Yinon Costica, Wiz co-founder and VP of Product, says AI adoption will compress a decade of cloud-style change into less than a year.
Costica argues defenders should attack themselves with AI first, using Wiz's red agent to find exposures before attackers do.
Wiz and Google launched an AI threat defence offering, and Costica expects always-on agent loops from testing to fixing to response to be visible by early 2027.
Wiz says defenders must attack themselves with AI first
Wiz argues that AI compresses the cloud security cycle into months and hands attackers a faster toolset, so defence has to turn offensive and automated. Defenders hold their own context, shared intelligence and the best models. Attacking yourself with agents before attackers do, then fixing and responding in continuous loops, is how that edge is used.
Takeaways
AI adoption repeats cloud, only much faster. Costica says companies will use many models, as they moved from one cloud to multi-cloud. What took about a decade with cloud is compressing into under a year, and AI also accelerates attackers where cloud only added an attack surface.
Companies cannot opt out of securing against AI. Attackers will use AI whether or not a company does, so the decision is not the organisation's to make. Costica adds that cyber has reached high maturity in acknowledging risk, which was not true even five years ago.
Defenders should attack themselves with AI first. AI made finding application attacks fast, scalable and cheap in expertise, and findings can look scripted. Pen testing once covered limited scopes yearly. With abundant intelligence, defenders may skip likelihood analysis and look for everything.
Defenders hold real advantages over attackers. Attackers need one weakness while defenders must cover all, but defenders have their own context and threat intelligence shared in minutes, not days. A model one percentile better than attackers' could unlock millions of sites. Atlas ranked first by using several models.
Scan for Good aims the red agent at infrastructure. The programme runs on a Gemini model and scans critical infrastructure, such as health organisations without Wiz access. Johnson cites roughly 470 findings, including a flaw that could let attackers delete about 9m files in a European national archive.
Wiz rebuilt its products around security agents. The red agent does automated pen testing and the blue agent investigates and responds defensively. The green agent fixes code and cloud configurations. The platform launched in March, when Google closed its acquisition, and Wiz stays independent with access to Google's threat intelligence and unreleased models.
Always-on agent loops should appear by early 2027. Costica predicts agents that continuously test, fix and respond. The path from red agent findings through green agent fixes to coding agent deployment already works, and he wants it closed end to end, possibly within minutes.
Wiz and Google's AI threat defence programme
Scan the attack surface with the red agent.
Tap a name to go there · tap a line to see why they are linked
On this episode 2
Show 1
Fix exposures at scale, including segmentation and a more resilient architecture, with the green agent automating remediation.
Scan code with Atlas before deployment.
Run AI threat detection and response with the blue agent, which should add detections, guardrails and response actions that cut the blast radius without humans.