Wiz launches cloud incident response service for rapid recovery
Wiz has introduced Incident Response (IR), a service aimed at helping organisations investigate, contain, and recover from cloud security incidents efficiently.
The new offering is designed to support organisations during critical moments by leveraging Wiz's expertise in cloud security and artificial intelligence. Arie Zilberstein, Vice President of Cloud Detection & Response at Wiz, said the service emerged from customer demand for a partner with deep cloud knowledge.
"This launch is driven by what we've heard from customers – they want a trusted partner who knows the cloud inside and out," said Arie Zilberstein, VP of Cloud Detection & Response at Wiz. "Wiz was built in the cloud, for the cloud, and this perspective guides everything we do, including our approach to incident response. Cloud threats are constantly evolving, and teams need support that's built for that reality."
According to Wiz, the company's familiarity with the speed at which cloud threats materialise, as well as its experience in securing large-scale cloud environments, positions the service to assist both security and engineering teams. Wiz reports that more than half of Fortune 100 companies use its cloud security platform.
Product details
The new Wiz Incident Response service is structured to be led by in-house experts with substantial experience in cloud incident investigations, including areas such as Kubernetes forensics and analysis of AI-driven threats. The Wiz IR team's work is supported by the company's previous research into notable vulnerabilities, such as the exposure of sensitive chat data in the DeepSeek database, unauthorised Remote Code Execution flaws in Ingress NGINX, and a chain of vulnerabilities affecting NVIDIA's Triton Inference Server.
These discoveries, according to Wiz, have influenced industry practices in tackling modern cloud security challenges.
The launch of Wiz IR builds on the existing Wiz platform, particularly the Wiz Defend and Wiz Runtime Sensor capabilities. These tools offer threat detection, response, and runtime visibility across cloud, hybrid, and on-premises environments. Integration with the Wiz Security Graph is intended to provide IR teams with context to accelerate response times and limit the impact of incidents.
Service features
Wiz IR offers support throughout all phases of a cloud security incident. This begins with incident intake and scoping, where the team works to distinguish genuine threats from false positives and advises on initial response steps. Wiz then maps the extent of the incident using data from the customer's environment to prioritise actions.
During the forensic investigation stage, the IR team identifies the extent and timeline of the incident through analysis of cloud-to-runtime context and forensic tools made available within the organisation's Wiz environment.
In the containment and remediation phase, Wiz IR recommends steps to halt the attack and remove the threat from affected systems, with the aim of improving security against future incidents. The service also provides ongoing monitoring while the incident is active, proactively checking for further malicious activity to ensure comprehensive protection.
Alongside technical response, Wiz acts as a strategic advisor to ensure leadership teams remain informed throughout the incident and can manage business risk while progressing towards resolution.
Wiz IR is currently in public preview, and the company states it is available to any organisation experiencing or concerned about a potential cloud security incident. According to Wiz, the launch of the new service is the first stage of a broader strategy to allow security teams to not only detect, but also rapidly respond to threats impacting their cloud infrastructure.
