Empowering SOC Teams with the Wiz Red and Blue Agents | Wiz Blog
Most SOC teams start investigating when a threat alert fires, and analysts triage the alert, piece together context, and begin an investigation, all after something has already happened.
Most SOC teams start investigating when a threat alert fires, and analysts triage the alert, piece together context, and begin an investigation, all after something has already happened.
That model was built for a world where attackers moved at human speed and relied mostly on known exploits.
Proactive, continuous threat exposure management (CTEM) with offensive testing will dominate SOC operations, as reactive detection yields an exponential increase in diminishing returns.
They deserve the same urgency as an active threat, because in the AI era, it's only a matter of time before attackers find them.
Two shifts are happening at the same time, and both are changing the day-to-day for the SOC: • Organizations are shipping more custom code than ever: AI-assisted development means teams are building custom AI applications at unprecedented speed.
This is critical for incident response in the AI era, and ensuring that the SOC can action at the speed required to defend the enterprise.
These apps can contain logic-driven vulnerabilities, such as broken authorization and authentication bypasses, that are impossible to detect with signature-based scanners.
• Attackers are using AI to move faster: Adversaries are using frontier AI models to scan perimeters, find exposed applications, and weaponize vulnerabilities in hours instead of months.
For the SOC, this means treating validated, exploitable exposures as what they are: attack paths that are proven exploitable.
• The Red Agent, our AI-powered attacker that continuously finds and validates exploitable risk across your attack surface, and delivers it as pre-breach, SOC-level alerts.
The Red Agent is an AI-powered pentester that enables teams to uncover complex, validated exploitable risks and remove them before attackers find them, at machine speed.
The only way to keep pace is to use AI to fight AI: find the open door before an attacker walks through it, and investigate at AI speed when someone does.
• The Blue Agent, our AI investigator that works alongside analysts to investigate active threats with full cloud, code, and runtime context, and reach a confident verdict fast.
Each finding arrives with proof of exploitability, reproduction steps, blast radius context from the Security Graph, and a clear owner and remediation guidance from the Green Agent.
What happened
Most SOC teams start investigating when a threat alert fires, and analysts triage the alert, piece together context, and begin an investigation, all after something has already happened.
That model was built for a world where attackers moved at human speed and relied mostly on known exploits.
What changed
Proactive, continuous threat exposure management (CTEM) with offensive testing will dominate SOC operations, as reactive detection yields an exponential increase in diminishing returns.
They deserve the same urgency as an active threat, because in the AI era, it's only a matter of time before attackers find them.
Who is affected
Two shifts are happening at the same time, and both are changing the day-to-day for the SOC: • Organizations are shipping more custom code than ever: AI-assisted development means teams are building custom AI applications at unprecedented speed.
This is critical for incident response in the AI era, and ensuring that the SOC can action at the speed required to defend the enterprise.
Why it matters
These apps can contain logic-driven vulnerabilities, such as broken authorization and authentication bypasses, that are impossible to detect with signature-based scanners.
• Attackers are using AI to move faster: Adversaries are using frontier AI models to scan perimeters, find exposed applications, and weaponize vulnerabilities in hours instead of months.
Technical details
For the SOC, this means treating validated, exploitable exposures as what they are: attack paths that are proven exploitable.
• The Red Agent, our AI-powered attacker that continuously finds and validates exploitable risk across your attack surface, and delivers it as pre-breach, SOC-level alerts.
The Red Agent is an AI-powered pentester that enables teams to uncover complex, validated exploitable risks and remove them before attackers find them, at machine speed.
Response
The only way to keep pace is to use AI to fight AI: find the open door before an attacker walks through it, and investigate at AI speed when someone does.
• The Blue Agent, our AI investigator that works alongside analysts to investigate active threats with full cloud, code, and runtime context, and reach a confident verdict fast.
What remains unknown
It works alongside Wiz ASM to cover all types of risks- from known risks, such as CVEs and misconfigurations, to the unknown, logic-based risks in custom-built applications, like authorization bypasses that signature-based scanners miss.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.