Full Report
New initiative partners with under-resourced organizations to uncover, remediate exploitable risk at scale.
Analysis Summary
# Industry News: Wiz Launches "Scan for Good" to Shield Critical Infrastructure with AI
## Summary
Cloud security leader Wiz has announced **Scan for Good**, a new initiative designed to proactively identify and remediate exploitable risks in under-resourced organizations, including nonprofits and critical infrastructure. Partnering with **Google DeepMind** and collaborating with **CISA**, the program leverages Wiz’s AI-powered "Red Agent" to uncover complex attack paths that traditional scanners often miss.
## Key Details
- **Date:** September 24, 2026
- **Companies Involved:** Wiz (Lead), Google DeepMind (Partner), CISA (Collaborator/Guidance)
- **Category:** Social Responsibility / Strategic Partnership / Product Expansion (AI Security)
## The Story
As offensive AI capabilities lower the barrier for threat actors to discover vulnerabilities, Wiz is positioning itself as a "defender-first" innovator. The "Scan for Good" initiative uses the **Wiz Red Agent**—a context-aware, AI-driven pentesting tool—to scan public-facing assets of organizations that lack the budget for high-end security operations.
The initiative focuses on "attack path" discovery rather than simple CVE scanning. It identifies how benign configurations, permissions, and identities can be chained together to create critical exposures. By partnering with Google DeepMind, Wiz utilizes the **Gemini 3.8 Flash Cyber** model to scale these investigations, while CISA provides strategic alignment with national cybersecurity resilience goals. Early results have already led to the remediation of hundreds of high-priority exposures.
## Business Impact
### For the Companies Involved
- **Wiz:** Solidifies its reputation as a mission-driven leader in the AI security space and gains valuable real-world data to refine its Red Agent AI.
- **Google DeepMind:** Demonstrates the practical, defensive utility of Gemini Cyber models in a high-stakes, real-world environment.
### For Competitors
- **Increased Pressure:** Competitors in the Vulnerability Management and CSPM (Cloud Security Posture Management) space must now justify their value proposition against AI-driven, autonomous pentesting capabilities.
- **Brand Differentiation:** Wiz is setting a high bar for "corporate social responsibility" that doubles as a powerful marketing engine for their technical capabilities.
### For Customers
- **Indirect Benefits:** Commercial Wiz customers will likely see faster improvements in the Red Agent product as it learns from the diverse environments scanned during this initiative.
- **Under-resourced Entities:** Nonprofits and public services gain access to elite-level security research and tooling at no cost.
### For the Market
- **Shift to Autonomous Defense:** The move signals a broader market trend where manual security audits are being replaced by continuous, AI-led autonomous testing.
- **Public-Private Synergy:** Reinforces the model of private tech firms working alongside government agencies (CISA) to secure national interests.
## Technical Implications
The initiative highlights the shift from **Static Analysis** to **Contextual Analysis**. By using AI to understand "Agent Intent" and chainable weaknesses, Wiz is moving beyond signature-based detection. The use of Gemini 3.8 Flash Cyber suggests a need for high-speed, low-latency AI inference to scan the vast breadth of the public internet effectively.
## Strategic Analysis
- **Market Positioning:** Wiz is pivoting from being a "dashboard for cloud risks" to an "active defender" that prevents breaches before they occur.
- **Competitive Advantage:** Early access to Google’s specialized cyber-AI models gives Wiz a significant lead in the "AI vs. AI" security arms race.
- **Challenges:** Managing responsible disclosure at scale is difficult; Wiz must ensure their scanning does not inadvertently disrupt the fragile systems they aim to protect.
## Industry Reactions
- **CISA (Nick Andersen):** Emphasized that this aligns with Executive Order 14409, viewing it as a vital step in strengthening digital infrastructure.
- **Google DeepMind (Raluca Ada Popa):** Highlighted the project as a way to "advantage defenders over attackers" globally.
## Future Outlook
- **Predictive Remediation:** Expect Wiz to eventually automate not just the *discovery* but the *fix* (auto-remediation) for these organizations.
- **Global Scaling:** While currently focused on public-interest organizations, this "scan-at-scale" model will likely become the standard for enterprise-level proactive defense within the next 12–18 months.
## For Security Professionals
Practitioners should note the evolution of the "Red Agent." The era of relying solely on periodic manual pentests is ending. Security teams should begin evaluating how AI-driven autonomous testing can be integrated into their own CI/CD pipelines and external attack surface management (EASM) strategies.