Vega + Wiz: Turning Cloud Risk Into Detections That Act

21 Sept 20266 min

TL;DR

Vega’s partnership with Wiz brings the best cloud risk insights into the platform where Agentic Cyber Defense happens.
Wiz’s cloud context - exposure, privilege, and sensitive data - becomes a native source inside Vega’s platform, part of every query, detection, and investigation.
The integration gives security teams the full power of rich cloud telemetry that’s often priced out of legacy SIEM ingestion.

Wiz knows what’s exposed, what’s misconfigured, and which resources touch sensitive data. The SOC knows what the adversary and their malicious campaigns are doing right now. With both in view, Cyber Defense Engineers have the end-to-end context they need at the moment of decision to stop a breach. Vega’s collaboration with Wiz builds that understanding from the start, integrating Wiz’s rich context as a native source in the Vega Agentic Cyber Defense platform.

Every security team has faced the choice between full visibility and containing ballooning legacy SIEM costs. Often, cloud telemetry is never ingested at all. It lives in object storage for basic querying, which isn’t security. With Vega, cloud data flows into the platform from wherever you choose: native integrations, object storage, or data lakes. It never needs to be ingested, and it never moves. You get all of the visibility at 82% less cost than legacy SIEMs. Coverage stops being a budget decision.

The Power of Natively Integrated Cloud Context

With this integration, every data source in the Vega platform is automatically enriched with Wiz’s exposure context, including public exposure, privilege level, and sensitive data access. The platform treats a routine API call at a different risk level, knowing that the target is internet-facing and holds sensitive data.

As part of Vega’s Agentic Cyber Defense loop across detection, triage, investigation, and optimization, the platform queries Wiz’s risk profile of every asset to make faster, better decisions. And through all of it, Wiz stays the source of truth. No costly, complex ingestion required by legacy SIEM, with all of the security benefits.

Proven Cyber Defense Use-Cases

Vega built its integration with Wiz in a completely unique way, pulling in risk context just as it is needed, versus bulk uploads that quickly go out of date. All data becomes instantly queryable in Vega, automatically prepared for the questions Cyber Defense Engineers actually ask: What’s exposed to the internet? What touches sensitive data? What is critically vulnerable, over-privileged, business-critical, or unmanaged?

Example 1: First-ever read of an internet-exposed store Wiz classifies as sensitive

A single object read turns into an exfiltration signal when it’s the first time this identity has touched a store Wiz says holds sensitive data and is open to the internet.

@CloudTrail
| where timestamp > ago(30d)
| where event_name == "GetObject"
| summarize firstSeen = min(timestamp), reads = count()
    by actor.user.name, databucket.name
| where firstSeen > ago(1d)                       // first access to this store in the window
| join kind=inner (
    @Wiz-Sensitive-Data-Resources
    | where resource.has_sensitive_data == "true" and resource.is_open_to_all_internet == "true"
    | project resource.name, cloud.provider, account.uid
  ) on $left.databucket.name == $right.resource.name
| sort by firstSeen desc

Together, Vega sees the read, with Wiz adding that the store holds regulated data and is exposed to the internet. Now, the analyst gets the complete picture with no manual work: novel access to a confirmed sensitive, internet-exposed store.

Example 2: A sensitive, internet-exposed store is being reconfigured

An identity rewrites the access policy on a store Wiz currently classifies as sensitive and open to the internet, surfacing who is changing exposure-critical settings on an exposed crown jewel, and when.

@CloudTrail
| where timestamp > ago(30d)
| where event_name in ("PutBucketPolicy", "PutBucketAcl", "PutBucketPublicAccessBlock", "DeleteBucketPublicAccessBlock")
| summarize firstSeen = min(timestamp), lastChange = max(timestamp), changes = count()
    by actor.user.name, databucket.name
| join kind=inner (
    @Wiz-Sensitive-Data-Resources
    | where resource.has_sensitive_data == "true" and resource.is_open_to_all_internet == "true"
    | project resource.name, cloud.provider, account.uid
  ) on $left.databucket.name == $right.resource.name
| sort by lastChange desc

Together, Vega sees a policy change and who made it, with Wiz providing the context that the store holds sensitive information and is public. In one platform, analysts see live configuration activity on a confirmed sensitive, internet-exposed store.

Understanding Impact in Seconds, Not Pivots

When an alert fires, Vega’s Agentic Cyber Defense loop brings Wiz context into the investigation as part of its reasoning. Instead of manually piecing together exposure across consoles, the investigation surfaces:

Whether the implicated resource is exposed to the internet
Its privilege level and access to sensitive data
Critical vulnerability findings on it
The potential blast radius of the activity

The result is a confidence-scored verdict with full cloud context in a single end-to-end workflow.

Vega AI investigation of a Block Public Access policy removal on an S3 bucket, with Wiz confirming the bucket is open to the internet and holds sensitive data, joined against CloudTrail GetObject reads, and recommended actions.

Cloud Risks, Where They Actually Matter

Overwhelmed by cost, Cyber Defense teams send their legacy SIEM a sample of their cloud data, and that’s all they are able to defend. Without the needed visibility at the moment of decision, exposures lead to breaches.

By integrating Wiz’s best-in-class cloud context directly into Vega’s Agentic Cyber Defense platform, cloud risk becomes part of every detection, triage decision, and investigation - with Wiz remaining the source of truth.

The outcome is simple: The Vega platform unifies all data sources, in place, where you choose to keep them, to drive significantly faster, more effective Cyber Defense decisions at a much lower cost than legacy SIEM.

FAQ

What do I need to set up the integration?

A Wiz service account (Custom Integration, GraphQL API) with read-only scopes - read:resources, read:issues, read:vulnerabilities - created by following Wiz’s official guide. In Vega, paste the Client ID, Client Secret, and API Host into the Wiz connector and hit Connect. Setup takes minutes.

Is my Wiz data copied into Vega?

Wiz stays the source of truth. Vega maintains a lightweight, continuously refreshed copy of just the risk attributes it needs - a rolling 14-day window, refreshed every 12 hours. No bulk log shipping, no second data lake, and access is read-only.

Will this add load to my Wiz tenant?

No. The sync pattern was designed together with Wiz following their integration guidelines: incremental, time-filtered pulls instead of full re-syncs, and request rates kept well within Wiz’s API limits. Your Wiz tenant won’t notice it’s there.

I already ingest Wiz findings through my SIEM or data lake - do I need this?

The two are complementary. If Wiz findings already land in your existing log platform, Vega reads them there. This integration adds direct, risk-sliced cloud context on top - pulled straight from the Wiz API, in the same normalized schema - so your queries and investigations work the same way regardless of how Wiz data reaches you.