Wiz launches AI SAST in public preview for Wiz Code customers

What Wiz AI SAST does

Wiz says AI models have become highly adept at finding complex flaws in application code. Security teams have historically filled that gap with manual reviews and quarterly pentesting, but the company argues neither approach scales when code is written and exploited at machine speed.

Wiz AI SAST analyzes how an application actually behaves to uncover a broader range of weaknesses (CWEs) that typically go undetected by rules-based scanners. It is powered by the Atlas harness, which Wiz shared earlier this year. According to Wiz, Atlas held the number one spot on CyberGym, the public benchmark for AI driven vulnerability research, and uncovered more than 200 vulnerabilities in widely used open source software.

Findings are correlated with what is running in production on the Wiz Security Graph. Prioritized results then flow through the policy, ownership and remediation workflows that AppSec teams already use.

Model selection and managing non-deterministic results

Wiz describes itself as an AI vendor-agnostic platform. It says its Cyber Model Arena work shows that AI security performance depends on the model and the harness together, so each new model release means retesting every pairing against real-world security tasks. The strongest and most efficient model is then swapped into the AI SAST harness. This includes cutting edge cybermodels made available through Wiz's partnership with Google DeepMind.

Because large language models are inherently non-deterministic, they can produce different results from one run to the next. Wiz says it addresses this with automated lifecycle management across scans:

• Retest: the engine re-examines existing findings before scanning for new risks. If the code has been fixed, the finding is marked resolved automatically.
• Deduplicate: new findings are matched to existing ones using security context and code semantics rather than line numbers or file paths. Even if the AI changes a bug's title or description, the engine reconciles it into a single, stable finding.

To decide what to scan, security teams can use Mika AI to prioritize repositories based on context such as cloud exposure, access to sensitive data and business criticality. Wiz notes that AI code analysis is resource intensive and not every asset needs it.

Logic flaws and infrastructure context

Wiz says the tool extends detection into logic-based vulnerabilities that have long been hardest to catch, such as broken access control, flawed input validation and misapplied cryptography. As an example, Wiz AI SAST detected an Insecure Direct Object Reference (IDOR) flaw in an e-commerce basket endpoint, where any authenticated user could read another user's cart by changing the ID in the URL. A rules-based engine would miss it, Wiz says, because the syntax is fine and the problem is a missing ownership check.

Findings come with confidence scores, investigation summaries and reproduction commands. Grounding the engine in the Wiz Security Graph lets the model consider infrastructure, identity configurations and runtime environment. Wiz says this helps uncover vulnerabilities that exist only where application logic and infrastructure flaws intersect, and surfaces attack paths to cut triage fatigue. The company's Red Agent can then validate exploitability against a live environment.

What it means for AppSec teams

Wiz positions AI SAST as an extension of existing scanning, not a replacement. Deterministic scanning offers fast, cost-effective coverage for syntax based flaws, while AI SAST adds reasoning for intent-dependent flaws. The company says the combination gives broader coverage across the application attack surface.

For Wiz Code customers, the pitch is that they can run AI code scanning without building their own harness, benchmarking new models or managing finding lifecycles. The feature is still in Public Preview, and the source does not give pricing or a general availability date.