What do users say about Wiz?

I feel like the best part of WIZ is its 100% agentless deployment and rapid time-to-value, since it scans the cloud environment from the outside in. Review collected by and hosted on G2.com.

Wiz is built on an agentless, snapshot-based architecture. While this enables deployment in minutes, it also introduces inherent latency and creates a blind spot around real-time runtime behavior. By contrast, competitors like Prisma Cloud take an agent-first approach by deploying “Defenders” into workloads, which helps them detect active, real-time post-exploitation activity—such as a reverse shell running in a container, ongoing lateral movement, or live cryptomining—that Wiz’s point-in-time snapshots can miss. In my experience, Lacework also performs better than Wiz when it comes to runtime behavior analytics and anomaly detection. Review collected by and hosted on G2.com.

The key strength of Wiz is its ability to consolidate visibility across cloud assets into a single platform. Its security-focused view provides an immediate understanding of the most critical issues, enabling faster and more informed risk management decisions. Review collected by and hosted on G2.com.

The primary limitation lies in the constraints of our current Essential licensing model. Integrations with third-party security controls, such as Fortinet firewalls, should be considered a fundamental capability. Given our reliance on non-cloud-native firewalls across cloud environments, the absence of these integrations reduces visibility and prevents Wiz from delivering a fully comprehensive security posture assessment. Review collected by and hosted on G2.com.

What I value most about Wiz is its ability to provide centralized visibility of security risks in multicloud environments, making it easier to identify, correlate, and prioritize vulnerabilities, misconfigurations, and security exposures. Its risk context-based approach helps direct remediation efforts towards findings with the greatest potential impact, improving operational efficiency and supporting strategic decision-making. Additionally, the integration of various security capabilities into a unified platform fosters collaboration between Security, Infrastructure, and Cloud teams, contributing to the continuous strengthening of the security posture. Review collected by and hosted on G2.com.

One of the main areas of opportunity is that it would be very beneficial to have greater customization capabilities in executive reports, tracking dashboards, and remediation workflows. This would facilitate adaptation to different governance and risk management models, according to the needs of each organization. Review collected by and hosted on G2.com.

What I love most about Wiz is the centralized visibility it provides over my entire multicloud environment. I currently use it to integrate different platforms like Azure, Oracle Cloud Infrastructure (OCI), Azure DevOps, and GitHub, allowing me to have a unified view of the security posture of both the infrastructure and the development cycle.

I find its ability to identify vulnerabilities in repositories, detect exposed secrets in code, and correlate risks between cloud resources, identities, and applications particularly valuable. This helps me understand not only what vulnerabilities exist but which ones pose a real risk to the organization.

Additionally, we leverage Wiz's AI agents and initiatives to accelerate the analysis and investigation of findings. These capabilities help us better understand the context of risks, identify potential attack paths, validate exposures, and prioritize remediation actions, significantly reducing the time spent on manual analysis.

In my daily work, I use Wiz to investigate automated alerts related to attack risks, analyze findings, validate their impact, and coordinate remediation with responsible teams. For example, we have identified resources exposed to the Internet, such as virtual machines with sensitive data or configurations that increase the attack surface, allowing us to act proactively before an incident materializes.

In summary, Wiz provides me with three key capabilities: visibility, context, and prioritization. Thanks to the combination of risk correlation, AI-assisted analysis, and comprehensive coverage of cloud and DevSecOps environments, we can detect, investigate, and remediate threats more quickly and efficiently. Review collected by and hosted on G2.com.

Overall, my experience with Wiz has been very positive, especially due to the comprehensive visibility it provides over multicloud environments and its AI-assisted risk correlation and investigation capabilities. However, if I had to mention an area for improvement, it would be the depth of some security analyses in the development cycle.

When comparing Wiz's SAST (Static Application Security Testing) capabilities and secret detection with specialized market tools, I believe Wiz adequately meets the need and provides excellent centralized visibility. Nonetheless, in some cases, it could delve deeper into the analysis and improve the accuracy of certain findings, reducing the number of false positives and providing more technical context to facilitate the validation and remediation process.

Even so, I believe this point does not diminish the overall value of the platform, as its main strength remains the ability to correlate information from infrastructure, identities, applications, and development to offer a complete view of risk in the organization. Review collected by and hosted on G2.com.

What I like most about Wiz is how effectively it balances depth with usability across the board.

The UI/UX is clean and intuitive. The Security Graph makes complex relationships easy to understand at a glance, and I can move from a high-level view to a specific finding in just a few clicks without feeling lost.

Integrations are another major strength. It connects smoothly with our cloud providers, CI/CD pipelines, ticketing systems, and messaging tools, so findings show up where my team already works instead of living in a separate silo.

From a performance standpoint, the agentless scanning provides broad, fast coverage across the environment without the overhead of deploying and maintaining agents. Results also come back quickly, even at scale.

On pricing and ROI, the value becomes clear quickly. By prioritizing real, exploitable risk over raw alert volume, it saves significant triage time and helps us reduce exposure with the team we already have.

Support and onboarding were smooth as well. Initial setup was fast thanks to the agentless model, and the team was responsive and genuinely helpful in getting us to value quickly.

Finally, the AI/intelligence layer stands out. It correlates exposure, misconfigurations, and attack paths into clear, prioritized insights, and it surfaces things that are easy to miss manually—like an “internal” asset that’s actually reachable from the public internet. Review collected by and hosted on G2.com.

There are a few areas where Wiz could improve.

On the UI/UX side, while the Security Graph is powerful, it can feel overwhelming at first. There’s a real learning curve to understanding all the different views and filters, and in larger environments the graph can become visually dense and harder to navigate.

When it comes to integrations, the core connectors are solid. However, some of the more niche or custom tools in our stack require extra configuration or workarounds, and a few integrations don’t go as deep as I’d like.

From a performance perspective, scanning is generally fast, but in very large environments some queries and dashboards can take longer to load. I’ve also noticed there can be a slight delay before newly created resources show up.

Pricing is probably the biggest challenge. Wiz is a premium product, and the cost can be a real hurdle for smaller teams or when trying to justify expansion into additional modules. The pricing model also isn’t always easy to predict as you scale.

For support and onboarding, the initial setup is smooth, but fully mastering the platform’s more advanced capabilities takes time. More in-depth documentation or guided tutorials would help shorten that ramp-up.

Finally, on the AI/intelligence side, the prioritization is strong, but it occasionally surfaces findings that still need manual validation. I’d also like more transparency into how certain risks are scored and ranked. Review collected by and hosted on G2.com.

What I like best about the Wiz platform is definitely the UI, the alerts, the charts interface, and the visibility it provides. As a security team, when we move to an investigation, we want to deep dive into the alert and check the root cause - not just read the title. I also like the AI agent capabilities, which help summarize the incident so I can get a clear overview. Every time I've used it, it has been accurate and really helpful. Review collected by and hosted on G2.com.

Honestly, nothing stands out as a dislike. The platform performs really well overall, and the UI makes the experience smooth and intuitive. Review collected by and hosted on G2.com.

What I like best about Wiz is how quickly it gives us visibility across our cloud environment, both agentless and with the Wiz Sensor where we need deeper runtime coverage. The Security Graph makes it easy to understand how a vulnerability, a misconfiguration, and an exposed resource connect into a real attack path, so we can focus on the issues that actually matter instead of chasing long lists of findings. The UI is clean and intuitive, and it integrates well with our existing workflows, which saves our team a lot of time. Review collected by and hosted on G2.com.

There isn’t much I dislike, but there are a few areas for improvement. The volume of findings can feel overwhelming at first, and it takes some time to tune policies and filters to reduce noise. Building more advanced custom queries in the Security Graph has a bit of a learning curve, and pricing can be on the higher side for smaller teams. Review collected by and hosted on G2.com.

The user interface is intuitive. Integrations are plentiful, which allows us to see across most of our systems. The graph query and the custom configuration policies are my favourite parts of the tool, and they provide a level of flexibility that fits our bespoke concerns. Review collected by and hosted on G2.com.

At a large enterprise scale, we sometimes run into scaling limits, and the UI can feel bogged down at times. We’ve also encountered a few edge cases and bugs; Wiz has resolved most of them, but not all of them fully. There’s also an opportunity for more learning sessions and broader awareness on how to get the most out of the product, especially given its extensive set of features. Review collected by and hosted on G2.com.

I like how Wiz is built from the ground and everything works together smoothly as a single solution. It is easy to implement and to maintain, most of the capabilities works in a agentless fashion, I have never seen an advanced solution like Wiz, it really feels like magic. Review collected by and hosted on G2.com.

Not all the integrations and deployments can be implemented at scale, which makes it hard for big organizations to implement Wiz in a automatic way on every aspect. Another thing is the reporting piece, having CSVs and a poor PDF is not enough to document what is needed and create a document that let engineering and operations teams to understand what is the problem quickly to create a plan of action. Having to create something at your own, like a PowerBI dashboard should not be a requirement, that should be improved as a Wiz solution, not customer managed. Review collected by and hosted on G2.com.

I like that Wiz has breadth of coverage combined with how clearly it surfaces what actually matters. The agentless deployment made onboarding easy and fast, and the Security Graph helps us seeing findings as a real attack path instead of just a flat list of alerts. That also helps us in prioritization, cutting through noise to highlight the risks worth acting on. Wiz has helped us with coverage across cloud, workloads, containers, code, and identities means one platform instead of several stitched together. On top of that, performance has been reliable and the interface is intuitive, making it easy for our teams across the org to adopt. Review collected by and hosted on G2.com.

What I like least is the deterministic side of Code Security. For a while it felt scoped mainly to package and dependency versions, and the SAST engine wasn't surfacing real, basic code vulnerabilities. In the early days it even missed OWASP Top 10 fundamentals that I would expect any static analysis to catch. The recent AI-agent-based scanning has improved results noticeably, but it also drives up cost. I would rather see the core deterministic SAST piece strengthened so solid baseline coverage doesn't depend on the expensive AI option. Tightening that foundation would make Code Security complete. Review collected by and hosted on G2.com.