself.

Wiz agents

Wiz has added AI agents and workflows to the platform, aimed at removing the manual steps between finding a risk and fixing it. Wiz describes three:

• Green agent: turns risks into code fixes by opening pull requests at the source, and helps developers write secure code from the start.
• Red agent: looks for attack paths through automated penetration testing and risk discovery.
• Blue agent: automates threat hunting and investigation for security operations, to validate and prioritise real threats.

As with any automation, agents work best when ownership, approval and change processes are already clear, so that a suggested fix reaches someone who can approve it.

Wiz for AI security

Much of what now runs in the cloud is AI: managed model services, training data, AI agents and the Model Context Protocol (MCP) servers that connect agents to tools. Wiz states that it continuously discovers AI models, agents, MCP servers and services across cloud and SaaS, identifies AI-specific risks such as sensitive data exposure, guardrail gaps and exposed endpoints, connects them to the surrounding infrastructure, identity and data context, and detects AI runtime threats such as malicious agent actions. This is the AI security posture management (AI-SPM) part of the platform, and it is why Wiz positions itself as cloud and AI security rather than cloud security alone.

What is CNAPP, and what is the Wiz CNAPP?

CNAPP stands for cloud-native application protection platform. The term describes a single platform that brings together security capabilities that used to be bought as separate tools, so that posture, identity, data, workload and code risks can be seen and prioritised together. The Wiz CNAPP is Wiz's version of that idea: Wiz Cloud, Wiz Code and Wiz Defend on one Security Graph, rather than separate consoles for each capability. In practice, a CNAPP usually covers the following.

The value of a CNAPP is less in any one of these functions than in the connections between them. A CSPM tool can tell you a server is exposed; a vulnerability scanner can tell you it is unpatched; a CIEM tool can tell you its role is too powerful. A CNAPP tells you that all three are true of the same server and that it can reach your most sensitive data.

CWPP vs CNAPP

A cloud workload protection platform (CWPP) protects the workloads themselves: virtual machines, containers and serverless functions. CWPPs were among the first cloud security tools, often relied on agents, and tended to look at each workload in isolation and serve the security operations team alone. A CNAPP includes workload protection but extends it to the whole environment: infrastructure, identities, data, code and APIs, with posture management and cloud detection and response built in. It is also meant to be used by several teams at once, from DevOps and cloud engineering to the SOC, vulnerability management and governance, risk and compliance. Wiz sets out the comparison in its CWPP vs CNAPP article.

CNAPP vs ASPM

Application security posture management (ASPM) looks at the application itself, from the inside out: source code, dependencies, CI/CD pipelines and how the application behaves, connected to developer tools such as Git repositories and software composition analysis. The other CNAPP components work from the outside in, at the cloud platform, workload and orchestration layers. Wiz combines the two, connecting a vulnerability in code to where that code is running and how exposed it is in the cloud (Wiz on CNAPP vs ASPM).

If you are already comparing CNAPP options and want to talk about licensing or implementation, see our Wiz partner page.

How Wiz can help Australian organisations

The problems Wiz addresses are the same everywhere, but a few come up repeatedly for Australian organisations across government and industry.

• Seeing across several clouds. Many organisations run on more than one provider, often after acquisitions or because different teams chose different platforms. Wiz connects to AWS, Azure, Google Cloud, Oracle Cloud and Alibaba Cloud, as well as Kubernetes, and presents them in one inventory with one set of policies.
• Prioritising a backlog. Security teams often inherit long lists of cloud findings with no clear order. Attack path analysis gives a defensible way to decide what to fix first, and to explain that decision to engineering teams and executives.
• Tightening identities and protecting data. Over-permissioned roles and forgotten access keys are a common way into a cloud environment. CIEM and DSPM together show who can reach sensitive data and which permissions can be removed, which supports the obligations organisations carry for personal information under Australian privacy law.
• Shifting security left. Wiz Code checks infrastructure as code and dependencies in the pipeline and links a running issue back to the template or repository that created it, so the fix happens once, at the source, instead of being patched by hand in production.
• Detecting threats in the cloud. Wiz Defend and the Wiz Sensor add detection for activity in cloud workloads. Findings can be sent to a SIEM and to the team that monitors it, whether that is an internal security operations centre or a managed service. See our guides to what a SIEM does and how EDR, XDR and MDR differ.
• Compliance reporting. Wiz assesses cloud environments continuously against built-in compliance frameworks, such as CIS Benchmarks, NIST, ISO 27001, PCI DSS and SOC 2, produces reports and heatmaps, and supports custom frameworks for internal policies. Wiz states that its built-in frameworks include the Essential Eight. A posture report is evidence, not a compliance outcome: it shows where cloud configuration meets a control and where it does not, and people still decide what to do about it.

Notes for government and regulated organisations

Wiz has published that it completed an Infosec Registered Assessors Program (IRAP) assessment of its commercial offering against the Information Security Manual's PROTECTED level controls (Wiz's announcement). Wiz also lists Australia among the regions where its platform data can be hosted. Agencies and regulated organisations should still review the current assessment report, the hosting region for their tenancy and what data the platform stores, as part of their own risk assessment.

What adopting Wiz typically looks like

Because Wiz is agentless, the first results arrive quickly. Getting lasting value out of it is mostly about ownership and process. A typical rollout covers:

• Connecting accounts. Grant read-only access to cloud accounts, subscriptions and projects, ideally at the organisation level so new accounts are picked up automatically.
• Building a baseline. Review the inventory, confirm which environments are production, and tag resources with business units and owners so findings reach the right team.
• Prioritising. Start with critical issues and toxic combinations on internet-exposed resources and on paths to sensitive data, rather than trying to clear every finding.
• Integrating. Route issues into the ticketing systems teams already use, such as Jira or ServiceNow, send detections to the SIEM, and agree remediation timeframes.
• Shifting left. Connect code repositories and CI/CD pipelines, start with warnings, then block the issues that keep recurring.
• Adding runtime protection. Deploy the Wiz Sensor on the workloads that matter most and connect Wiz Defend to the team that responds to alerts.

What Wiz integrates with

A cloud security platform is only useful if its findings reach the people and systems that act on them. Wiz shares findings in both directions through its integration platform (WIN) and lists the following kinds of integration in its evaluation FAQ:

• Ticketing and collaboration: Jira, ServiceNow, Slack and Microsoft Teams.
• SIEM and SOAR: tools such as Splunk, Microsoft Sentinel, QRadar, Sumo Logic, Torq and PagerDuty.
• DevOps and CI/CD: Terraform, GitHub, GitLab, Jenkins and Azure DevOps.
• Identity: Okta, Microsoft Entra ID (Azure AD), Google Workspace and CyberArk.
• Cloud and asset management: AWS Security Hub, Azure Service Bus, Google Cloud Pub/Sub and ServiceNow CMDB.

How Wiz is priced and bought

Wiz says its pricing is generally based on the number of cloud workloads covered and the additional features required, with exact pricing available on request. In practice, the cost depends on the size of the estate and which parts of the platform (Wiz Cloud, Wiz Code, Wiz Defend, the sensor) you need. In Australia, Wiz can be bought through an authorised partner, which can also scope the rollout and provide implementation and support. For licensing and a quote, see our Wiz partner page.

Questions to ask before you choose a CNAPP

• Which clouds, Kubernetes platforms and on-premises environments do you need covered today, and in two years?
• Who will own and fix findings: a central security team, cloud platform engineers or application teams?
• Do you need runtime detection, or is posture and vulnerability management the priority for now?
• Which tools must it integrate with: ticketing, SIEM, identity provider, CI/CD?
• Where will the platform's data be hosted, and what assurance does your organisation require?
• Do you have the people to act on findings, or will you need implementation and ongoing support?

How TOM SHAW helps

TOM SHAW is an authorised Wiz partner. We supply Wiz licensing, implement and integrate the platform, and support it for organisations across Australia. That includes connecting your cloud accounts, setting up policies, ownership and reporting, integrating Wiz with your ticketing, SIEM and pipelines, and helping your teams work through what it finds. You can also buy our Implement and Support Wiz offer on AWS Marketplace. Find out more on our Wiz partner page, see our other security partners, or read about our SOC, MDR and XDR services and SIEM services for the people who respond to what Wiz detects.