Start Secure in the AI Era: Accelerating AI Threat Readiness with WizOS

Frontier AI models like Anthropic’s Mythos can now autonomously find vulnerabilities and generate working exploits. The gap between disclosure and active exploitation is shrinking, and security programs built around weeks of response time are being stress-tested by a world where that window can be days or hours. 

In this environment, two things matter more than ever: how much vulnerable surface area you are carrying into production, and how fast you can respond when something needs to be fixed. Container base images are a significant and often underestimated factor in both. According to Wiz research, base images account for 39% of critical and high severity CVE findings on production containers. Base images pulled from public repositories frequently carry unnecessary packages and unpatched CVEs, putting the burden on development teams to understand and apply patches in code they didn’t write. Image choice matters: choosing images that are minimal, secure, and continuously patched can keep you a step ahead of AI-driven exploitation.

In our recently published framework for AI threat readiness, we recommend that organizations standardize on hardened components and base images to reduce constant patching. WizOS container images provide this minimal, hardened, continuously patched base. In this post, we go deeper on recent updates to WizOS, and outline how organizations can adopt and operationalize WizOS to support AI threat readiness.

How Hardened Images Support AI Threat Readiness

Preparing for AI-driven exploits requires working across the full picture: reducing what can be attacked, preventing new vulnerabilities by preserving supply chain integrity, and responding faster when a vulnerability does emerge. Using hardened images like WizOS helps with all three.

Minimize the Application Attack Surface

Hardened images minimize the application attack surface by minimizing both CVEs and reducing the container footprint to only the packages and components that are essential at runtime. Wiz research tested WizOS images against equivalent open source image variants and found a 94% median reduction in CVEs, 48% average reduction in image size, and 48% average reduction in package count. WizOS images are continuously maintained by Wiz at near-zero CVEs, to prevent introducing new vulnerabilities to your containers. WizOS supports a secured package repository, allowing developers to customize images with additional packages while maintaining a strong security posture.

Wiz maintains SLAs for CVE remediation in WizOS images: 7 days for critical CVEs and 14 days for high and medium. Images are patched quickly without requiring action from your team. You can set up a pull-through cache or mirroring pipeline from the WizOS container registry to your own private artifact registry. When new images are released, simply update your manifest to reference the new patched version, or trigger your CI pipeline on a daily basis to automate the process. 

Mitigate Supply Chain Risk

As AI lowers the barrier for supply chain exploitation, maintaining the integrity of software components is critical. In the past year, supply chain attacks have repeatedly targeted the open source ecosystem through compromising CI/CD systems such as Github Actions to inject malware into OSS components. Supply chain risk can never be mitigated 100%, but understanding and verifying the provenance of components in your supply chain is a recommended hedge. 

WizOS works to mitigate supply chain risk in a few ways:

• Building from source: WizOS images are built directly from source code in a hardened, build pipeline. This process prevents inherited risk from pre-built upstream artifacts.

• Hardened and isolated build pipeline: WizOS images are built in a specialized pipeline that is hardened with strict security and access controls, and isolated with no connectivity to the internet.

• Provenance: WizOS images are rebuilt daily and every build is signed with verifiable cryptographic provenance. 

Accelerate Response (MTTR)

When vulnerabilities reach production, speed is the primary defense against shrinking exploitation windows. Wiz identifies and prioritizes CVEs that are exposed and exploitable so teams can ensure actual risks are remediated immediately, without wasting valuable time on instances that are unreachable. Wiz further accelerates remediation efforts through the Wiz Green Agent, which leverages the Wiz security graph and code-to-cloud traceability to provide step by step remediation guidance. Green agent recommendations can be sent directly to coding agents as issues for expedited implementation.

In the context of container images, this reduces mean time to respond (MTTR) to critical issues on container images. Teams can immediately identify exposed risks, view an automatically generated remediation plan that suggests a WizOS image that will remediate the issue, and hand the fix off to an AI coding agent for seamless migration. 

How to Operationalize WizOS for AI Readiness Today

We have introduced three new capabilities to help teams adopt and operationalize WizOS images: planning where to start, executing swaps, and responding to critical findings.

Secure Architecture Opportunities: A clearer starting point for migration

Most environments have many image types in active use, and without a structured view of where risk is concentrated, it is hard to know where migration will have the most impact. Secure Architecture Opportunities is a new page within Findings in Wiz that groups WizOS migration opportunities by image type, such as Python or nginx. For each group, you can see associated vulnerabilities, related security issues, and estimated effort to complete the swap, giving teams a risk-ordered starting point rather than a flat inventory to work through.

WizOS Migration Skill: Execute image swaps with your AI coding agent

The WizOS Migration Skill makes it straightforward to act on migration opportunities without leaving your development environment. Within your AI coding agent, the skill surfaces the appropriate WizOS image based on the context in your dockerfile and can apply the swap directly, particularly useful when migrating to address a critical vulnerability quickly.

WizOS and Wiz Green Agent: Faster MTTR for critical container image findings

If a CVE is identified in a container image and a fix is available through WizOS, the Wiz Green Agent now includes WizOS as part of its remediation guidance. Green agent provides the specific WizOS image to use. By clicking Send to Coding Agent, Wiz automatically opens a repository issue, tags your AI coding agent, and passes the full context. The coding agent can then apply the swap via a new WizOS migration skill. This closes the loop between the security finding and the engineering fix, lowering mean time to remediate (MTTR).

What’s Next

WizOS image coverage continues to expand, with new application and runtime images added regularly. Customers can submit requests for additional image support in the Secured Image Catalog and track upcoming additions via the Wiz Roadmap Tracker. We are also working to extend coverage to the broader development supply chain with more exciting news to come later this summer. 

Get Started

Secure Architecture Opportunities is now available in public preview. The WizOS Migration Skill, and WizOS recommendations in the Wiz Green Agent are GA. To enable WizOS, visit Settings and follow the Quickstart Guide. Not yet a Wiz customer? Request a demo.