Wiz launches Scan for Good to find exposures in public services and critical infrastructure

Wiz has launched Scan for Good, an initiative that pairs AI with human security researchers to uncover public exposures and complex attack paths across public services, critical infrastructure, healthcare and nonprofits. The programme uses the Wiz Red Agent, an AI-powered, context-aware pentester, alongside other internal AI research capabilities to examine publicly facing websites, APIs and applications where organisations have authorised testing.

Wiz said the effort has already uncovered hundreds of public exposures that were fixed after validation and collaboration with the affected organisations. Google DeepMind partnered on the project, and CISA engaged with Wiz to offer collaboration and guidance.

The company cited examples including an exposed administrator key giving read, write and delete access to 8.8 million files in a national archive, missing access controls at a public hospital, and a leaked production database at a public rail operator that exposed active administrator sessions. It also described findings at technology platforms, including a zero-day in a shared payments service and a credential in public website code that could have been used to publish malicious software across more than 500 production container images.