Wiz details ASPM prioritization in Wiz Code: finding enrichment, deduplication and Security Graph attack paths
Wiz published Part 2 of its ASPM in the AI Era series, describing how Wiz Code prioritizes application security risk. It cites its State of SDLC Security 2026 report, which argues that AI mainly amplifies existing risks through faster code generation, a wider attack surface and less time for human review. The post is product and vendor content, not an incident report or a threat disclosure. It refers to React2Shell only as an example of why prioritization needs context across the application lifecycle.
Detalhes técnicos
- Finding-level prioritization: scanner data is normalized into unified schemas. SCA findings are enriched with NVD data, EPSS scores, exploit availability and CISA KEV status. SAST findings carry CWE and code snippets. DAST findings have their network exposure validated by the ASM module. Secrets are checked for leaks, classified and given severities.
- Deduplication: overlapping tool findings are labelled "Representative" or "Duplicate", and automated Ignore Rules can suppress the duplicates while keeping the scanner audit trail.
- Attack path prioritization: the Wiz Security Graph links a code flaw (for example a Snyk SAST finding) to the container image built from that branch, the production Kubernetes cluster running it, its internet exposure and an ASM reachability check. The result is a single high-priority Wiz Issue. The same flaw on a branch that never reaches a running workload stays low priority.
- Security debt: findings that map to no attack path are tracked through Posture Issues, with groupings and remediation SLAs.
Remediação
The article gives no defensive guidance beyond product features. Part 3 is announced to cover remediation with the Wiz Green Agent and Wiz Workflows.
Linha do tempo
-
Wiz details ASPM prioritization in Wiz Code: finding enrichment, deduplication and Security Graph attack paths
ler a análise desta fonte ocultar
Wiz published Part 2 of its ASPM in the AI Era series, describing how Wiz Code prioritizes application security risk. It cites its State of SDLC Security 2026 report, which argues that AI mainly amplifies existing risks through faster code generation, a wider attack surface and less time for human review. The post is product and vendor content, not an incident report or a threat disclosure. It refers to React2Shell only as an example of why prioritization needs context across the application lifecycle.
Technical Details
- Finding-level prioritization: scanner data is normalized into unified schemas. SCA findings are enriched with NVD data, EPSS scores, exploit availability and CISA KEV status. SAST findings carry CWE and code snippets. DAST findings have their network exposure validated by the ASM module. Secrets are checked for leaks, classified and given severities.
- Deduplication: overlapping tool findings are labelled "Representative" or "Duplicate", and automated Ignore Rules can suppress the duplicates while keeping the scanner audit trail.
- Attack path prioritization: the Wiz Security Graph links a code flaw (for example a Snyk SAST finding) to the container image built from that branch, the production Kubernetes cluster running it, its internet exposure and an ASM reachability check. The result is a single high-priority Wiz Issue. The same flaw on a branch that never reaches a running workload stays low priority.
- Security debt: findings that map to no attack path are tracked through Posture Issues, with groupings and remediation SLAs.
Remediation
The article gives no defensive guidance beyond product features. Part 3 is announced to cover remediation with the Wiz Green Agent and Wiz Workflows.