Wiz details ASPM strategy to unify app security scanner data

Wiz published first-hand research detailing how organizations can operationalize Application Security Posture Management to handle the increased speed of modern software development. The company argues that traditional security workflows are failing because AI models can now discover vulnerabilities and generate exploits in minutes, shrinking the window for remediation significantly.

The research highlights that AI-assisted development allows teams to ship code faster than ever, which amplifies existing risks and expands the overall attack surface. This dual acceleration renders manual processes for reviewing scanner alerts and tracking code owners unviable. Consequently, Wiz states that ASPM must evolve beyond simple aggregation to help teams prioritize exploitable risks using context from the entire application lifecycle.

Context and Technical Approach

Wiz Code aims to provide this necessary context by connecting existing application security scanner findings with cloud exposure data and runtime insights. The platform also incorporates adversarial testing to help prioritize critical risks. According to Wiz, this foundation of context enables security teams to achieve broad visibility into application risk across their enterprise footprint and empowers developers to remediate issues at machine speed.

The company released this analysis as the first part of a blog series on ASPM in the AI era. Subsequent parts will cover how Wiz enriches third-party findings, removes duplicate alerts, and uses its Security Graph to identify true attack paths. The final installment will focus on remediation automation and AI-generated fixes.

Who Is Affected

Organizations using Next.js applications serve as a practical example of the challenges described in the research. Wiz cites the critical remote code execution vulnerability React2Shell, identified as CVE-2025-55182, which impacted Next.js applications in late last year. For enterprises heavily invested in this framework, a flaw in a core component cascades across micro-frontends, internal tools, and public applications.

This cascade instantly generates thousands of isolated findings across hundreds of repositories and container images. Without context, application security teams are left with a massive backlog of vulnerable packages and no way to determine which instances are actually exploitable. With proper context, organizations can detect every instance and prioritize those tied to internet-facing applications or workloads with access to sensitive data.

What should you do?

Security teams should evaluate whether their current tools provide unified visibility across their entire application stack. They should look for platforms that can ingest data from existing scanners without requiring a complete replacement of their current security ecosystem. Teams should also verify that their solution can correlate findings with cloud exposure and runtime data to prioritize risks effectively.

What to do and how to stay safe: Wiz

• Integrate existing application security scanners into a central platform to reduce integration overhead and normalize data automatically.
• Use cloud exposure and runtime insights to prioritize vulnerabilities found in internet-facing applications or those with access to sensitive data.
• Identify coverage gaps across codebases by correlating and deduplicating resources from multiple security tools.
• Monitor for new AI-generated exploits and adjust remediation priorities based on the exploitability of specific vulnerable components.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does AI impact application security workflows according to Wiz?

AI models can autonomously discover vulnerabilities and generate exploits in minutes, while AI-assisted development helps teams ship code faster, amplifying risks and breaking traditional manual review processes.

Which third-party tools does Wiz integrate with?

Wiz provides out-of-the-box support for popular AppSec solutions including Snyk, Checkmarx, and GitHub Advanced Security through its Wiz Integration Network.

What is the purpose of the React2Shell example in the research?

The example illustrates how a single vulnerability in a core component can cascade across multiple repositories and applications, generating thousands of isolated findings that require context to prioritize.