> Wiz combines a graph search for asset management with agentless vuln and malware scanning that clones EBS volumes and scans them on their infrastructure. That's a great combo for vuln management, but has some downsides like delays between scans and cloud costs. They have a sensor with solid detection rules, and are okay at a bunch of other stuff like cloud log threat detection and sensitive data detection. They've basically pushed what you can do without an agent to the limit.
Crowdstrike: “you just install a kernel module with ring zero access and we’ll make sure you’re protected”
Wiz: “hold my Red Bull…”
Memory dumps are obnoxiously useful for detecting stealthy malware, especially if you do the memory dumps from the hypervisor instead of from the VM itself.
The hard part is parsing :)
Maybe there are obvious answers to these questions, but if a company is worth $23bn I’d expect that as somebody in the industry, I could answer them without doing in depth research.
This is exactly the kind of gut feeling of “something’s off” that I’ve learned to pay attention to.