Wiz AI Vulnerability Scanning Targets Critical Infrastructure, but Human Review Still Decides What Gets Fixed

Wiz has launched AI vulnerability scanning across critical infrastructure after reporting 475 high or critical exposures, despite the risks of testing live public systems. Its new Scan for Good initiative covers public services, hospitals, transportation operators, nonprofits, open-source software, and foundational technology providers.

The program combines Wiz Red Agent, internal research systems, deterministic checks, and Google DeepMind’s Gemini 3.8 Flash Cyber model. Wiz says human researchers validate every consequential finding before contacting an affected organization.

That distinction matters. The program is not simply a faster vulnerability scanner or an autonomous bot receiving unrestricted access to live infrastructure. It represents a controlled test of whether AI can find real attack paths while researchers preserve authorization, evidence quality, and safe disclosure.

The pressure falls on periodic security testing, which evaluates an environment at scheduled intervals. An internet-facing system can change between those assessments, while an AI agent can continue examining new endpoints and combinations of weaknesses.

However, finding more vulnerabilities does not automatically produce better security. The harder questions concern authorization, validation, remediation capacity, and whether Scan for Good can provide evidence beyond Wiz’s own reporting.

Wiz AI Vulnerability Scanning Moves From Code to Live Attack Paths

The important change is not that AI can identify suspicious code. Wiz is applying it to connected weaknesses across live, internet-facing environments.

Wiz announced Scan for Good on September 24, 2026. According to the company’s program announcement, the initiative examines public websites, APIs, applications, and related exposed assets.

Its stated focus includes energy, water, transportation, telecommunications, government services, healthcare, nonprofits, education, and open-source projects. Organizations can apply for a complimentary assessment and remediation support.

Wiz describes three layers of assessment. Deterministic checks look for defined exposure conditions, AI-powered dynamic application security testing examines running applications, and deeper AI penetration testing investigates selected targets.

Dynamic application security testing, or DAST, interacts with a running application to identify exploitable behavior. It differs from static analysis, which primarily examines source code without executing the application.

Wiz says the system monitors 326,891 public endpoints associated with 17,761 organization-linked domains. Its program page reports 475 high or critical findings, although another section lists 17,461 root domains in scope.

That difference deserves attention. Wiz does not explain whether the figures use different definitions, reporting windows, or continuously updated datasets. Readers should treat them as company-reported dashboard figures, not independently audited measurements.

The underlying mechanism is more significant than the total. A public route, forgotten credential, or missing permission check might appear limited when assessed alone. An AI system can keep investigating how that signal connects to identities, databases, internal services, and administrative functions.

This turns exposure discovery into attack-path analysis. An attack path is a sequence of weaknesses that lets an intruder move from initial access toward sensitive data or operational control.

Traditional scanners are effective at matching assets against known signatures and configuration rules. They often struggle with application logic, chained permissions, and context that only becomes visible through interaction.

Scan for Good attempts to close that gap. The agent explores behavior, forms hypotheses, tests permitted actions, and searches for evidence that a weakness produces meaningful impact.

Wiz says it does not accept model-generated hypotheses as confirmed vulnerabilities. A human researcher must review each potential finding and validate enough impact to support disclosure.

That safeguard separates the initiative’s public framing from fully autonomous penetration testing. The AI expands the searchable space, while researchers retain responsibility for deciding whether a result is real and how far validation should proceed.

The effort also has institutional support. Google DeepMind contributes the Gemini models, while CISA engaged with Wiz to offer collaboration and guidance.

CISA Acting Director Nick Andersen said defensive vulnerability discovery can strengthen national digital infrastructure. His statement also emphasized lawful and responsible AI adoption.

The program therefore links three parties with different responsibilities. AI systems search at machine speed, security researchers control validation, and infrastructure operators decide how to remediate their systems.

That structure creates the central tension. Automation can make discovery abundant, but safe testing and durable remediation remain scarce human processes.

The First Cases Show Why Connected Exposure Matters

Wiz’s strongest evidence comes from cases where an ordinary public weakness allegedly opened a path to operational control or sensitive records.

The company has not named most affected organizations, which limits independent verification. It says the anonymity protects organizations after private disclosure and remediation.

Its examples still illustrate the kinds of risks Scan for Good targets. They also show why a simple vulnerability count does not capture the potential consequences.

At a public rail operator, Wiz says a leaked production database exposed active administrator sessions. Those sessions reportedly controlled routes, schedules, service announcements, and administrator accounts.

The issue was not described as malware targeting specialized rail equipment. It was an exposed administrative system sitting within the operational chain.

That distinction matters for critical infrastructure buyers. Attackers do not always need a rare industrial exploit if a public application exposes credentials with operational authority.

Wiz also reports two hospital cases. One involved missing access controls that exposed employee information and control of a hospital-wide mobile alert channel.

The second involved an unsafe upload feature on a public appointment-booking site. Wiz says the flaw enabled server control and exposed patient identifiers, clinical information, and consent signatures.

In another case, a municipal service reportedly exposed personal, health, and financial records belonging to roughly 5,000 elderly residents. Wiz says it confirmed the risk without collecting a bulk dataset.

The company also describes an exposed administrator key at a national archive in Europe, the Middle East, or Africa. That key allegedly provided read, write, and delete access to 8.8 million files.

These cases share a pattern. The starting point was a public-facing application, credential, upload route, or authorization failure. The potential impact reached data and functions that users would reasonably consider internal.

The technology-sector cases follow the same model. Wiz says missing access controls at an AI training-data platform exposed proprietary customer data and project configurations.

A shared payment service at an unnamed website and commerce platform allegedly exposed customer names, card brands, expiration dates, and partial card numbers across multiple stores.

Wiz also reports finding public software-delivery workflows that exposed credentials for an internal issue tracker and a production marketing database. The company says those credentials put proprietary information and customer records at risk.

One cloud infrastructure case reached the software supply chain. A credential embedded in public website code allegedly offered control over 534 production container images supporting an AI service.

Wiz says researchers proved the credential’s reach without modifying an image. The affected company then contained the credential and addressed the exposure.

That restraint is essential. A researcher does not need to alter production software to prove that a token possesses dangerous publishing permissions.

The live program dashboard also presents a sample of seven attack paths. Wiz says every example achieved initial access within 10 minutes.

The company reports that escalation ranged from two minutes to three hours and 47 minutes. Initial access and complete compromise are different events, so both measurements matter.

The examples include remote code execution, exposed keys, registry control, server-side request forgery, enterprise resource planning access, and control of a maritime port access system.

Server-side request forgery, or SSRF, tricks a server into making requests to destinations an external user cannot directly reach. It can become a bridge from a public application into an internal network.

These are serious claims, but the public evidence remains selective and anonymized. Outside researchers cannot reproduce the cases without identities, technical detail, or affected versions.

That is understandable before disclosure completes. It also means the evidence currently supports a promising program, not a broad conclusion about AI outperforming every established testing method.

The number to watch is not only 475. It is the proportion of findings that affected organizations confirm, remediate, and keep closed after follow-up testing.

Continuous AI Puts Periodic Security Testing Under Pressure

Scan for Good challenges the assumption that occasional testing can adequately cover software that changes continuously.

A conventional penetration test gives an organization a valuable point-in-time assessment. Skilled testers can understand business logic, negotiate ambiguous behavior, and recognize when a technically valid action creates operational danger.

Yet the tested environment starts changing as soon as the engagement ends. Teams deploy new code, rotate identities, expose APIs, alter cloud permissions, and connect external services.

Periodic testing therefore competes with continuous change. AI agents can revisit a public surface more frequently and investigate more combinations than a small human team can examine manually.

Wiz says Scan for Good continuously maps public assets and monitors endpoints. Deeper AI penetration testing remains on demand, which suggests the program combines continuous breadth with selective depth.

This hybrid approach is more credible than claiming one autonomous agent can fully replace expert testers. Deterministic tools identify known conditions, AI explores uncertain paths, and people validate consequential outcomes.

The broader industry has already moved in this direction. The two-year AI Cyber Challenge, organized by DARPA with ARPA-H and other partners, tested autonomous systems against open-source software used in critical infrastructure.

Finalist systems had to find vulnerabilities and produce patches under competition conditions. DARPA later released components as open source to support further defensive development.

That competition focused heavily on software artifacts. Scan for Good pushes the model toward deployed applications, identities, exposed credentials, and business logic.

The difference is operational context. Source code may reveal a vulnerable function, but a live environment determines whether that function is reachable and what authority surrounds it.

Wiz’s Red Agent is designed to investigate that context. The company describes it as an AI-powered penetration tester that reasons across application behavior and connected weaknesses.

The initiative also benefits from Wiz’s place inside Google. The program uses several Gemini models, particularly Gemini 3.8 Flash Cyber, according to the company.

This pairing creates an obvious strategic advantage. Google DeepMind supplies specialized model capability, while Wiz contributes security tooling, researchers, and access to cloud-security workflows.

It also raises expectations. A Google-backed security company should be able to publish clearer performance evidence than a smaller vendor with limited research resources.

Useful evidence would compare AI-assisted assessments with human-led tests across the same authorized environments. It would track confirmed findings, false positives, missed vulnerabilities, time to validation, remediation time, and recurrence.

A raw vulnerability total cannot answer those questions. A system can produce more findings while creating more work for the humans who must verify them.

Scan for Good’s early reports emphasize cases with real impact. That is a better signal than a list of theoretical weaknesses, but selection effects remain possible.

Successful cases naturally become public examples. Failed investigations, unproductive scans, duplicated findings, and missed vulnerabilities rarely receive equal attention in a launch announcement.

Periodic testing will not disappear because continuous AI exists. Instead, human testers will likely move toward authorization design, unusual business logic, safety boundaries, and review of high-consequence findings.

The AI system becomes a force multiplier. It covers more surface and sustains longer investigations, while people handle context that cannot be reduced to a technical exploit.

For infrastructure operators, this changes procurement questions. Buyers should ask how a service validates findings, records testing authority, limits agent actions, protects collected evidence, and verifies remediation.

They should also ask what the agent cannot test. Operational technology often has availability and safety constraints that make active experimentation inappropriate.

An assessment that works well against a public web application does not automatically belong on an industrial controller. Continuous discovery must still respect operational boundaries.

Human Validation Is the Safety Boundary, Not a Footnote

Wiz AI vulnerability scanning becomes credible only when human review controls testing depth, evidence handling, and disclosure.

AI security systems face two symmetrical risks. A false positive wastes scarce remediation time, while a false negative leaves a real attack path undiscovered.

The cost of a mistaken action can be higher in critical infrastructure. Aggressive testing might disrupt a hospital service, transportation platform, utility portal, or public communications system.

Wiz says it only tests where an organization provides explicit authorization or maintains an authorized bug bounty program or vulnerability disclosure policy. This condition should govern every active test.

A vulnerability disclosure policy invites researchers to report security issues under stated rules. It does not necessarily authorize every technique against every connected system.

Scope therefore matters as much as permission. Researchers must know which domains, endpoints, accounts, data, and actions are allowed.

Wiz says Scan for Good minimizes interaction with live systems, avoids unnecessary access to sensitive information, and uses clear stopping points. It also promises private disclosure and reasonable remediation time.

Those principles are sound. The remaining question is how consistently they operate when an autonomous agent discovers an unexpected route into a sensitive environment.

An agent might begin on an authorized website and encounter credentials connected to a system outside the original scope. A human needs to decide whether further validation remains lawful and necessary.

The company says deeper testing happens only where authorized. It also says researchers validate only enough impact to confirm a real-world risk.

That language reflects a central rule of responsible research: proof should stop before it creates unnecessary harm. Access capability can often be demonstrated without copying records or changing production data.

Human review also limits hallucinations. A language model can generate a plausible exploit narrative without proving that the target is vulnerable.

Security teams need reproducible evidence, including requests, responses, affected components, permissions, and a safe explanation of impact. A confident model description is not enough.

Independent practitioners have made the same point. A human validation analysis from the SANS Institute argues that AI can accelerate discovery, but experts still distinguish plausible theories from working exploits.

Wiz appears to recognize this limitation. Its researchers review each potential finding and decide how disclosure should proceed.

Still, the program’s public language sometimes shifts between “critical exposures” and “vulnerabilities.” Those categories can overlap, but they are not identical.

A vulnerability usually describes a weakness in software or system behavior. An exposure can include a leaked credential, dangerous configuration, excessive permission, or publicly reachable administrative function.

That wider definition fits the reported cases. It also makes transparent classification important because a total combining several categories can be difficult to compare with other research programs.

Severity labels need equal care. A critical rating should reflect realistic impact and exploitability, not merely the theoretical privilege of an exposed component.

The program dashboard includes a disclosure ledger with finding class, severity, time, token use, and estimated model cost. This is a useful start because it makes some operational data visible.

However, the public view shows only a subset of the reported findings. It does not yet provide an independent validation rate or explain how severity decisions were reviewed.

Wiz says it plans to release anonymized research after affected organizations remediate their systems. That material should clarify vulnerability patterns and the AI’s contribution to practical exploitability.

The eventual reports need to distinguish autonomous work from human intervention. Readers should know when the agent discovered a path, when a researcher redirected it, and when deterministic checks supplied the decisive evidence.

Without that separation, “AI found it” can conceal a wide range of workflows. The phrase could mean independent discovery, AI-assisted exploration, or traditional research accelerated by model-generated code.

Each workflow can be valuable. They simply demonstrate different levels of autonomy and require different safety controls.

Free Scanning Helps, but Remediation Capacity Remains the Bottleneck

Finding an exploitable weakness is only the opening step, especially for organizations that already lack security staff and modernization budgets.

Scan for Good prioritizes under-resourced organizations because they protect services with broad public consequences. That mission addresses a real mismatch in cybersecurity.

Hospitals, municipalities, nonprofits, and transportation operators can present attractive targets while operating with small security teams. Their systems may also include legacy applications and third-party dependencies.

A complimentary assessment can remove one barrier to discovery. It does not automatically provide the engineering time, procurement authority, vendor cooperation, or maintenance window needed for a safe fix.

The hospital upload case reportedly required securing an application path, rotating credentials, and adding authorization controls. Those actions touch application code, identity management, and operational testing.

The rail case required invalidating active sessions and securing management access. A durable fix may also require examining how the database became exposed and why the sessions possessed operational authority.

This difference separates remediation from containment. Rotating a credential can stop immediate access, while architectural work prevents the same failure from returning.

Wiz says it collaborates with affected organizations and supports remediation. That commitment is important because an AI-generated report without practical guidance can deepen an existing backlog.

The free model also creates a selection question. Wiz can prioritize applicants where exploitation would cause meaningful harm, but demand may exceed available researcher time.

Human validation becomes the limiting resource as automated discovery scales. More agents can produce more hypotheses, but qualified researchers must safely confirm the most consequential ones.

Disclosure capacity is another constraint. Security teams need accurate contact routes, rapid acknowledgment, coordinated technical review, and a clear timeline for remediation.

An unnamed organization can also depend on third-party software it cannot patch directly. The operator may need a vendor update, compensating control, or temporary service restriction.

Critical infrastructure magnifies these dependencies. A public portal can connect to identity providers, cloud platforms, contractors, commercial software, and operational databases.

The disclosed flaw may sit several organizational boundaries away from the team that first receives the report. Ownership can take longer to establish than exploitability.

Security leaders should therefore evaluate Scan for Good through outcomes rather than scan volume. Confirmed remediation, time to containment, recurrence rates, and reduced privilege offer better measures.

Wiz’s examples say the affected organizations fixed the identified problems. The program has not yet published a consistent metric for remediation time or long-term closure.

Follow-up assessment will matter. An access-control patch might protect one route while leaving another route exposed to the same underlying mistake.

Likewise, rotating a leaked credential helps only if teams remove the secret from public code, review its access history, and narrow its replacement’s permissions.

The most useful AI system would preserve context across that lifecycle. It would connect the original evidence, disclosure discussion, fix, retest, and lessons for similar assets.

That process also creates a knowledge-management challenge. Security findings arrive through reports, tickets, code changes, meetings, and vendor conversations.

Teams need a searchable record of what the agent observed, what humans confirmed, and why the chosen remediation closes the path. A structured engineering knowledge base can support that work without replacing security controls.

The broader lesson is straightforward. AI can lower the cost of looking, but organizations still bear the cost of deciding, fixing, and operating safely afterward.

What Wiz Must Prove Next

Three signals will show whether Scan for Good becomes durable defensive infrastructure or remains an impressive collection of launch cases.

The first signal is detailed post-remediation research. Wiz has promised anonymized reports describing vulnerability patterns, practical exploitability, and AI’s role.

Those reports should reveal enough technical evidence for defenders to recognize similar weaknesses. They should also document where human researchers intervened and why testing stopped.

If Wiz publishes reproducible patterns with clear autonomy boundaries, its central claim becomes stronger. If disclosures remain limited to totals and dramatic outcomes, independent evaluation stays difficult.

The second signal is a consistent remediation ledger. The program already lists finding classes and selected operational measurements, but buyers need outcome data.

Useful fields include confirmation status, time to disclosure, time to containment, time to verified remediation, recurrence, and affected asset category. Aggregate reporting can protect identities while showing performance.

A rising finding count with slow remediation would weaken the program’s defensive case. Faster verified closure would support Wiz’s argument that AI can improve real security outcomes.

The third signal is how peers and public agencies respond. Other security providers are building AI-assisted testing systems, while public programs are supporting automated vulnerability discovery.

The competition will center on validated attack paths, safe operating controls, and remediation quality. Model branding alone will not determine which approach earns trust.

CISA’s involvement gives Scan for Good institutional credibility, but public-sector engagement does not constitute certification of every finding or process. Agencies and operators should still conduct their own due diligence.

The initiative could also influence expectations around vulnerability disclosure policies. Organizations may need machine-readable scope, explicit rules for agent behavior, evidence-retention limits, and emergency contacts.

That would be a meaningful secondary effect. Existing policies were largely written for human researchers conducting discrete investigations, not agents operating continuously across many assets.

The dual-use issue will remain. Techniques that help defenders chain exposures can also help attackers move faster.

Wiz’s answer is to give selected defenders access to stronger models, use authorization, require human validation, and disclose privately. Those controls reduce risk but do not remove it.

The wider policy challenge is keeping defensive adoption ahead of offensive use. That requires fast remediation, shared patterns, measured disclosure, and clear accountability for automated actions.

Wiz AI vulnerability scanning has already produced consequential reported cases. A rail administration system, hospital applications, public archives, payment services, and software registries are not abstract test targets.

Yet the initiative’s long-term value will depend on evidence beyond discovery speed. It must show that findings are accurate, testing remains controlled, operators can fix problems, and the same exposure does not return.

Security leaders should respond by mapping their public assets, tightening disclosure policies, and defining boundaries for authorized AI testing. They should also rehearse how high-impact findings move from intake to verified closure.

Ask a practical question before the next agent arrives: can your organization identify the owner, preserve the evidence, authorize safe validation, and fix a chained exposure quickly? If the answer is unclear, the immediate task is not buying more scanning. It is building the process that turns an AI-generated signal into a controlled, durable security improvement.