WIZ Cloud Infrastructure Security Platform

A testing team at my current company is starting with Wiz Code, but I personally am not using it. Wiz is part of the license that we have.

In my last company, we reduced vulnerabilities from one million to a few hundred. What we gained was the ability to focus on the important vulnerabilities.

The intelligence behind Wiz is what I appreciate the most. In security, it is very important to analyze all vulnerabilities or security findings with context. Most tools say that a high finding means you need to implement the fix immediately. However, Wiz differs because of the intelligence behind it. Analyzing a high finding in a server exposed to the internet is not the same as analyzing one in an isolated server without internet connection. Wiz provides that contextual understanding.

Wiz is effective, but if you want to adapt it to your organization, you need to know your organization very well and adapt most of the queries.

It is very useful as a way to know specific vulnerabilities or the security status of your instance.

Sometimes it is a little difficult to create specific queries to find data in your environment. I know Wiz is working on this, but the way to create queries could be improved.

I started using Wiz at the beginning of 2024. We had already used another CNAPP like Lacework, but after studying other tools like Sysdig or DataDog, we chose Wiz because it is very complete and understands everything about the CNAPP process.

Wiz is very stable. I did not receive any service downtime or outages. Since I have been using it, I have not been notified about any service being down. When the Copy-File vulnerability appeared, Wiz was the first provider that updated their database with this vulnerability without a CVE, but with a specific CVE, and we did not notice any service interruption.

Wiz is very easy to scale. The main concern is the cost, but the scalability itself is easy.

It is very easy to contact the technical support team. They usually do a lot of follow-ups or send messages as reminders if you forget to answer their message. The team is very professional.

I would rate customer service an eight. Sometimes the support process can be difficult to implement in a large company, and follow-up on tickets can be challenging. For example, if you have many related tickets, such as in my case with Wiz for Images, it is difficult to find a specific ticket for follow-up. The technical support person may only send one reminder and then close the ticket or put it on hold.

I previously used native cloud tools and Lacework.

The first deployment is very easy because you only need to connect with the landing zone in the case of AWS or Azure. However, the specific parts of Wiz, such as connectors, can be difficult. In the case of using a package or image with Wiz for Images, if you are not familiar with code or the DevOps process, it can be a little hard. Overall, the setup is easy.

Wiz pricing is very expensive. To be honest, I think it is a little expensive. In my last company, it cost around $200,000. It can be expensive because Wiz provides more features than other providers. They know that they are better than other providers, so they price accordingly.

I considered Lacework, which was purchased by Fortinet. As far as I know, Fortinet is using Lacework only for specific features. I also looked at Sysdig and DataDog. In my last position, I was in the position to decide on a specific tool to manage cloud security, so I was in contact with several vendors including Sysdig, DataDog, Lacework, and Wiz to choose a tool. DataDog is a tool that I analyzed but did not use.

Wiz is the best option because Wiz understood the concept of CNAPP in the cloud with CSPM, CWPP, and CIEM. It is a tool that covers every single point of CNAPP.

I have been working in cloud security since 2018, so close to ten years. Wiz does not require anything special. I would give Wiz a rating of nine overall. I do not want to give them a ten because you always have a little point to improve. In this case, it is a specific part of support or the query functionality. These are small points to improve, which is the reason I would give them a nine.

The main use case for which I use Wiz is managing a company's cloud security posture.

A concrete example of how I use Wiz in my day-to-day work for this purpose is defining custom controls, custom frameworks, and doing follow-up with the development teams to improve the security posture.

In these processes, I would like to add that the platform allows me to make use of several automations directly from it, which is quite useful.

I do consider AI-based security posture management important within my cloud security strategy because we need, at least, to keep up with offensive actors which seems unatainable without AI.

Wiz is deployed in my organization primarily for public clouds( AWS, Azure, GCP, and Oracle)

Wiz has had a positive impact on my organization by improving follow-up, process automation, and visibility into the state of cloud security.

Since I implemented Wiz, I've noticed a measurable change in that the follow-up time has been greatly shortened, since we have quite a few automations around Wiz.

Wiz has also allowed me to consolidate tools in my organization, and that consolidation allows us to centralize the security posture from a single tool, which is much simpler for us, without having to go into each of the different providers, and I think that's the main advantage of that part.

The best features that Wiz offers are the Security Graph, the coverage, and that everything works via API.

The coverage and the Security Graph have benefited my organization by being able to connect different information sources in a simple way, since we can see the full structure of an organization in cloud environments, and with the Security Graph we can create custom controls for the organization, which allows for a better security posture over time. Basically, it can be improved more easily.

Regarding Wiz's artificial intelligence capabilities, I think its governance and security are good, as they have recently deployed several specific dashboards for AI coverage, Shadow AI, and so on, which are very good.

I think Wiz could improve its identity component.

I have been using Wiz for three years.

In general, I would say that Wiz is a stable solution.

I would rate Wiz's scalability as very good, as we have been deploying different environments, different tools, and overall the product continues to work well, and we haven't had scalability problems.

We use Wiz's post-sales support services, and these services impact the team's efficiency positively since we have sessions with them every so often so they can tell us about new product features and go over any questions we have, so it's good. They've always been very positive when it comes to helping us and with any questions or problems we have, they are always willing to solve them.

I would rate Wiz's customer support as quite good, as they are always quite quick to respond and are always willing to help.

On a scale from one to ten, I would also rate customer support a nine.

Before implementing Wiz, we used Prisma Cloud, and I understand that the switch was more a matter of cost since I think Wiz was considerably cheaper and gave a bit more flexibility for what we needed at that time.

I have seen a return on investment with Wiz in terms of time savings, as I mentioned before, and I think the team's efficiency has improved when it comes to managing the cloud security posture.

My experience with Wiz's pricing, implementation costs, and licenses has been positive.

We did not evaluate other options before choosing Wiz since we switched from Prisma to Wiz directly.

I rate Wiz a nine on a scale from one to ten. I give Wiz a nine because, in general, I think it's a very complete product. There are a couple of things that could be improved, or at least I think they could be improved, but for now, any use case I've needed, I've been able to do it with Wiz.

My advice for someone thinking of using Wiz is to try it and start playing with the Security Graph, which is a very powerful tool.