Wiz × Surf | Surf AI

Attack paths are found. Closing them is the hard part.

Wiz correlates exposures, vulnerabilities, and identity into the toxic combinations that form genuine attack paths to your most sensitive assets. Finding the path that matters is half the battle.

The other half is operationalizing a fix within an enterprise. Who owns the workload, what are the ripple effects from a change and what could break, which compliance considerations exist, and what systems of record need to be updated. Today, that work is manual, so high-severity paths sit open while new ones stack behind them and the backlog grows.

Wiz finds the path that matters. Surf AI operationalizes the closure at enterprise scale.

What changes

From a growing queue to a backlog that shrinks.

Ownership

Every finding gets an accountable owner

Surf resolves the accountable human for each attack path from identity, HR, code, and on-call context, so nothing waits in an unowned queue.

Closure

Closed and verified, not just ticketed

Surf drives each attack path to a verified fix and writes the outcome back, turning a ticket into a closed, recorded loop.

Backlog

The backlog shrinks and stays down

Recurring issues are fixed at the source and stop coming back, so hygiene improves and holds instead of resetting each cycle.

The Scenario

A critical attack path is live in your cloud.

WizSecurity Graph

Attack pathCritical

Internet-exposed workload on a path to customer data

Wiz correlates four conditions on a single workload into one high-confidence attack path. Each on its own is a finding. Together they are a reachable path to sensitive data.

Attack path

01InternetPublic exposure
02checkout-apiCVE · CVSS 9.8
03Admin roleEffective admin
04customers-dbPII at risk

Resource: checkout-api (container workload)
Environment: prod-us-east-1 · public cloud
Exposure: Internet-facing
Vulnerability: CVE-2024-XXXX · CVSS 9.8
Identity: checkout-api-role · effective admin
Data at risk: customers-db · PII

What happens next is where the two paths diverge.

Two paths

Same attack path. Two outcomes.

Without Surf AI

Backlog grows.

High-severity paths sit open while newer criticals stack behind them.

The risk is visible. Ownership, impact, and change policy are not.

Find the ownerManual
Assess the impactUnclear
Clear the changeBlocked
Escalate and approveAd hoc
Fix and closeReopens

With Surf AI

Backlog shrinks.

Owned, closed, and verified. The paths that matter stay closed.

Wiz discovers the finding. The Context Graph helps operationalize a fix.

Resolve ownershipAutomated
Model and guardModeled
Route to the ownerOne tap
Close and write backVerified

Critical attack path

Critical

checkout-api · WIZ-4471. Public exposure, a critical vulnerability, and effective-admin access, on a path to customers-db (PII).

Surf AI via Wiz · Approve & Remediate

How it works

From finding to verified closure.

Bring in the findings

Ingest

Wiz findings flow into Surf with full context, so every issue enters the loop ready to act on rather than waiting in a queue.

Own it and model it

Resolve

The Context Graph names the accountable owner and models ripple effects, compliance scope, and availability across identity, HR, cloud, code, and IT systems.

Remediate and write back

The owner gets a one-tap action. One approval drives the fix through your change workflow, and Surf writes the verified outcome back to Wiz.

All of it runs inside the Context Graph, a continuously updated knowledge graph that links identity, cloud, code, HR, and IT systems.

Context Graph

Capabilities that turn Wiz findings into closed, owned work.

Subject defragmentation

A person or service is scattered across identity, HR, code, and cloud systems under different handles. The Context Graph resolves them into one subject, so ownership points to a real, accountable human even when the record is stale.

Ripple Effect modeling

Before recommending action, Surf simulates downstream impact across services, entitlements, and data access, so teams know what a fix will and will not break, and which option is safest.

Compliance embedding

Regulated scope, change-approval rules, and policy are properties of every node, resolved alongside ownership rather than chased separately.

Availability awareness

Leave status, on-call schedules, and identity activity determine who can act, not just who is listed as the owner on paper.

Bidirectional lifecycle closure

Surf writes remediation outcomes back to Wiz with action and approver, so the finding becomes a verified closure with a complete audit trail on both sides.

Across domains

One graph, every domain

Because the graph spans identity, HR, ITSM, and SaaS, Surf assigns an accountable owner even when a finding never maps to a cloud asset, the cross-domain reach most remediation tools lack.

Partners

Built together for closed-loop remediation.

About Surf AI

Surf AI is an agentic operations platform that helps enterprises operationalize security programs with AI. By connecting context across identity, cloud, data, HR, and IT systems, Surf closes the gap between understanding risk and acting on it. Surf's AI-native platform uses specialized agents to drive action with human oversight, guardrails, and auditability built in. Surf is backed by Accel, Cyberstarts and Boldstart Ventures, and trusted by global companies including Fortune 500 enterprises.

www.surf.ai

About Wiz

Wiz is a leading cloud security platform that helps organizations secure everything they build and run in the cloud. Built on the agentless Wiz Security Graph, it connects across code, cloud, identities, data, and runtime to correlate risk into the attack paths that matter most. Founded in 2020, Wiz serves more than half of the Fortune 100. As of 2026, Wiz operates as part of Google Cloud while continuing to support every major cloud environment.

www.wiz.io

Wiz and Surf AI

Turn Wiz findings into closed, owned work.

See how Surf gives every finding an owner, a safe path to closure, and a complete audit trail.

Request a demoVisit Wiz

Turn Wiz attack paths into closed, owned remediations.