We are excited to share that the Wiz Penetration Test Findings is now Generally Available (GA), giving offensive security teams a single home for all pen-test results- unifying findings from bug bounties, third-party audits, internal red team exercises, and AI pen-test scanning.
Wiz brings findings that otherwise would have lived in PDFs or siloed third-party portals directly into the Wiz platform, correlates them against real-time cloud context, prioritizes them accurately, and tracks them through to remediation.
Completing CTEM with unified, enriched pen-test findings
Security leaders are rapidly shifting away from reactive vulnerability management and embracing Continuous Threat Exposure Management (CTEM) - a framework built on five iterative stages: Scoping, Discovery, Prioritization, Validation, and Mobilization. The premise is straightforward: instead of running periodic point-in-time assessments that produce stale reports, organizations continuously identify, validate, and close exposures before adversaries can exploit them.
Wiz Penetration Test Findings is purpose-built to support CTEM strategy, connecting penetration test findings to the rest of the environment context, bridging across the Validation stage back to Discovery, Prioritization, and Mobilization in a single platform:
Validated Exploitability Meets Cloud Context: A CVSS 9.0 finding on paper might target an isolated test container, while a CVSS 6.0 finding might grant access to a production database containing sensitive customer data. By mapping pen-test findings directly onto the Wiz Security Graph, Wiz correlates human-validated exploits with real-world context - external network exposure, identity privileges, secrets, data, and lateral movement paths. We introduced Graph Controls that surface attack paths tied to pen-test findings, so teams can immediately see blast radius, prioritize what actually matters, and reduce noise.
Unified Exposure Visibility: Whether an exposure was discovered by an automated Wiz scanner, reported via HackerOne, uploaded from an external audit PDF, or generated by AI pen-test agents, it lives in one single pane of glass. Security teams no longer need to correlate across four different portals to understand their full exposure picture.
Accelerated Mobilization & SLA Tracking: Through automated ownership mapping and code-to-cloud tracing, Wiz assigns pen-test findings directly to the developer or team responsible for the resource. Coupled with Mika AI triage (to deduplicate results across tools) and the Green Agent (for automated remediation guidance), teams can enforce remediation SLAs and close the loop on validated exposure faster than ever.
Leveraging AI to make pen-test unification even easier
Making CTEM work in practice means eliminating the operational toil that causes validated findings to pile up unaddressed. We added two AI-powered features designed to do exactly that:
Automated PDF Report AI Scanning
Many traditional pen-testing vendors and external auditors deliver findings as PDF documents. To remove the need to manually migrate over findings, you can now upload PDF reports directly into Wiz Penetration Test Findings, and have AI scan and parse the document, automatically extracting individual pen-test findings, severity ratings, evidence, steps to reproduce, and their underlying assets. In just a few minutes, a static, 50-page PDF is transformed into structured, actionable items modeled on the Wiz Security Graph - ready to be correlated, prioritized, and assigned.
Interactive Finding Creation with Mika AI
Creating and mapping findings on the fly should be as natural as having a conversation. With the GA release, you can now manage and create findings directly through Mika AI, Wiz's built-in AI security assistant:
Guided Creation: Chat with Mika to walk through the finding creation process. Mika guides you step-by-step, automatically populating finding fields based on your inputs.
Smart Resource Mapping: Mika analyzes your cloud architecture and automatically suggests and maps the new finding to the exact target resource in your environment.
Raw Text Parsing: Have raw notes, a Slack message, or unstructured output from a custom exploit script? Simply paste the raw text into Mika. It parses the content, identifies key metadata, and formats it into a structured pen-test finding instantly.
Ingesting AI-Generated Findings via MCP
With the rise of code scanning using frontier models like Claude Mythos, Google CodeMender, and custom LLM-based scanners, teams need a way to centrally manage those findings and remove silos. With Wiz Penetration Test Findings, you can leverage a dedicated skill via Model Context Protocol (MCP), which bridges the gap between external frontier models and the Wiz platform.
You can connect to the Wiz MCP and prompt your AI agent to import findings directly into the Wiz Security Graph, regardless of how they are scanned. The skill handles the operational complexity automatically:
Data Normalization: Formats heterogeneous scan data to match the Wiz schema, regardless of which external tool generated it.
Deduplication: Prevents duplicate uploads across multiple scans from the same or different tools.
Resource Mapping: Matches findings against your existing Wiz inventory, ensuring vulnerabilities are attached to the correct cloud resource or repository.
Once ingested, findings appear on the same Penetration Test Findings page with full lifecycle management - status tracking, history, and unified visibility- even when the external tool has no persistent state of its own.
Accelerating remediation with AI
Getting findings into the platform is only half the battle - the other half is making sure they actually get fixed. Once a pen-test finding is promoted to an Issue in Wiz, the Green Agent takes over and automates the path to resolution:
Ownership Discovery: Automatically identifies the developer or team responsible for the affected resource, so findings never sit unassigned.
Remediation Guidance: Generates specific PR fixes or code snippets tailored to the vulnerability, giving developers a clear starting point rather than a vague description of a problem.
Agentic Workflows: Triggers downstream actions in integrated tools like Slack, Jira, ServiceNow, or GitHub - ensuring the fix is tracked, assigned, and implemented without manual handoff.
The result is a fully connected loop: a finding enters Wiz from any source, gets correlated against cloud context, is assigned to the right owner, and drives automated remediation - all without leaving the platform.
From continuous reporting, to continuous action
The GA release of Wiz Penetration Test Findings reflects a broader shift in how we think about offensive security: the goal isn't a better PDF. It's a closed loop. Every finding that enters Wiz - whether from a manual red team, an external audit, or an AI scanning agent — immediately becomes part of a continuous cycle of prioritization, ownership, and remediation tracking.
For security teams looking to operationalize CTEM, Wiz Penetration Test Findings is now a core pillar: turning static, point-in-time assessment reports into continuous, contextual risk reduction on the Wiz Security Graph. You can learn more in the Wiz Docs (login required) or set up a live demo with our team.
Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attacks.
Recognizing the partners, integrators, and visionaries driving cloud security transformation, AI risk management, and SOC modernization across AMER, EMEA, and ANZ.
Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s Advanced Security, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live.
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management