Wiz expands Service Catalog with auto-discovery, posture policies and a Services Board

Building the catalog with less manual work

Wiz says service context is often scattered across cloud platforms, tags, developer portals and CMDBs. Service Catalog is meant to bring that together so security insights can be tied to the services, teams and owners behind them.

For teams that define services in developer portals, Backstage Software Catalog Sync brings service descriptions, lifecycle stages, tags and ownership mappings into Wiz while keeping the hierarchy developers already use. A ServiceNow CMDB integration is described as upcoming, offering a similar route for organizations that treat ServiceNow as their system of record.

Wiz also describes Dynamic Discovery Rules, planned for a Q4 release. They will inspect real-world tagging patterns, extract the dominant service-identifying keys, such as app, service or component, and build application boundaries dynamically. According to Wiz, this removes rule maintenance and adapts to naming inconsistencies.

Where tagging is inconsistent, Network Inclusion Rules use live network traffic and cloud event telemetry to identify the databases, storage buckets and messaging services an application communicates with. These are mapped as Related Resources in the catalog. Later this year, Wiz plans to let teams create services from non-compute resources such as buckets, databases, managed/AI services and CDNs.

Posture policies and service-level context

Service Posture Policies let organizations define and enforce standards for service configuration and ownership. Wiz gives two examples: requiring every production service to have an owner, or requiring every service to be assigned to a Wiz Project. Wiz automatically creates and resolves Posture Issues as services move in and out of compliance.

The company also lists several views that bring context to the service level:

• Service Threats: links multi-resource detection chains, such as lateral movement, privilege escalation or data exfiltration, to the affected service so SOC analysts see which service and team are impacted.
• Service-Level Identity Security: maps IAM roles, service accounts and API keys to the services they power, to help spot excessive permissions, toxic combinations and credential exposure.
• Secure Architecture Opportunities with WizOS: surfaces container image migration opportunities to service owners.
• Service Compliance: shows compliance posture scores for frameworks such as CIS, SOC 2 and PCI DSS, scoped to each service's assigned resources.
• Wiz Cloud Cost: breaks down cloud spend and optimization opportunities by service, so SecOps, Platform and FinOps teams can work from one view.

On AI, Wiz says it automatically identifies and catalogs AI components, including PaaS AI agents (AWS Bedrock, Azure OpenAI), foundation models, MCP servers and AI datasets. Security teams can filter for AI-powered services, audit agentic identities and govern sensitive data flows to AI workloads.

Services Board and workflow templates

The new Services Board gives an organization-wide view of discovery trends, ownership gaps, project mappings and risk. For leaders, Wiz says it provides benchmarks across discovery completeness, ownership coverage, compliance, threat exposure and cost attribution, helping track progress over time.

New templates in the Wiz Workflows Catalog aim to turn that visibility into action. Teams can identify unowned services and route ownership requests, and notify stakeholders through Slack, Jira or ServiceNow when a service violates a Service Posture Policy. Developers can remediate issues through tools they already use.

Two event-driven triggers are described. On Service Creation, teams can automate ownership outreach, verify tagging or start Slack or Jira approval flows. On Service Issue Creation, consolidated service-level findings can be routed to the responsible dev team's backlog or alert channel with service and code context attached.

What it means for security and engineering teams

Based on Wiz's description, the update targets a common gap: knowing which team owns a risky resource. By combining discovery, ownership checks and automated routing, Wiz says teams can move from identifying risk to assigning it, and from assigning it to fixing it. Several features, including Dynamic Discovery Rules, the ServiceNow CMDB integration and non-compute service creation, are still upcoming, so availability will vary.