AI visibility report
Wiz ranks #2 in DevSecOps & Application Security AI search.
Outside the top three on 18 of the 25 prompts buyers actually ask.
Endor Labs is cited on 14 of those losses.
Free trial. Setup comes pre-filled for Wiz.
Track Wiz across these prompts daily.
Start free trial#2 among 12 vendors · still absent from 79.3% of tracked prompt responses
Top-3 citations across 150 prompt × platform pairs
Peer Ranking
Key Metrics
Platform Breakdown
Grok
Gemini Search
Perplexity
Google AI Mode
ChatGPT
Bing CopilotVisible, but narrative can improve. Wiz ranks #2 on presence but #3 on sentiment. The brand appears relatively often, but competitors may be getting more favorable language when they appear.
Where Wiz is losing
Prompts where competitors are visible and Wiz is not.
These prompt-level losses are the first prompts to track and repair.
Where Wiz is winning3
Which security scanning platforms handle availability well so a critical fix can still ship even if the scanning service goes down temporarily?
Avg # 4.0 · 2 platforms
What cloud security posture management tools integrate well with container and orchestration platform security scanning?
Avg # 8.5 · 2 platforms
Which security vendors update their vulnerability databases fastest after major CVE disclosures like Log4Shell?
Avg # 10.0 · 1 platform
Where Wiz is losing5
Which software supply chain security tools detect malicious packages, not just known vulnerable versions?
Competitors on 5 platforms
Track this promptWhich security scanning tools are best at reducing noise so developers actually act on alerts instead of ignoring them?
Competitors on 5 platforms
Track this promptWhich application security platforms are best at communicating vulnerabilities to developers in an actionable way rather than just generating noise?
Competitors on 3 platforms
Track this promptWhich DevSecOps platforms have the best two-way integration with ticketing systems for tracking vulnerability remediation end to end?
Competitors on 3 platforms
Track this promptWhich DevSecOps platforms handle vulnerability prioritisation well when there are hundreds of findings across multiple repositories?
Competitors on 3 platforms
Track this prompt
Track Wiz daily before the next report refresh.
Track these gapsResearch dossierCapabilities, use cases, sources, reviews, pricing, and FAQ
Overview
Wiz is a cloud-native application protection platform (CNAPP) founded in January 2020 and acquired by Google Cloud in March 2026 for $32 billion. Built by veterans of Israel's Unit 8200 intelligence corps, Wiz connects code, cloud, and runtime into a unified Security Graph that surfaces contextual attack paths and prioritizes risk across multi-cloud environments—AWS, Azure, GCP, OCI, and Kubernetes. Its agentless architecture deploys via read-only APIs in hours without requiring software installation. The platform consolidates CSPM, CWPP, CIEM, DSPM, IaC scanning, vulnerability management, and cloud detection and response into a single interface. Wiz Code extends coverage into developer workflows and CI/CD pipelines, while Wiz Defend delivers runtime threat detection via an eBPF sensor. Trusted by more than 50% of Fortune 100 companies, Wiz is ranked #1 CNAPP on G2 and named a Leader in the Forrester Wave CNAPP Q1 2026.
Wiz is a unified CNAPP platform that provides agentless, graph-based security across code, cloud infrastructure, and runtime. Its Security Graph connects misconfigurations, vulnerabilities, exposed identities, and sensitive data to model real attack paths—surfacing only the 'toxic combinations' that pose actual breach risk. The platform spans Wiz Cloud (CSPM, CWPP, CIEM, DSPM, compliance), Wiz Code (shift-left IaC, CI/CD, and IDE security), and Wiz Defend (cloud detection and response). AI agents automate risk remediation, penetration testing, and threat hunting. Since March 2026, Wiz operates as part of Google Cloud while remaining multi-cloud.
Key Facts
- Founded
- 2020
- HQ
- New York, USA
- Founders
- Assaf Rappaport, Yinon Costica, Roy Reznik +1 more
- Employees
- 1000-5000
- Funding
- $1.9B
- ARR
- ~$500M (mid-2024)
- Customers
- 50%+ of Fortune 100
- Valuation
- $32B (acquisition price)
- Status
- Acquired by Google (Google Cloud), March 2026
Target users
Key Capabilities10
- Agentless multi-cloud scanning via read-only APIs (AWS, Azure, GCP, OCI, Kubernetes) with no performance impact
- Security Graph correlating misconfigurations, vulnerabilities, identities, and exposures into contextual attack paths
- Toxic combinations detection surfacing only the highest-priority, exploitable risk chains
- CSPM, CWPP, CIEM, DSPM, KSPM, and vulnerability management consolidated in one platform
- Wiz Code: IaC scanning, CI/CD integration, and IDE-level shift-left security with automated PR fixes
- Wiz Defend: Cloud Detection and Response (CDR) with eBPF runtime sensor, threat detection, and incident investigation
- AI Security Posture Management (AI-SPM) for discovering and securing AI models, agents, and MCP servers
- 100+ built-in compliance frameworks with automated heatmaps and on-demand reporting
- Attack Surface Management (ASM) for outside-in scanning of internet-exposed assets
- Automated remediation agents (Wiz Green, Red, Blue) for AI-speed risk reduction and threat response
Key Use Cases8
- Unified multi-cloud security posture and visibility across AWS, Azure, GCP, and Kubernetes
- Prioritizing and remediating critical cloud misconfigurations and attack paths
- Container, serverless, and Kubernetes workload protection
- Securing AI workloads, AI models, and agentic infrastructure in cloud environments
- Shift-left developer security: IaC scanning, secrets detection, and CI/CD pipeline integration
- Cloud compliance automation for PCI DSS, HIPAA, GDPR, SOC 2, and other frameworks
- Cloud incident response, threat detection, and forensic investigation
- Tool consolidation: replacing siloed CSPM, CWPP, CIEM, and DSPM point solutions
Wiz customer outcomes
20% reduction in MTTR with security agents
Bridgewater deployed Wiz to gain cloud-native visibility across its AWS environment, enabling its security team to understand and prioritize real risks across identities and network exposure during its cloud migration.
Full environment visibility within 60 minutes of deployment
Cushman & Wakefield's CISO reported that Wiz provided immediate, comprehensive visibility across its cloud environment shortly after deployment and subsequently standardized on Wiz enterprise-wide.
Colgate-Palmolive used Wiz across its hybrid multi-cloud environment (AWS, GCP, Snowflake) to detect excessive privileges and previously unidentified misconfigurations, and to rapidly assess and confirm data protection during the 2024 Snowflake-targeted threat campaign.
Digital analytics platform Amplitude used Wiz CNAPP to build a unified DevSecOps program across 5,000+ VMs and 30+ Kubernetes clusters, enabling faster software shipping with a secure, visible risk posture.
Blackstone consolidated CSPM, CWPP, secrets management, breach path detection, and container management into Wiz's single agentless platform, replacing isolated point solutions and gaining advanced network exposure and identity analysis for its AWS-only environment.
Recent Trend
How AI describes Wiz3
...nventory, ownership mapping, AI-assisted remediation | Developer-first organizations using GitHub, GitLab or Azure DevOps | | Wiz | Attack path analysis, cloud exposure context, runtime signals | Cloud-native environments with Kubernetes and multi-cloud...
Which DevSecOps platforms handle vulnerability prioritisation well when there are hundreds of findings across multiple repositories?
...first AppSec | | GitLab Ultimate | Good (inside GitLab) | Limited | Via integrations | N/A | GitLab-centric organizations | | Wiz | Good | ✅ | ✅ | Via workflows | Cloud security | | Palo Alto Prisma Cloud | Good | ✅ | ✅ | Via automation | CNAPP/Cloud sec...
Which DevSecOps platforms have the best two-way integration with ticketing systems for tracking vulnerability remediation end to end?
...d Security | Excellent | Correlating code scanning, secret scanning, and Dependabot alerts with infrastructure events | | Wiz | Excellent | Cloud risk correlated with runtime and infrastructure telemetry | | Snyk | Very good | Application vulne...
Which DevSecOps tools integrate best with SIEM platforms for correlating app security findings with infrastructure events?
Most cited sources8
- W8
The Top 28 Open-Source Security Tools: A 2026 Guide | Wiz
wiz.io·Listicle
- W8
11 DevSecOps Tools and the Top Use Cases in 2026 | Wiz
wiz.io·Article
- W7
Guide to SBOM Tools: 5 Picks for Enterprise Security Teams | Wiz
wiz.io·Listicle
- W4
The Best OSS AppSec Tools: Features, Benefits & Use Cases | Wiz
wiz.io·Listicle
- W3
Ci/cd Security Scanning Best...
wiz.io·Listicle
- W2
Best Cloud Security Assessment Tools: 2026 Guide - Wiz
wiz.io·Article
Alternatives in DevSecOps & Application Security6
Wiz holds the #1 CNAPP and CSPM ranking on G2 for multiple consecutive quarters and was named a Leader with the highest Current Offering score in the Forrester Wave CNAPP Q1 2026.
- Its core differentiator is the Security Graph—a contextual engine that correlates risks across code, cloud, identities, and runtime to surface 'toxic combinations' (attack-path-level risk chains) rather than flat vulnerability lists.
- This graph-based, agentless architecture enables faster deployment and broader multi-cloud coverage than most peers.
- Now part of Google Cloud since March 2026, Wiz is positioned as the 'code-to-cloud' security standard for enterprise, trusted by 50%+ of Fortune 100.
- Against CNAPP peers like Aqua Security, Wiz competes on breadth and ease of consolidation; against AppSec-first tools like Snyk and Checkmarx, it competes on cloud infrastructure context; against platform players like CrowdStrike and Palo Alto Networks, it competes on agentless simplicity and cloud-native depth.
Reviews
Praised
- Agentless deployment and fast time-to-value (hours not days)
- Comprehensive multi-cloud visibility across AWS, Azure, GCP, and Kubernetes
- Security Graph and toxic combinations cutting alert noise
- Contextual risk prioritization over raw CVE severity scores
- Intuitive, visually clear UI accessible to non-security teams
- Strong customer support and responsive technical account managers
- Unified CNAPP consolidating CSPM, CWPP, CIEM, DSPM in one platform
- Enabling collaboration between security and development teams
Criticized
- High premium pricing, cost-prohibitive for smaller organizations
- Limited native SAST and SCA code scanning depth versus dedicated AppSec tools
- Reporting largely limited to CSV export formats
- Alert noise and duplicate alerts in large-scale environments
- No manual scan trigger for real-time, on-demand assessments
- Fine-grained access control gaps in enterprise multi-team setups
- Non-transparent pricing model requiring sales engagement for quotes
- Limited professional and managed services offerings
Wiz earns strong ratings across major review platforms, scoring 4.7/5 on G2 (776 reviews) and 4.7/5 on Gartner Peer Insights (94 verified reviews as of December 2024), with a 95% willingness-to-recommend score in the Gartner report. Users consistently praise the agentless deployment speed, comprehensive multi-cloud visibility, and the Security Graph's ability to cut alert noise by surfacing only actionable attack paths. Reviewers highlight how the unified platform enables security and development teams to collaborate in a shared context. Criticisms center on premium pricing, limited native SAST/SCA depth, restricted reporting formats (CSV-only), and occasional alert noise in large-scale deployments. Wiz was named the G2 #1 Cloud Detection and Response (CDR) solution in Winter 2025 with a 98% satisfaction score, 8% higher than the next vendor.
Pricing
Wiz does not publish standard pricing; all contracts are custom-quoted based on cloud workload count, feature modules selected, and contract term. Third-party procurement data (Vendr) indicates contract values ranging from approximately $24,000 to $354,350 per year, with a median around $111,500. Entry-level coverage for ~100 workloads is estimated at ~$24,000/year. Add-on modules—container security, DSPM, CDR (Wiz Defend), and Wiz Code—are priced incrementally or bundled. Multi-year commitments and module bundling typically yield meaningful discounts. Wiz is also available via AWS Marketplace with custom private-offer pricing. Perceived by users as premium-tier; free trials and demos are available on request.
Limitations
- Premium, workload-based pricing (estimated $24K–$354K/year) is cost-prohibitive for SMBs; no transparent public pricing is published.
- Native SAST and full SCA code scanning capabilities are limited compared to dedicated AppSec tools such as Checkmarx or Snyk, leaving teams reliant on external tools for deeper application-layer coverage.
- Reporting is largely confined to CSV export formats with limited executive summary templates.
- Alert noise and duplicate alerts under different categories can surface in large environments.
- Fine-grained access control and on-demand manual scan triggering have been cited as gaps by users.
- Professional and managed services offerings are limited compared to broader platform vendors.
- Coverage for on-premises and hybrid environments is minimal.
- Some users note perceived innovation slowdown post-Google acquisition.
Frequently asked questions
Topic coverageCoverage by buyer topic
Topic Coverage
Prompt-Level Results
| Prompt | Google AI Mode | ChatGPT | Perplexity | Bing Copilot | Gemini Search | Grok |
|---|---|---|---|---|---|---|
Capability2/5 cited (40%) | ||||||
Which application security platforms go beyond known CVEs to detect logic-level vulnerabilities and misconfigurations? | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Your brand and a competitor were cited |
Which software supply chain security tools detect malicious packages, not just known vulnerable versions? | A competitor was cited | A competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | A competitor was cited |
What tools cover SAST, DAST, and SCA in one platform — and which do teams use to cover all three vulnerability types without tool sprawl? | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Your brand and a competitor were cited |
Which SAST tools have the lowest real-world false positive rates and the best tooling for managing them at scale? | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited |
Which secret scanning tools are best at both detecting credentials in git history and preventing new secrets from being committed? | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited |
Developer Experience5/5 cited (100%) | ||||||
Which application security platforms are best at communicating vulnerabilities to developers in an actionable way rather than just generating noise? | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Your brand and a competitor were cited |
What security tooling do teams typically use for managing findings across dozens of repositories from a single security engineer workflow? | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Your brand was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Your brand and a competitor were cited |
Which security scanning tools are best at reducing noise so developers actually act on alerts instead of ignoring them? | A competitor was cited | A competitor was cited | A competitor was cited | A competitor was cited | A competitor was cited | Your brand and a competitor were cited |
Which DevSecOps platforms handle vulnerability prioritisation well when there are hundreds of findings across multiple repositories? | A competitor was cited | A competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Your brand and a competitor were cited |
Which application security tools offer the best IDE-native experience vs. CI-only scanning — and what are the tradeoffs for developer adoption? | Your brand was cited | A competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Your brand and a competitor were cited | Your brand and a competitor were cited |
Integrations & Ecosystem5/5 cited (100%) | ||||||
What cloud security posture management tools integrate well with container and orchestration platform security scanning? | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Your brand was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Your brand and a competitor were cited |
Which DevSecOps tools integrate best with SIEM platforms for correlating app security findings with infrastructure events? | A competitor was cited | Your brand and a competitor were cited | A competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Your brand and a competitor were cited |
Which DevSecOps platforms have the best two-way integration with ticketing systems for tracking vulnerability remediation end to end? | Neither your brand nor a competitor was cited | A competitor was cited | A competitor was cited | A competitor was cited | A competitor was cited | Your brand and a competitor were cited |
Which security scanning platforms have the best support for SBOM generation workflows for compliance and audit requirements? | Neither your brand nor a competitor was cited | A competitor was cited | Your brand and a competitor were cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Your brand and a competitor were cited |
Which application security tools integrate natively into the pull request workflow so findings can block or warn on merges? | Your brand was cited | A competitor was cited | A competitor was cited | A competitor was cited | A competitor was cited | Your brand and a competitor were cited |
Performance & Reliability4/5 cited (80%) | ||||||
Which security scanning platforms handle availability well so a critical fix can still ship even if the scanning service goes down temporarily? | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | Your brand was cited | Your brand and a competitor were cited |
Which runtime application security tools have the lowest production overhead and are safe to run on high-traffic services? | A competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited |
Which security vendors update their vulnerability databases fastest after major CVE disclosures like Log4Shell? | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Your brand and a competitor were cited |
Which enterprise application security platforms scale best when scanning thousands of repositories across multiple teams? | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Your brand and a competitor were cited |
Which application security scanning tools are fastest at scale and least likely to slow down PR pipelines as the codebase grows? | A competitor was cited | A competitor was cited | Your brand and a competitor were cited | Neither your brand nor a competitor was cited | Your brand and a competitor were cited | Your brand and a competitor were cited |
Setup & First Run3/5 cited (60%) | ||||||
Which SAST tools integrate into an existing CI pipeline without slowing down developer velocity? | Neither your brand nor a competitor was cited | A competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited |
I'm rolling out a software composition analysis tool across an engineering org — which platforms have the smoothest onboarding for large teams? | Neither your brand nor a competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | Your brand and a competitor were cited |
What are the best software supply chain security tools for a polyglot monorepo with Node.js, Python, and Go services? | A competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | Your brand and a competitor were cited | Your brand and a competitor were cited |
What are the best container image scanning tools that catch vulnerabilities before images are pushed to production? | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | Your brand was cited | Your brand and a competitor were cited |
What secrets management tools are best for a small startup team to ensure developers never commit credentials to the repo? | Neither your brand nor a competitor was cited | A competitor was cited | A competitor was cited | Neither your brand nor a competitor was cited | Neither your brand nor a competitor was cited | A competitor was cited |
Turn this matrix into daily prompt monitoring.
Track prompt changesVertical Ranking
| # | Brand | PresencePres. | Share of VoiceSoV | DocsDocs | BlogBlog | MentionsMent. | Avg PosPos | Sentiment |
|---|---|---|---|---|---|---|---|---|
| 1 | Endor Labs | 34.0% | 27.4% | 0.0% | 33.3% | 21.3% | #17.3 | +0.33 |
| 2 | Wiz | 20.7% | 14.1% | 0.0% | 0.0% | 26.0% | #24.1 | +0.41 |
| 3 | Checkmarx | 20.0% | 15.8% | 1.3% | 1.3% | 38.0% | #25.4 | +0.32 |
| 4 | Snyk | 17.3% | 15.3% | 7.3% | 6.0% | 67.3% | #32.2 | +0.36 |
| 5 | Jit | 11.3% | 5.0% | 0.0% | 0.0% | 5.3% | #17.0 | +0.34 |
| 6 | Semgrep | 8.7% | 8.0% | 2.7% | 4.0% | 35.3% | #41.7 | +0.41 |
| 7 | Veracode | 7.3% | 6.8% | 0.7% | 6.7% | 28.0% | #34.3 | +0.37 |
| 8 | Aqua Security | 5.3% | 2.3% | 0.0% | 0.0% | 13.3% | #29.8 | +0.36 |
| 9 | SonarSource | 4.7% | 2.5% | 0.0% | 2.0% | 2.7% | #24.9 | +0.35 |
| 10 | GitGuardian | 3.3% | 2.5% | 0.7% | 2.7% | 7.3% | #27.2 | +0.44 |
| 11 | Socket | 0.7% | 0.3% | 0.0% | 0.0% | 6.7% | #20.0 | +0.00 |
| 12 | Chainguard | 0.0% | 0.0% | 0.0% | 0.0% | 0.7% | — | — |
Turn this into your team dashboard
Sign up to unlock project-level analytics, daily tracking, actionable insights, custom prompt configurations, adoption tracking, AI traffic analytics and more.
Free trial. Setup comes pre-filled from this report.