Wiz pairs Red and Blue Agents to bring AI offense and defense to the SOC

Why Wiz says reactive SOC work falls short

Wiz argues that most SOC teams begin investigating only after a threat alert fires, a model it says was built for attackers who moved at human speed and relied mostly on known exploits. The company points to two shifts that change this.

• Organizations are shipping more custom code, helped by AI-assisted development. According to Wiz, these apps can contain logic-driven vulnerabilities such as broken authorization and authentication bypasses that signature-based scanners cannot detect.
• Attackers are using frontier AI models to scan perimeters, find exposed applications and weaponize vulnerabilities in hours instead of months, according to Wiz. AI also lowers the barrier to entry, so more attackers can probe custom applications.

Wiz concludes that the first sign of a logic flaw is often the breach itself. Its answer is to use AI to fight AI: find the open door before an attacker does, and investigate at AI speed when someone gets through.

The company cites a Gartner report, The Security Operations Roadmap to 2030, dated October 2026, which says proactive, continuous threat exposure management (CTEM) with offensive testing will dominate SOC operations.

Red Agent: pre-breach alerts

Wiz describes the Red Agent as an AI-powered pentester that finds validated exploitable risks so teams can remove them before attackers arrive. It works alongside Wiz ASM and covers known risks such as CVEs and misconfigurations as well as logic-based risks in custom applications, such as authorization bypasses.

Each finding comes with proof of exploitability, reproduction steps and blast radius context from the Security Graph. A clear owner and remediation guidance come from the Green Agent. Wiz says such findings call for pre-breach urgency rather than a place in the vulnerability backlog.

Roy Weiss, Principal DevSecOps at Fireblocks, is quoted in the post saying: "All of those insights are really, really helping me to close gaps fast."

As an example, Wiz describes a finding from its Red Agent POV series. The agent found a way into a financial services company's production cloud API without authentication, exposing live cloud credentials and the application's full source code. Wiz outlines a five-step playbook for the SOC:

• Triage: already done, since the exploit is proven and reproduction steps are provided.
• Scope: threat hunters check whether anyone has already used the path, for instance the exposed credentials from unexpected sources.
• Contain: rotate the credentials and restrict the endpoint as a stopgap.
• Hand off: the Green Agent identifies the application owner and sends specific fix guidance.
• Verify: once the fix ships, the Red Agent retests the same risk to confirm it no longer works.

Blue Agent: investigating active threats

Wiz acknowledges that proactive alerts shrink the attack surface but that no SOC can close every door instantly. For active threats, the Blue Agent takes over manual investigation steps, such as deciding whether activity is legitimate, a security test or an attack, what the blast radius is, and whether containment actions have worked.

According to Wiz, the agent pulls context from the Security Graph, code-to-cloud visibility and runtime signals, and investigates like a trained incident responder. Specialized sub-agents handle individual questions. The Forensics sub-agent, for example, analyzes forensic evidence captured at detection time by the Wiz Sensor to find the root cause of suspicious activity and what actually ran on a machine.

The Blue Agent shows its work: the questions it asked, the data it retrieved and how each signal shaped the verdict. Wiz says this lets analysts stay in control and trust the result. With Wiz Workflows, teams can turn verdicts into action, such as escalating incidents, notifying response teams or triggering containment playbooks based on verdict and confidence level.

What it means for SOC teams

The pitch is a change in when the SOC gets involved. Wiz says detection still matters but should not be the first time a team hears about a critical, validated, exploitable risk. Treating proven attack paths with the urgency of an active threat, and handing fixes to owners with verification afterwards, would let teams respond to fewer incidents, the company says.

The claims come from Wiz's own blog post, and the source gives no performance figures or pricing. Wiz directs interested teams to get started with the agents, read its Red Agent and Blue Agent POV blog series, or book a live demo.