Wiz Reviews

We are delighted to have Wiz Cloud revealing our cloud security posture across our development, QA and production systems for both Azure and AWS. We share access to the results widely with our technical staff. It's great that Wiz permits unlimited user accounts. Our professional services and support can use Wiz to demonstrate to individual customers the security posture of the systems we are hosting for them. 

Mika, the built-in AI, is easy to use. The query creation is intuitive.

The attack surface findings initially revealed numerous vulnerable systems. Upon investigation we learned that 100% of them were stale DNS entries. We deleted those but this gave us confidence that our security posture is better than the general industry.  If we were to have a vulnerable system, we're confident that Wiz will quickly surface the finding.

To someone who is looking at buying Wiz but concerned they already have too many products that give them a lot of alerts, the overview dashboard does a great job of raising the issues that matter. It intelligently filters the signal from the noise.  Interns on our team were immediately as productive with Wiz as experienced security experts.

Wiz allowed us to cancel two other tools with noticeably superior results.

Our Technical Account Manager set up weekly meetings, but we have switched it to monthly. We dove into self-training with Wiz Academy so there wasn't much value for us in the meetings. Anytime we need something, we open a support ticket and they are responsive. 

We acquired Wiz Cloud in September, 4 months ago.

As for stability, we have seen some issues where our results changed radically from one day to the next, but we had not made radical changes, so we opened a case with support. It didn't cause us any downtime.

Scalability is not an issue for us because we have a constant load. It quickly took on our substantially large workload.

I have contacted Wiz technical support frequently.

The support is excellent. We contact via an in-application portal. We can see the support cases we personally open, and also the cases that other people have opened from our company. I appreciate that feature. Generally, support gets back to us within a few days with a good answer. There was one fellow in particular who has been knocking it out of the park. He is a great support person to deal with. We are happy with the support experience.

If I were to put Wiz support on a scale from one to ten, I would give them a ten.

Positive

Wiz distinguished itself immediately in the PoC, surfacing important issues that were entirely missed by both the products we were already using and other CNAPP's that we tested. We dropped both products.

For configuration management we had been using another product that we were happy with that was much cheaper, but it did not do any of the other things Wiz does. We also had what was formerly a leading CNAPP that was priced similar to Wiz, but the support and upgrades declined rapidly. In head to head comparison Wiz stood out as the superior solution.

The initial deployment of Wiz was super easy. It only took a few hours, so we were getting results the next day.  There are still a few minor settings that Wiz scripts don't handle so we have to manually apply and then we will be fully deployed.

The deployment of Wiz is spread across different teams with different areas of responsibility on AWS and Azure. 

Quickly identified around $40K in unneeded annual expenses that we were able to drop.

Wiz is expensive, but it offers good value for the money.

I feel confident that we are learning of the issues that matter. I rate Wiz nine out of ten.

Public Cloud

Microsoft Azure

My main use case for Wiz includes utilizing Wiz Code, Wiz Defend, and Wiz Cloud Security Posture Management.

A quick specific example of how I use Wiz Cloud Security Posture Management in my day-to-day work is analyzing all the issues we see within the cloud and infrastructure as a code over our SOC team and security engineering.

I have been using Wiz during these years and think it is a great product; I can review in depth when the need is being requested, and I have been doing POCs of other vendors out there compared with Wiz.

I did create a custom dashboard in Wiz, and my experience with it is that it works well, has a flexible widget system, good query-based customization, and easy cloning for multi-team environments, but it could work better with limited visualization types.

Wiz runtime sensor has helped in identifying active threats more effectively compared to previous solutions by providing increased visibility and accuracy, especially when correlating runtime behavior with cloud posture; it offers better context around runtime activity, faster detection of critical threats, improved detection accuracy, increased visibility across assets we previously missed, and stronger support for incident response, with the overall impact rated 10 out of 10.

Before adopting Wiz, we relied on multiple disconnected tools for CSPM, vulnerability scanning, and infrastructure as a code review, which each provided partial visibility; Wiz replaced most of these functions with one unified security graph that brings together configuration, risk, identity, workload vulnerability, data sensitivity, and exposure path in one way.

The standout features of Wiz that make it valuable for me include good multi-cloud environment support, data governance, shadow IT detection, DevSecOps governance, automation, level reporting, threat detection, and good infrastructure detection.

Wiz has positively impacted my organization by implementing zero trust authorization, providing good reporting that shows the top attack path, critical assets, overall risk posture, and demonstrating AI and ML workload capabilities towards my team, as well as good infrastructure detection and vulnerability detection accuracy with security posture management at massive scale and identity exposure. There is a massive reduction in risk exposure, immediate visibility across the entire cloud estate, reduced noise and better prioritization, stronger DevSecOps collaboration, continuous compliance instead of ad hoc panic, faster incident response with real context, significant cost savings through tool consolidation, and stronger AI and data governance.

Wiz can be improved with better maturity in code scanning and developer workflows, expanding secret detection to full lifecycle management, stronger IAM across multi-account environments, more transparent attack path scoring and risk modeling, improved AI and ML security scanning, reduced false positives in runtime threat detection, more fine-grained access control and tenant separation, and better integration for serverless workloads.

I have been using Wiz for around two years.

In my experience, Wiz is very stable.

Wiz is very scalable.

I do use Wiz's post-sale support services, and I am improving every quarter the performance of the tool with their assistance.

The customer support for Wiz is very good.

Positive

I have evaluated multiple solutions before Wiz, including Palo Alto Prisma Cloud, Orca Security, Lacework, Check Point, Qualys cloud solution, Snyk, Checkmarx, and other DevSecOps platforms.

I have seen a return on investment with Wiz by reducing our budget spent on other tools, saving time, and needing fewer employees.

Wiz has reduced alert fatigue in my organization by around 90% over a given time period.

My experience with pricing, setup cost, and licensing for Wiz was through an RFP where they offered us a good price, and the licensing was a flexible solution based on our business.

My advice for others looking into using Wiz is to try it not just as another security tool, but as a foundational visibility and risk prioritization platform for your entire cloud environment; to get the full value, you need to think strategically about adoption, ownership, and cross-team alignment. I would rate this review as a 9 out of 10.

Hybrid Cloud

Amazon Web Services (AWS)

I use Wiz for visibility, cloud visibility, and inventory. We will be using it for prioritizing toxic combinations like risk analysis or vulnerability management and compliance and governments.

The best features in Wiz are visibility and the security graph, which is one of the main core components of Wiz. Instead of flat results, Wiz builds a digital twin of your entire cloud environment such as AWS and Azure. A site scanning option is also available. One of the main features is automated compliance mapping in Wiz.

As a security analyst, I would say automated compliance mapping is one of the important features because many companies do not actually know everything they have running in the cloud. Wiz provides a single pane of glass to see shadow IT, discovering any forgotten database or server created by developers during unmonitored periods. Multi-cloud management allows seeing assets across different providers, such as AWS and Azure, and maintaining a real-time list of virtual machines, serverless functions, buckets, and containers.

Wiz is a full-scale cloud detection and response platform. Agentless scanning is taking a high-resolution photo of your house once an hour to check for unlocked windows. Runtime is having a motion-activated security camera or a guard on site for twenty-four seven. Unlike other traditional agents that slow down servers, Wiz uses extended Berkeley Packet Filter, which is one of the major key features. It is incredibly lightweight and provides deep visibility into containers and Kubernetes nodes, where agentless snapshots might miss live execution details compared to the previous tool I have worked with.

The security graph takes you to zero through the toxic combination filter, which is the fastest way to clear the queue by focusing on the security graph and its logic with a high CVSS score, vulnerability that is exposed and has server identity that can reach sensitive data. Resolving those specific combinations first means that once the path is broken, for example by closing a port or stripping a permission, the issue moves to zero. To automate that remediation and keep the queue at zero, you cannot rely on manual clicks, so you can set up automation rules that automatically resolve critical issues in Jira or ServiceNow. Serverless cleanup will trigger a Lambda function to automatically remove any permissive IAM role and quarantine any suspicious container the moment Wiz detects it.

Wiz reduces alert fatigue. Unlike traditional scanners, Wiz uses a security graph to filter out the noise. Time to value is achieved through agentless deployment. Wiz connects via API rather than requiring software installation on every server. It provides one hundred percent visibility in minutes, which is one of the key benefits.

For time saving, I have reduced around forty to fifty percent time reduction in investigation by using the Security Graph to show exactly how an attacker could reach a database. That almost saves seventy percent of my time. Instead of manually tracking, which would take much time, it saves overall around forty to fifty percent. The alert volume will decrease almost eighty to ninety percent. SLA issues are also addressed. While using this, I do not have to be afraid of facing any SLA issues since it will reduce almost all the backlogs, ensuring all the critical vulnerabilities are fixed within their required policy window. For cost saving, replacing several point solutions with one platform is absolutely cost saving compared to many other products in the market.

Everything Wiz has in place is good enough to analyze things.

Nothing has to be added in the future.

The alert fatigue zero issues and priority-based consolidation security graph and anything that has in it easily make it rate eight, including its customer service and support team service. Two percent would be that the loading time is taking a bit longer while loading the graph, and while navigating to other links, that is also taking some time. That is why I am giving it an eight instead of a ten.

I have been working with Wiz for almost five years.

I have not faced any stability issues during my use of Wiz.

I have not experienced any scalability issues.

The customer support in Wiz is really good. They are super quick to answer the queries that I am facing or any kind of issues that I am facing. They are responsive over time. The onboarding was easy and smooth.

The support team is really helpful, and whenever I raise any kind of ticket about issues I am facing, they will immediately respond to it.

Positive

It was easy while onboarding Wiz.

Wiz was purchased from the same marketplace. I did not buy it from a different place.

Wiz is absolutely cost-effective.

The setup cost is somewhere around twenty-four thousand dollars based on your organization's size.

Wiz does consolidate the issue and the priorities and the containers. I would recommend Wiz because of its time-saving ability. You can almost see what are the criticalities that are there and the consolidation feature that is also there in Wiz. Majorly, the security graph will give you a deep information to analyze things in a much better way.

Traditional scanners and other tools do not treat every vulnerability as a priority. Wiz has the security graph to filter out the noise and by only surfacing toxic combinations, security teams can stop chasing thousands of low-risk patches and focus on the few that actually matter. It allows a small security team to manage a massive complex cloud environment without hiring dozens of additional users to look into it.

For any organization who want to think of moving to Wiz, the Security Graph feature is amazing and awesome. It will give you deeper information than any other tools does. That is the main thing to consider. Overall, I rate this product an eight.

Hybrid Cloud

Amazon Web Services (AWS)

My main use case for Wiz is in my report, where I use it when we push any code changes on GitHub. The DevOps team sets one pipeline that includes Wiz scanning. When we push any changes, if there are any vulnerabilities or security issues related to the code, Wiz raises a vulnerability that stops the pipeline execution and prevents deploying any changes. When we need to deploy, we fix those changes first and then proceed to deploy.

Wiz fits into our workflow as a very good tool, which I can affirm because of the many levels of scans they offer. As developers, we focus on completing tasks and may overlook security aspects, but we have a Wiz plugin in VS Code and IntelliJ IDEA. We run scans locally to fix any issues before pushing code to GitHub, ensuring that we resolve potential problems upfront.

Wiz is deployed in my organization through a private cloud setup, and as a developer, I use it with integration provided by the Infosec and DevOps teams during code changes and deployment processes.

The best features Wiz offers include its comprehensive scanning capabilities, which are essential for my work.

In addition to the good features, Wiz scanning is integrated into our repo. The DevOps team added that functionality, and the reporting aspect alerts us via email when vulnerabilities are raised, indicating deployment failures due to those issues. We receive timely notifications after deployment failures and have good integration with our DevOps team and pipelines, along with a user-friendly interface that provides details and hints for fixing vulnerabilities.

Wiz positively impacts my organization, especially since we are in the insurance sector where data security is paramount. Cybercriminals and cyberattacks are constant threats; thus, Wiz's scanning helps ensure we do not expose vulnerabilities, enhancing my organization's security and trust with clients.

Regarding specific outcomes or metrics, compliance has notably improved in my organization. With the Wiz plugin at the local level, we identify vulnerabilities before pushing changes, allowing us to fix them ahead of time. While I cannot claim faster development cycles outright, I can say that Wiz helps mitigate issues that might arise post-deployment, reducing pressure and ensuring security upfront.

While Wiz provides excellent data and reports, sometimes the suggested fixes for vulnerabilities are not always accurate based on our code compatibility. For example, if Wiz recommends upgrading from log4j to log8j but our code only supports log6j, this can lead to issues. Additionally, I suggest incorporating AI to provide real-time hints for fixing vulnerabilities during scans, as this would enhance usability significantly.

Regarding needed improvements in Wiz, the integration and usability are quite effective, though adding AI-driven features could significantly assist developers in addressing vulnerabilities more efficiently, thereby improving deployment times and adherence to deadlines.

I have been using Wiz from last two years.

Wiz is stable and scalable, with no downtimes experienced during changes, ensuring that any vulnerabilities found are addressed without affecting my workflow.

Customer support from Wiz is quite good. While I have not directly engaged with them, our Infosec and DevOps teams liaise with Wiz and receive prompt responses, indicating a positive experience overall.

I am unsure about post-sales support services and whether my organization utilizes them. We typically raise tickets through the DevOps team, which handles communication with Wiz, and I find that process works well.

I am not certain about other solutions evaluated before Wiz, but we also use Snyk alongside Wiz. Both tools have their strengths, but I find Wiz to be more advantageous due to its detailed summaries and team support.

I have seen a return on investment with significant effort reduction, as Wiz vulnerabilities allow us to detect risks before cyberattacks can occur, building trust with my clients because we prevent sensitive data exposure.

I do not have detailed information about pricing, setup costs, or licensing as I am just a user. However, I have heard the setup cost is low and that we subscribe on a yearly basis.

Wiz reduces alert fatigue within my organization effectively, as we perform local scans before pushing changes to GitHub, which minimizes issues at the production level and alleviates the stress of resolving errors late in the deployment process.

Wiz runtime sensor effectively helps in identifying active threats, allowing us to recognize and address serious issues at the development and local levels before they reach production, thus ensuring security and reliability.

The cloud security democratization aspect of Wiz is significant, as it enhances my organization's security management by ensuring standards are upheld through local and repo-level scans, even though I do not manage cloud security directly.

My advice for others looking into using Wiz is that it is crucial for building trust with clients and securing products, as it addresses vulnerabilities effectively before production, thus helping prevent cyberattacks and enhancing organizational reputation.

My company only has a customer relationship with Wiz, and I do not have additional information regarding other business relationships they may have.

I rated this review 8.5 out of 10.

Private Cloud

Amazon Web Services (AWS)

Wiz allows us to get a view into what's happening in our cloud environments, helping us see the gaps, how things are connected, and it aids in CVE monitoring, especially during incident response as we're able to look at what that environment or host might look like, how it connects, and how big of an issue this might be versus how small it could be, along with other indications gathered from Wiz's reporting that help us better understand what's happening and how it might have all started.

We have created a couple of custom dashboards and charts for Wiz to help keep track of specific environments. One example is when we were looking for certain types of activities; it allowed us to create a singular place to see the events in the subscriptions of interest that needed remediation, bringing it together quickly, allowing us to take action and track progress as things were fixed.

Zero Criticals is the dream for us; that's our goal, and we've made good progress, with Wiz allowing us to see everything together in an easy-to-understand way, giving us a path to have conversations with the business about what can be done from policy or user education standpoints to prevent recurring issues that need remediation, resulting in improved numbers and positively impacting our approach over time.

Wiz has enabled us to consolidate tools. Having multiple cloud providers presents challenges as each has its own versions of security products, leading to the problem of needing to monitor three different tools, which do different things. Wiz helps standardize alerting and responses while allowing us to fill in the gaps since many tools don't do CVE analysis and reporting, resulting in time savings and less effort in creating detections to fill those gaps.

Wiz helps us consolidate our alerting process. I am a strong advocate for avoiding alerts that do not add value to our environment. It's especially crucial to eliminate alerts that are single-instance or one-off occurrences. Instead, we need detections that tell a comprehensive story. Additionally, we require a way to drill down into these detections to understand them fully. Wiz has surpassed other tools across the multi-cloud landscape in alerting us to the issues that truly matter. It presents the information in a manner that allows us to address and remediate those issues effectively.

Wiz also includes excellent remediation steps within the detection, helping us understand what is happening. Our SOC team comprises individuals with varying levels of seniority and experience in the cloud, which can present challenges for skill development. Therefore, it is vital that we don’t just receive a barrage of noise in our SOC; we need information that clarifies what actually happened. Being able to communicate to the business how to resolve these issues is extremely important to us. Wiz has filled the gaps where other tools excelled in one or two areas but failed to provide a complete picture.

My favorite feature of Wiz is how it gathers information together; instead of generating a thousand independent signals, it rolls that up and shows you within that environment how all the different toxic combinations contribute to a critical alert, making it an issue worth responding to, unlike many other vendors or tools that show singular things which may appear small, but when looked at holistically, are actually part of a much bigger issue needing attention.

Wiz has significantly reduced alert fatigue in our organization. One of the key functions is that it groups together elements that can form toxic combinations. Instead of treating a policy violation and a critical CVE as separate issues that would generate two different alerts requiring two different tools, it consolidates them into a single event. This allows us to identify problems more effectively. For example, if I see a high or critical CVE alongside a policy misconfiguration tied to an account, I know I need to address both issues. This grouping enables us to take action rather than approaching it as a simple decision of whether or not to act on a single alert. Previously, I might see a policy issue and wonder if it’s significant enough to warrant attention. However, when these issues are combined, I can assess the full scope of what’s happening, allowing me to take appropriate action. I can also determine quickly whether something might be a false positive, preventing unnecessary investigations.With the critical issues we identify, we can confidently fix them and reach out to the right people without relying on a "hope" strategy or waiting for an hour of research to see if it turns into something actionable. Based on my experience with other tools, Wiz helps us bypass that frustrating process.

I believe they are on the right path. However, Wiz has a unique way of identifying issues. As part of its growth and maturity, I'm noticing that it is taking an approach where it not only detects problems but also provides solutions to fix them. This expansion into a more comprehensive ecosystem allows it to become a 360-degree product. Instead of just continuously pointing out findings and detections, it starts to integrate with existing solutions, reducing the cycle of repeated issues. We can learn from these mistakes, and ideally, they will only occur once, allowing us to address them effectively. I appreciate the continued growth in this partnership, as it aims to reduce the number of findings over time by tackling the root of the problem.

One significant area for improvement would be increasing automation. While they excel at identifying issues, we need assistance in minimizing the human hours required for tasks. Ideally, the process would become more automated, allowing us to quickly respond with steps such as: we found an issue, reached out, and fixed it immediately. In cybersecurity, if it takes several hours to address a concern and a human attacker is present, that delay can lead to severe consequences. We need more immediate measures in our response strategies.

I have been using Wiz for almost two years.

Regarding stability, I was pleasantly surprised by the performance of this SaaS provider. We haven't encountered any outages or issues with reports not running, finishing, or data being incomplete or inaccurate.

Scalability is great. We haven't faced any problems. There were no requirements like, “once you get to this point, you have to do this or that.” We were simply able to connect our accounts, and during our last round, our environment quadrupled in size. We didn’t have to make any adjustments or configuration changes; it just accommodated the growth. Even as some environments scaled back down, the service scaled back down with us, which has been a great benefit.

Regarding technical support, we haven't needed to contact them. All the questions and issues we encountered were addressed by our account team. It was very helpful not having to open a ticket and wait for assistance; our account team was knowledgeable about the tool and could provide immediate answers. This level of support was refreshing, as we didn’t have to deal with delays or uncertainty. Overall, we were very satisfied with the support we received.

For support, I would rate them a ten out of ten. They have great documentation and excellent support from the account team, which reduces how much you have to rely on technical support. I've dealt with other tools where the account team couldn't answer any questions, and the only option was to open a ticket and wait, sometimes for a day or two, for someone to respond. However, with this service, we received answers immediately and at the level we needed. Additionally, we received plenty of training and education without having to pay for expensive classes. So, I would definitely give them a ten in that area.

Positive

It was very easy to deploy. We were able to get everything set up quickly during a call with our Wiz account team. They walked us through the process, and once we connected the accounts, it was off and running. From that standpoint, it was great to easily tap into the different cloud providers. The experience was positive overall.

After the initial setup, the team also assisted us with health checks to ensure everything was functioning properly. They provided feedback and helped us make any necessary adjustments to permissions so that the tool would work effectively.

As for the setup time, we had a 30-minute call scheduled, and we managed to complete the setup within that timeframe. It mostly involved connecting the parent account and giving Wiz access to deploy the tool. After that, we were able to start viewing the results. So, in total, we spent about 10 to 15 minutes actually configuring it during that 30-minute window.

I’m familiar with their pricing. I believe it aligns well with what we typically see for security tools. It’s not unreasonable or outrageous. They have a great product that works effectively and fulfills its intended purpose. I don’t think there’s anyone else out there offering the same level, scale, or efficiency. While their pricing may be a bit on the premium side, it also enables users to consolidate tools, which can offset some of those costs.

A significant alternative out there is AWS GuardDuty. It operates within a single scope, analyzing your logs and identifying signals of potential issues. However, this can lead to high alert fatigue because it focuses on individual events. Instead of grouping and triaging alerts, it may send you multiple separate notifications for a single host or device performing several actions.

In addition, we've utilized scanners for Common Vulnerabilities and Exposures (CVEs) like Rapid7. This tool effectively scans for CVEs, but it requires thorough configuration, continuous monitoring of output, and the creation of reports to take necessary actions. This process is not on the same level as Wiz, which consolidates all of these tools into one platform.

We haven't used Wiz Runtime Sensor; we've seen demos and it looks really cool, but it's not something we have implemented.

I believe there isn't a perfect tool, but Wiz comes very close, continuously growing and expanding to add more value into its ecosystem, and I'm happy with it. I would rate Wiz a nine out of ten.

Public Cloud

Amazon Web Services (AWS)

I have been using Wiz for approximately three years in my career. Our first use case is Cloud Security Posture Management. We needed that because we are a multi-cloud company. We have most of our infrastructure in AWS, but we also have some in Azure and some in GCP. So we needed a CSPM to cover all three environments.

The feature I appreciate most about Wiz as a CSPM is the vulnerability detection and misconfiguration identification. It helps us to ensure that we know if there are misconfigured cloud workloads and what those are, as well as if there are vulnerabilities. That is one of the key value adds for us.

What we have done is create a tool that is not just a security tool but is actually used by other teams. We have created dashboards for other teams, for product teams who are developing code. They can see their assets, or our cloud team or other teams that own different assets can view their own team's vulnerabilities and misconfigurations through per-team dashboards.

For us, the value add when considering Wiz is that I would rather consolidate under fewer tools to get to a platform. This allows for alerts, administration, and dashboards to all be under one platform, simplifying the environment. It makes operations easier and ultimately enhances our ability to use the platform more effectively.

Wiz allows us to consolidate tools, particularly in vulnerability management. We used to use a technology called Tenable to do our vulnerability scans, not just on-prem but in the cloud, and we replaced Tenable with Wiz's capabilities as well as the capabilities of an endpoint protection technology we use called CrowdStrike.

Regarding scalability, we have connected to all our cloud accounts and have never had any capacity or performance issues, so scalability really has not been a topic of conversation for us because we have never had any issues.

I have contacted customer support for Wiz. They are aware of our discussions about it. We have talked about it during our quarterly business reviews.

I have never seen any instability with Wiz, such as lagging, crashing, or downtime.

We have connected to all our cloud accounts and have never had any capacity or performance issues, so scalability really has not been a topic of conversation for us because we have never had any issues.

I have contacted customer support for Wiz. They are aware of our discussions about it. We have talked about it during our quarterly business reviews.

I am a few steps removed from the details about the support quality and speed, but my impression through the team and talking with the account team directly is that when we raise issues, they are addressed thoughtfully, professionally, and quickly. I do not think there have been any lingering support issues we have had. We have also surfaced feature requests or changes, and they have implemented those and rolled those out within a few weeks. Wiz does a good job of listening to the feedback of their customers and using that to help shape the platform.

Positive

I have not used any alternatives to Wiz. Wiz was our choice; although we evaluated different technologies when we were looking for a CSPM, we went with Wiz, so we went from nothing to Wiz.

The initial deployment of Wiz was easy from my point of view. Essentially, once we connected Wiz to our AWS account, all the data starts to flow in and telemetry on our cloud assets, any vulnerabilities, and misconfigurations. So the dashboards light up with red, yellow, and green indicators. After deciding to go with Wiz, our proof of concept ended up becoming our production implementation, and we just expanded Wiz to more accounts, then to Azure and GCP. So it was very easy.

I do not know exactly how long it took to fully deploy to a working condition because it has been so long ago, but I will say that getting the visibility was in a matter of weeks to connect the accounts, probably within a week. Then it was a few months to build some of the dashboards and operationalize what we were seeing.

Feature-wise, I cannot tell you that it is a bit expensive compared to its peers, but I do think the premium is worth it. One of the things that Wiz has done well is that there are no agents for the CSPM, at least from what we are doing. It is very easy to roll out, easy to configure, maintain, and generally it does what it says it does with few issues. We had more overhead and more issues with other competing CSPM platforms.

From the team standpoint, I do not think Wiz requires much maintenance on our end because it is all cloud-based and Wiz does a great job of providing almost weekly updates. The ongoing maintenance itself of Wiz is low. We do have integrations which require some care and feeding. We have an integration with ServiceNow, but Wiz's ServiceNow integration is not the best. I have been told there have been issues getting the data out of Wiz and plugged into ServiceNow effectively, so that has taken a little bit more attention.

We are working on achieving zero criticals in our issue queues with Wiz. It has helped us gain visibility into our critical issues, but we still have a few dozen left to work through. A lot of that actually has to do with some older infrastructure and workloads that applications use. So we have some application migrations in the works, but we have not quite got to the zero critical status.

I would rate this review as a 9 overall.

Public Cloud

Amazon Web Services (AWS)

The product was implemented for AWS monitoring and cloud infrastructure monitoring. Our goal was to conduct security monitoring of cloud infrastructure. Wiz was the first product we selected, and we were not using any other product, so this was not a consolidation effort.

The installation and configuration process was straightforward, and the onboarding was smooth. The user interface of Wiz, including the graphics, dashboards, and overall design, is user-friendly. The customization capabilities are excellent, allowing us to tailor the tool based on our requirements.

When someone worked from another country and connected with an unusual IP address, the system provided us with a notification, which was valuable.

Wiz significantly helped with our compliance requirements. The tool makes it easy to generate compliance reports by selecting a specific compliance framework, and it creates the report automatically.

The product provides an overview of our entire company through dashboards, and access was not limited to our security team. We provided access to other departments and software developers, allowing them to monitor the dashboards as well. This broader accessibility made Wiz a valuable tool for our organization.

During the initial setup, obtaining support was not easy initially. When assistance was needed, response times were longer than desired. However, the documentation was comprehensive, so there were no major blocking challenges.

After purchasing the product, support quality improved significantly. As a paying customer with a license fee, we found that support was responsive and easy to reach.

From a technical perspective, Wiz is excellent, but the pricing is too expensive.

We experienced pressure to monitor license costs constantly because they increased automatically. There was no way to limit these increases, which was a significant stress point.

Wiz is very reliable. The services were stable, and we did not experience any downtime. During monitoring operations, we did not encounter any issues that required attention or fixes. From the first day of implementation, the product worked well and remained stable.

Wiz scales easily. The platform automatically scales itself, though this automatic scaling also increased our license costs, which required monitoring. The scalability happens in the background without requiring manual intervention.

After purchasing the product, support was satisfactory. As a paying customer with a license fee, we received good support and found it easy to reach out to the team. Overall, the support experience was satisfactory.

I used this product at my previous company but am no longer a customer.

The installation and configuration process was straightforward, and the onboarding was smooth.

During the initial setup, obtaining support was not easy initially. When assistance was needed, response times were longer than desired. However, the documentation was comprehensive, so there were no major blocking challenges. Overall, we did not experience any significant blocker challenges with Wiz.

We did not experience any security threats, but the monitoring of our infrastructure was valuable. We did not use any other solution, though it was reassuring to know that Wiz was operational and running.

We conducted proof-of-concept evaluations with different tools. Wiz was easy to onboard to our infrastructure. We did not want to spend excessive time on integrations and configurations during the initial phase. The process was straightforward, which was a key factor in our decision. Additionally, because we were using AWS infrastructure, Wiz could be purchased directly through the AWS Marketplace, which was another reason we selected it.

The setup process takes approximately fifteen to twenty minutes. If you are not using artificial intelligence, you may not need this capability. However, if you are using artificial intelligence in your portfolio, it is important.

Control is essential when using artificial intelligence because there are instances where you feel out of control. You do not know what is happening in the background, and artificial intelligence agents are working and performing tasks. When you have a security tool controlling everything, it is truly useful.

We used filters that Wiz provides while configuring alerts. You can avoid false positives, excessive noise, or alert spam by using these rules and alert configurations.

The company was a startup in its initial phase, and I was involved in choosing the technology tools stack from the beginning.

We did use the features available. Our goal was not to avoid using the product's capabilities. I would rate this review nine out of ten.

Public Cloud

Amazon Web Services (AWS)

My use case for Wiz is basically for overall security, focusing on vulnerability management, infrastructure security, and application security, all of that combined. I have my AWS accounts where I run multiple services, so that's where I'm utilizing Wiz to the core optimum, utilizing all of its capabilities. Even as an inventory management tool, I think it has been really helpful because it keeps a record of every change, making it very functional.

Wiz has helped me consolidate some tools, as it is not just doing the job of the security tool alone. It has good inventory management, good vulnerability management, and we do not need to invest in multiple tools. All aspects such as infrastructure, application, vulnerabilities, and the regular security scoring patterns are in-built into Wiz along with the inventory manager, which has helped us reduce one or two tools here and there.Wiz has reduced alert fatigue in my organization, as it is very accurate in terms of reporting the issues, which has definitely improved, and I don't see a concern.

The best features of Wiz that I appreciate the most include trends of security, such as how we have been getting issues reported and how frequently we are closing them, along with the capabilities to notify a user and a channel on Slack, which have all been really helpful beyond just doing its main job as a security framework.The extent to which the Wiz runtime sensor has helped identify active threats more effectively compared to other solutions I've used is significant, as it refreshes based on a schedule in terms of the latest findings. It has been pretty effective for our use case, as I keep checking for anything new reported there. We also have a ticketing mechanism attached to it, so as soon as a security issue is figured out, it creates a ticket on Jira, allowing us to keep track of issues, and it is pretty responsive in terms of catching the latest issues.Wiz has helped me achieve zero criticals in issue queues, as it detects a range of issues whether it is the end of life of a product or an actual security issue, such as an exposed port or a compromised service.

In Wiz, the areas that have room for improvement would include some autonomous capabilities, such as having an agent declare where, since we are in the era of AI, it can auto-solve some low or medium alerts. High and critical issues would still need manual handling, but some level of alerts being handled autonomously would be good. More or less, Wiz is doing well, but the false alerts at random times would be another area for improvement. I would also appreciate seeing it go deeper on the security aspect, expanding beyond just infrastructure and application to include potential issues stemming from APIs, as currently it focuses more on the infrastructure pieces. Having more visibility in API endpoints, microservices, and application code running on the infrastructure would be beneficial.

I have been using Wiz for the past 18 months.

The stability of Wiz has been good, with no downtime, bugs, or glitches. Just today I was not able to load it, but I wouldn't blame it that much as I have always been able to access the application when reaching out. I would rate the stability out of 10 as about nine or 10.

Wiz is scaling well for our use case, so I would rate scalability a 10 out of 10.

I would rate technical support as about nine, as we had a couple of cases where the responses were delayed quite a bit, but apart from that, they have been spot on.

Positive

I cannot name the vendor I used previously, but the reason for switching to Wiz was the added features that we were getting, which offered more control on cloud security.

The deployment process of Wiz was easy and not complex. It was fairly straightforward, honestly. The internal configurations took time due to the different applications we have, but I don't think there was any delay from the Wiz side.It took about three to four weeks to deploy Wiz, as the time taken was more about how we wanted to structure the projects and boxes inside Wiz from our perspective. We were operational from the first week and integrated with SSO projects by the third or fourth week.

The integration capabilities of Wiz were generally seamless, although we had some complications with Oracle accounts. Integration with AWS was pretty straightforward, but with Azure and Oracle, Oracle had some limitations regarding what it could report to Wiz. However, I think there was some more fine-tuning and adjustments done by the Wiz team to ensure Oracle could also be onboarded correctly, so that worked out.

The purchase of Wiz was a direct purchase rather than through the AWS marketplace or a partner purchase.

My thoughts on the pricing of Wiz is that for our use case, it has been moderate, as I was using a different tool earlier, so it's not been a very large jump. I would say it resides in that moderate zone, and it's not something that raises eyebrows, so I think we're good.

I would say Wiz is in the top tier, and it might just be the leading product as well. While there are a couple more products out there, I think Wiz is definitely leading the course at this point.

I have created some custom dashboards, charts, and counters, and I have created some custom reports that are sent out, including a lot of widgets for my reporting of all the accounts that I have. I have almost seven to eight accounts where very large workloads are running, and in total, there are almost 20 accounts, so it gives a very good view to summarize all of the accounts in one place.My business is a medium enterprise with about 5,000 employees.The maintenance of Wiz is fairly easy, with a few people looking into it, but it's not as though their whole time is dedicated to Wiz, which is a good part.I absolutely recommend Wiz to other users because of its ease, features, and user-friendliness, allowing anyone to come in, configure all the things they want out of Wiz, and start using it. There is no doubt about that. I would rate this review an 8 out of 10 overall.

Public Cloud

Amazon Web Services (AWS)

I mostly work with a lot of AI use cases and some data governance use cases where we are focusing on the data because data can reside anywhere in the cloud. It is not limited to some storage. We do have a variety of services where data can reside and it is very crucial to identify those sensitive data and label them. When data is exfiltrated from one resource to another resource, we have to make sure that the DLP policies are fulfilled or enforced.

I have found that Wiz covers all the stages of the software development life cycle. It covers application or code security, DevOps security, and runtime security. It is a full-fledged CNAPP solution. All the areas within the development and the deployment side are covered.

The impact of consolidation on my ability to prioritize critical risks in the cloud environment is all about the correlation and how the technology works at the back end. It picks the data from different sources and correlates and identifies the high-priority risk. It provides visibility, meaning the risk score about the resource where we need to focus on.

Wiz does reduce alert fatigue for our customers, but alert fatigue is the main concern for every organization. If you don't have the proper workflow for each incident, it also depends upon the implementation and the workflow that you have decided. Sometimes it is a very big concern and a big headache for the customer because it finds a lot of findings that could be false positives. We have to fine-tune those alerts as per the infrastructure design. Sometimes some findings could be false positives, so we have to assess all these findings and we have to make sure that all policies are relevant for the environment.

The second point is basically the remediation steps. Sometimes it creates a burden or headache for the customer because the remediation of those kinds of findings are difficult. It may need a dedicated team who can get involved and fix them. Ownership and accountability is the main concern. We have to collaborate with different teams and make them understand the impact of that finding. The workflow also depends upon whether automation should be there. Automation is not for all findings, but for where we can do some kind of alerts where we can do the automation. For example, with IAM, those guys having the extra privilege, we can decide the workflow and we can remediate. But somewhere the service is running, we cannot immediately remediate those findings because it involves a lot of impact. First, we have to analyze each alert and what kind of impact it could be, then based on that, we have to plan whether it will be manual or through automation.

Wiz is currently allowing us to consolidate everything, the findings, the visibility of your environment, and everything is there.

Wiz Code is also covering your secrets and your vulnerabilities inside the IAC. It also provides us the SCA, Software Composition Analysis, and also provides an SBOM report that helps developers to look at the security standpoint while creating or writing any code. There are a lot of other things it is providing, but these are the major things.

Regarding Wiz Defend, the runtime protection, we do have the agent or sensor on the endpoint where it can defend in real time. There are two approaches. Detection is the one capability and protection is the second capability. At some stage, it only provides us the visibility, and at some stage, it also defends the attack.

I find AI security posture management very important in cloud security strategy. Nowadays, every organization is using different kinds of models or enhancing their applications. While they are using the models or they are calling through APIs, maybe sometimes they are using models inside their environment, sometimes they are just buying the APIs for any third-party model. While we are buying any APIs for their application or to integrate the LLM model into their application, it is crucial that we should have the visibility. Whoever kind of prompts the end user is triggering and what kind of data in or out is happening. Such kind of sensitive information may be traversing inside our network. The visibility of these things should be there so that preventive control can be implemented.

I believe Wiz could be improved or enhanced by acknowledging that nowadays a lot of technology is coming. Every solution is now doing the integration at the backend. They are trying to cover more areas in terms of cybersecurity. Definitely, every solution is growing as per the market demand. We can see a couple of more things coming soon, and every technology or technology owner is working behind the scenes. The purpose is basically the baseline foundation. If you talk about the CIA triad, that should be covered properly and everyone is doing the same thing.

I would like Wiz to push backend integration more, but not that much because license and procurement happen through a different team.

I have been working with Wiz for the last three months, during which I deployed this Wiz solution for one of the clients.

The stability and reliability of Wiz are good. I don't feel any issues. It is good because whenever they are planning any activity, they generally inform us prior to implementation.

Regarding the scalability of Wiz, it is good. I don't see or feel any kind of issue on the scalability or the performance. Every solution is running behind most probably on the Kubernetes services, they are using multiple containers and the pods behind those services. In terms of scalability, I don't feel any issues. It totally depends upon the license, how much license you procured. Based on that you can onboard or you can consume those licenses. Even if you go beyond that, you don't see any kind of challenges. It is pretty much good, not limited to Wiz but for all solutions I'm talking about. They are providing 99.99 kind of SLA. I don't see and feel such kind of issues in the past.

I communicate with the technical support at some times when we feel that the technology is not working as expected. The outcome that we suppose is not getting as expected, so we generally raise a ticket with the provider. They assist as they regularly do.

I have found that Wiz covers all the stages of the software development life cycle. It covers your application or code security, also covers DevOps security, and also finally covers the runtime security. It is a full-fledged CNAPP solution. All the areas within the development and the deployment side are covered.

My impression of Wiz Runtime Sensor is quite good. Runtime, as I already mentioned, in the runtime sensor, we are basically deploying the sensor on the endpoint. It could be your EC2 instance, the virtual machine, container, and the Lambda function as well. It detects and blocks in real time and blocks the attack in real time. It is really convenient. Sometimes zero-day vulnerability is not possible in agentless scanning. When I say agentless scanning, we don't have a sensor on the device. But while we are putting the sensor, we have these kinds of visibility and it protects or helps us with zero-day attacks as well. That is really helpful for the organization.

On the ability side of Wiz regarding its ability to achieve zero criticals in its issue queues, there is no doubt. But it also depends upon the use case as well. We have a limited use case for the recent deployment, it is all about the deployment. But as a part of product maturity, we can leverage or we can explore more things.

While deploying any controls, there are a lot of prerequisites and readiness for that. We have to collaborate with different teams. It could be the network team, generally the network team, the cloud team, and the infrastructure team, where we have to explain the use case of that particular control, why we are putting it, and what is the requirement. Once we have a good understanding about the infrastructure and about the technologies, we generally deploy the solution phase-wise. In phase one, we just target one or two test environments where we can provide some ROI against those accounts and resources. Down the line, we are covering in phases, more accounts and resources. That is how the approach we are currently following, and generally every organization is doing the same thing.

Most of the customers prefer a hybrid environment, not limited to the on-prem or cloud. Everyone is using a hybrid environment nowadays. It could be Azure, AWS, and sometimes on-prem. But the capability that the solution is providing is very limited to the on-prem environment. They more focus on the cloud environment first and are limited to the endpoint protection if I talk about the runtime monitoring. The rest of the things cover the cloud environment only, the identity and the access part.

To get the full potential of Wiz, it is good and good for the cloud environment and the hybrid cloud environment. Some part of it is covering the on-prem as well.

I would rate this product a 9 out of 10 based on its comprehensive coverage and capabilities.

Hybrid Cloud

Amazon Web Services (AWS)

I am a customer of Wiz, and we use Wiz for container scans, image scans, and code and build scans, with most of my use cases involving container and code and build scans.

What I appreciate most about Wiz is that it has access to all project scopes. For example, in an organization where I am part of a particular workstream, if I compare Wiz with other tools such as Snyk, I could only access my part of the organization, but in Wiz, the project scope lists all the areas of the projects. If I'm interested to know what's happening across data, finance, and warehouse, I can click and understand and review their vulnerabilities and trigger points. That's quite valuable.

The other thing I find useful is the information about policies. It has graph control which lists issues based on severity, risk, external attack surface, unprotected data, and remedies, and in some cases it highlights these. Recently, they added Mika AI, which is a cool feature. I can ask anything related to my work, and it responds based on certain trends, which is quite useful.

AI security is important to me because it helps. I have found one of their AI agents which is quite effective. It scans and provides trends of anomalies or vulnerabilities across various projects while supporting remedies as part of that. It is very important for me to assess what the AI suggests based on the scan it reviews across other projects. We review this before we hook our pipeline to see if we have vulnerabilities or anomalies in a particular area. We also try to prevent these rather than cure them, so we use the stats provided by AI to prevent anomalies or vulnerabilities from being detected and our security team having to chase us to fix them.

I'm not certain if Wiz allows me to consolidate tools because we link our integrations. When I say consolidate, I mean integrating with other third-party providers. We integrate with our integrations which are run via our build scan, so my experience is limited to our domain. I am not from security; I am a user of Wiz, and I try to use Wiz to ensure that the vulnerabilities it finds and scans can be actioned by our engineers. With respect to consolidation, I'm aware of what it does in my area. We only integrate our container and build scans with Wiz, and that works pretty well for us.

I think Wiz could be improved by identifying vulnerabilities occurring in a repeated pattern in the same estate. The AI capability should scan these and warn us based on historic data before moving or running a container scan. It should suggest somewhere on the dashboard that based on the last year, I've identified these vulnerabilities in a repeated fashion, so perhaps it's time to improve.

I have been using Wiz for the last two years, probably around close to a year, but then I moved out from that engagement. I still have access to Wiz, and my account is still active with Wiz. The last time that I had hands-on experience with Wiz was three months ago.

I find Wiz to be pretty stable, and I have not heard of it going down.

In terms of scalability, it is straightforward. During our busiest period, Black Friday, I have not heard of issues with Wiz struggling to cope with the volumes we handle.

I would rate the technical support of Wiz a seven, as it is fairly decent. I can't think of anything I am not happy about with the technical support since I have not been directly involved; it is our security team. I haven't heard them complaining much, and they were responsive to our queries when we started the engagement.

Before Wiz, I used Snyk for the same use cases. The decision to stop using Snyk and switch to Wiz was a central security decision, not mine. From what I understand, it may be related to Snyk becoming overly particular about the pricing models.

I participated in the initial setup of Wiz during a pilot conducted by our security team, where my team was chosen to run scans on some of our repos. This was around two years back. I found the initial setup of Wiz not entirely straightforward; there is a learning curve involved. I believe the Wiz team was pretty supportive during our adoption journey.

I am not certain if I utilized Wiz Defend in my security strategy as I haven't heard of it. There is a separate security team which adds the policies and the setup, and we are asked to run the respective pipeline so that all the container scans and build scans adhere to our security guidelines. It may be done as part of our security offering by the security team, which I am not aware of.

I am not certain what Wiz Runtime Sensor is or if it is part of the offering. I think it is available as part of the explorer, but I can't remember.

I can confirm that zero criticals in our issue queues is not possible; you will get critical vulnerabilities. What we have to assess is the level of security threat based on the score that is assigned. We do have critical vulnerabilities, but what Wiz does is help identify them, and wherever possible, provide a remedy or solution for them. We try to assess and review that periodically and try to reduce the severity of the vulnerability. In some cases, Wiz suggests certain actions which could probably downgrade the critical severity to medium or high.

Wiz has reduced alert fatigue in our area to some extent. It will identify a vulnerability, send an alert, and if there is a possible fix, if I give that command, then Wiz will try to do that by itself. I can't comment on the organization as a whole, but in the project that I have access to, I can see that for the last six months, Wiz has helped reduce alert fatigue by about twenty percent over a given time period.

Regarding the pricing of Wiz, that's a question for our security team; I don't know what tenant or at what level they have been using it. From what I understand, they are quite competitive and fairly price their offering. In an area where Wiz is helping us is in endpoint management, where their RED agent provides endpoints whenever incidents are raised. I believe they are pretty flexible on the pricing since they want to enhance their footprint globally.

I rate this review eight out of ten.

Public Cloud

Amazon Web Services (AWS)