cloud security

Wiz

Wiz is an agentless cloud security platform. This profile covers what it does, how it is priced, and where it stops being the right choice.

What the product actually does

Wiz connects to cloud accounts with read-only credentials and builds a graph of everything running: virtual machines, containers, identities, data stores and the network paths between them. Vulnerabilities and misconfigurations are attached to that graph.

The graph is the product. A critical vulnerability on an instance with no network path from the internet is not the same finding as the same vulnerability on a public load balancer, and the graph is what tells them apart.

How pricing works once you are inside

Priced on the number of cloud resources under management, which is a metric that grows silently as an organisation creates instances, buckets and roles. Contracts are annual and negotiated.

The resource metric is worth modelling before signing, because a development account that spins up and down all day still counts toward the ceiling.

Where it breaks down

Agentless means it sees configuration and not runtime behaviour. A process that is compromised without changing its configuration is invisible to an agentless scanner, which is why most organisations pair it with a runtime tool.

The graph also takes time to build and to understand. A team expecting a list of findings gets a topology they have to learn to read.

What switching costs

Moderate. The findings are exportable and the graph is rebuilt from the cloud APIs, but the prioritisation logic and the workflow around it are Wiz-specific.

Sources

Wiz public documentation, read October 2026. Pricing is negotiated.