Rethinking Scanning for the AI Era: Wiz’s Agentic Code Security System

The recent leap in model capabilities for security has fundamentally changed what is possible in application security. AI is highly capable at uncovering complex flaws that evade traditional scanners, pentests, and even experienced human reviewers. For security teams, however, the question is no longer whether to use AI, but how to make it part of an application security program that continuously protects applications at enterprise scale, instead of producing one-off scans that become stale as soon as code changes. Earlier this week, we shared results from Wiz Atlas, our AI vulnerability research system that achieved a 90.8% success rate on CyberGym and uncovered more than 200 previously unknown vulnerabilities. Atlas demonstrated what's now possible when frontier AI models are applied to vulnerability research. It also reinforced an important lesson: an effective enterprise AI application security program requires much more than a powerful model or a single scanner. It requires a system. In the rest of this post, we’ll explore how we think about AI-powered application security as a layered system, why different layers require different capabilities, and how they work together to balance speed, cost, and depth. We’ll then explain how we’re applying these principles as we build Wiz’s solution…