The Closed Loop Remediation Playbook with Wiz

As response windows shrink due to AI-powered exploitation, security teams need to get three historically difficult challenges right: discovering risk, prioritizing it, and fixing it before it's exploited. The last has always been the hardest, and it's an exponential challenge in the AI era. The Hugging Face incident in July 2026 gave a preview of what remediation needs to keep pace with: an autonomous AI agent exploited zero-day vulnerabilities, harvested credentials, and escalated privileges, chaining each step to move laterally from a sandboxed environment into production Kubernetes clusters. Over 4 days, it performed 17k+ actions without a human directing it. It’s never been more crucial to build towards self-healing and fix as fast as we break, however three dynamics due to AI is making that harder: Ownership is unclear as more teams build with AI. Vibe coding has enabled anyone to become a builder, but that doesn't map to security ownership patterns when risks are discovered. Legacy SLAs no longer apply. The 2026 Verizon DBIR reports unpatched vulnerabilities are the #1 attack vector, with a median 47 days to patch. Those timelines can’t hold when AI weaponizes vulnerabilities in hours. More attack paths qualify as critical. AI-powered attacks are more sophisticated, chaining together isolated lower-severity findings to form critical attack paths faster than teams can remediate. Organizations need an always-on, automated remediation with full environmental context to remediate at the speed of AI-powered discovery. Wiz delivers the playbook for closed loop remediation: a continuous cycle that takes validated risk from the Red Agent, provides remediation guidance from the Green Agent, and executes a verifiable fix with Remediation and Response (now public preview) and Wiz Workflows (now GA) at scale. Step 1: Proactively Uncover Validated Risk with Red Agent The Hugging Face incident reinforced a critical lesson: organizations need to continuously discover and attack their own environments before adversaries do, and detect exploitable attack paths, not just vulnerabilities, to understand how an AI attacker can chain risks for lateral movement. Risks don't exist in isolation. A vulnerable package connected to a publicly exposed workload with access to sensitive data isn't three separate findings, it's a critical attack path. The Wiz Security Graph maps these toxic combinations, leveraging the Red Agent as the AI attacker to uncover the risk and validate exploitability. Closed loop remediation starts with knowing what to fix first and the impact of the risk, giving teams a starting point for fighting AI with AI and breaking those attack paths before an attacker can exploit it. Step 2: Investigate and Plan the Fix with Green Agent Once you have the attack path, teams need to break it just as fast. That starts with understanding the root cause, who can fix it, and what’s the right remediation path. Wiz resolves ownership by correlating resource tags, cloud logs, CMDB data, code commit history, Service Catalog mappings, and Project ownership to route Issues to the person who can act. That context flows directly into the Green Agent, which investigates the Issue end-to-end by leveraging the Security Graph, historical remediation patterns, and Skills from CodeMender to trace risks back to source code and generate a context-aware, layer-appropriate fix. That fix surfaces as a one-click remediation action execution, a handoff to a coding agent, or a pull request in the developer's repository. The Green Agent meets Red Agent finding with a ready-to-execute fix, using AI against AI so teams can move at the speed AI threats demand. Green Agent helps us with triage and remediation explanations. It's not just putting a ticket saying 'your Kubernetes is publicly exposed.' Green Agent explains the full context: you have a pod running like that, you don't have runtime security, you are running end-of-life technology. All the remediation paths are really clear. Roy Weiss, Principal DevSecOps, Fireblocks Step 3: Take Immediate Action with Remediation and Response Teams can immediately execute Green Agent’s plan with Remediation and Response, now in public preview. With a centralized catalog of pre-built Response Actions, and the flexibility to create custom actions, teams can pre-deploy actions in their cloud environment so Green Agent will surface applicable deployed actions for one-click execution alongside its remediation plan. To move at machine speed, teams need to shift away from manual runbooks and custom scripting. Remediation and Response gives teams a governed, controlled way to implement fixes, with revertible actions, managed versions, and least-privilege access to execute confidently. Step 4: Orchestrate Response at Scale with Wiz Workflows Wiz Workflows, now GA, turns these fixes into repeatable, automated processes across the entire remediation lifecycle. As a centralized control plane, teams can chain together Wiz AI agents, Remediation and Response actions, and WIN integrations into multi-step workflows that execute response at scale. For example, a workflow can be customized to trigger when a new Issue is identified - filtered by severity, environment, subscription, resource type, and more - or scheduled to run on a recurring basis. From there, it orchestrates the full response. It can pull in Green Agent’s remediation analysis, route to the right owner in Slack for approval, and execute a response action once approval is received, verifying resolution from the next scan. Teams can define the logic once, or leverage our pre-built templates, and tailor it to the tools and processes to fit their organization. Workflows is the orchestration engine for closed-loop remediation, connecting every stage from detection to verified resolution to enable teams to build towards a self-healing cloud, with remediation that runs continuously as soon as risk is discovered. Step 5: Track Actionability and Outcomes A self-healing cloud requires visibility into what efforts are working and where to focus next. Wiz tracks actionability: Issues with Green Agent analysis ready, Red Agent Issues that need attention, critical Issues with owners assigned, and more so teams can quickly begin acting. As teams fix, Wiz also tracks outcomes: MTTR trends, response actions applied, Issues resolved, and Issues opened so teams can measure if they’re closing the gap faster than it grows. Security teams have the data at their fingertips to report progress to leadership and continuously refine the remediation process. The Wiz Remediation Playbook in Action Across every layer of autonomy, Workflows provides the flexibility to orchestrate always-on remediation tailored to your business’s processes and policies. Human-Led: A Workflow is configured to trigger on new Issues with privilege escalation risks impacting production workloads. It sends a Slack message to the security team with Mika AI’s risk analysis of the Issue, and the team chooses to create a Jira ticket to investigate later or creates an approval request to update the Issue status. Human-in-the-Loop: A Workflow triggers on new critical Issues impacting an active EC2 instance with access to sensitive data. It pulls Green Agent’s analysis, shares it with a developer for review, and once approved, executes a response action to revoke the attached IAM’s role excessive permissions. Otherwise when rejected, creates a Jira ticket for the developer to investigate. AI-Led: A Workflow triggers on low-severity Issues in the backlog across an internal tools subscription. It pulls Green Agent's analysis, assigns it to the code author, and opens a PR if Green Agent's verdict is to remediate. Teams start where they're comfortable and move the slider as confidence builds. Whether human-in-the-loop or with AI-led, closed-loop remediation gives teams the foundation to move faster, reduce exposure continuously, and build toward a self-healing cloud. What’s Next: Preventing Risk at the Source The Hugging Face incident validated the urgency of the threat landscape. Closed-loop remediation is how teams fight AI with AI, using AI for detection and resolution with Wiz AI Agents and platform capabilities operating in sync. That gets organizations on a path to resolve risk as fast as it’s discovered. The next step is making sure that risk never reaches production in the first place. In Part 2, we'll cover how Wiz embeds into development workflows to prevent issues from reaching the cloud.