Question 1

What is Wiz + AI remediation?

Accepted Answer

Wiz + AI remediation is the pattern of taking the cloud-security findings Wiz surfaces and having an AI agent close them end-to-end — not just re-listing them. CloudThinker delivers this through Oliver and its AppSec module: they ingest each Wiz finding, run the DARV loop (Detect, Analyze, Remediate, Verify), and ship the fix as a merge request or a sandboxed runbook under your team's policy. Wiz tells you what's exposed; CloudThinker proves it, fixes it, and verifies the fix.

Question 2

How does CloudThinker connect to Wiz?

Accepted Answer

CloudThinker reads your Wiz findings through a scoped connection and treats each one as the Detect input to the DARV loop. It correlates the finding against your live cloud, Kubernetes, and source — the same environments Wiz already has context on — so remediation targets the real resource, not a guess. Credentials to touch those environments are brokered per task and never handed to the model.

Question 3

Is it safe to let an agent remediate Wiz findings automatically?

Accepted Answer

Yes — autonomy is graduated and governed. Every remediation skill runs under graduated autonomy (L1–L4): the agent starts read-only, proposing fixes, and earns broader scope one skill at a time. Credentials are brokered per task, execution is sandboxed, sensitive data is tokenized deterministically at egress, and every action lands in a tamper-evident audit log. Production stays behind an approval gate your engineers set per environment — nothing ships autonomously until a skill has earned it.

Question 4

How is this different from Wiz auto-remediation?

Accepted Answer

Native auto-remediation and workflow rules fire a pre-written script when a finding matches a condition — open-loop, with no verification that the fix actually closed the exposure. CloudThinker runs a closed loop: it analyzes the specific finding, reasons about blast radius, drafts the fix as a reviewable merge request or runbook, and then re-runs the check to confirm the finding is gone — rolling back if it isn't. It reasons over novel findings instead of only matching the ones someone already scripted. TODO(steve): verify current Wiz native auto-remediation capabilities and wording.

Question 5

Does it replace Wiz?

Accepted Answer

No — it composes on top of Wiz. Wiz stays your cloud-security posture and detection layer. CloudThinker becomes the remediation layer that acts on the findings Wiz produces, closing the loop from exposure to verified fix. Teams keep their existing Wiz investment and add autonomous, audited remediation on top.

Question 6

What do I get after each remediation run?

Accepted Answer

For every Wiz finding it works, you get: a verified analysis of exploitability and blast radius; the fix drafted as a merge request or executed as a sandboxed runbook under your approval gate; an automatic retest confirming the finding is closed; and a tamper-evident audit record of every action. Recurring finding shapes get faster each pass because the loop is recorded.

Wiz + AI remediation that closes the finding, not just the ticket.