Tool profile
Wiz: cost, fit and limits
Wiz is a cloud security platform made by Wiz, Inc., now part of Google Cloud, that scans cloud and code environments for risk, maps attack paths, detects runtime threats and uses named AI agents to fix issues and investigate alerts.
What to know first
Wiz sells three packages, Wiz One, Wiz Go and A la Carte, and publishes no prices for any of them; the pricing page leads to a three-step custom quote form. No free trial was mentioned on the pages read. The product spans code, cloud and runtime, with Green, Red and Blue agents and AI security discovery of models, agents and MCP servers.
Wiz at a glance
| Maker | Wiz, United States |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI Cloud Security (CSPM and CNAPP) Software in 2026, rank 6 of 12 |
| Website | wiz.io |
Who Wiz is best for
Security teams that want code to cloud coverage
Wiz Code covers the IDE through CI/CD to deployment, so a team can trace a cloud risk back to the repository that created it.
Teams drowning in alerts
Blue Agent automates threat hunting and alert investigation, and fix routing uses graph context and ownership mapping to find who should handle a fix.
Organizations adopting AI services
The AI security feature discovers AI models, agents and MCP servers across cloud and SaaS and flags sensitive data exposure and exposed endpoints, which gives a starting inventory.
Wiz plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Wiz One | Not published, custom quote | The pricing page lists the plan without contents or figures; scope is set through the quote form. |
| Wiz Go | Not published, custom quote | The pricing page lists this package without contents or figures, so what it covers beyond Wiz One must be asked of sales. |
| A la Carte | Not published, custom quote | Options described as tailored to exact needs; individual options are not listed on the page. |
Checked October 2026.
What Wiz does
- Green Agent
- Green Agent turns identified risks into code fixes and opens pull requests, which moves remediation into the developer workflow instead of leaving it in a separate ticket queue.
- Red Agent
- Red Agent runs automated penetration testing and attack-path discovery, aimed at finding how an attacker could reach critical assets before a real attacker does it.
- Runtime detection
- Wiz Defend adds runtime threat detection through an eBPF Runtime Sensor, which extends the posture view to what is actually executing inside your running workloads.
- Attack surface scanning
- Scanning maps internet-reachable assets and the initial access paths into them, so exposure can be judged from the outside as well as from inside the account.
How Wiz handles your data
The trust center, read in an earlier pass, lists ISO 27001, 27017, 27018 and 27701, SOC 2 Type II, a HIPAA report and a PCI DSS v4.0.1 Attestation of Compliance. The pages read do not state whether customer data trains AI models, how long data is retained or where it is hosted, so the vendor's policy was not checked for those points. Buyers should request the data processing terms.
Where Wiz falls short in practice
- No published prices. All three packages are quote only, so cost cannot be compared before a sales conversation, and no free trial was mentioned on any of the pages read.
- Unexplained homepage figures. The homepage shows 0% for three outcome figures without explanation, so this page uses none of them. Ask the vendor for customer evidence during an evaluation.
- No developer API named. The home, about, pricing and integrations pages read name no public developer API, so teams planning custom automation should check the documentation first, before committing.
Alternatives to Wiz
Wiz: common questions
How much does Wiz cost?
Wiz publishes no prices. The pricing page lists Wiz One, Wiz Go and A la Carte and sends visitors to a three-step custom quote form. A la Carte is described as tailored to exact needs. Expect to get figures only from sales, and ask what the package includes.
Is Wiz part of Google Cloud?
The Wiz about page, opened for this page, says it is now part of Google Cloud. The legal maker is listed as Wiz, Inc. The pages read do not describe how pricing, support or data handling changed with that ownership, so ask the vendor in a contract review.
What do the Wiz AI agents do?
Green Agent turns risks into code fixes and opens pull requests, Red Agent runs automated penetration testing and attack-path discovery, and Blue Agent automates threat hunting and alert investigation. Wiz names these on its pages; the pages give no accuracy figures for them.
Does Wiz find AI workloads in my cloud?
The AI security feature discovers AI models, agents and MCP servers across cloud and SaaS and flags AI-specific risks such as sensitive data exposure and exposed endpoints. Coverage depth is described only in marketing terms, so test it on a real account.
Which certifications does Wiz list?
The trust center lists ISO 27001, 27017, 27018 and 27701, SOC 2 Type II, a HIPAA report and a PCI DSS v4.0.1 Attestation of Compliance. That page was read in an earlier pass, so confirm the current scope and report dates with the vendor.