Wiz Attack Paths & Toxic Combinations in CNAPP

① What a toxic combination actually is — four conditions, one critical path

A toxic combination in Wiz is a chain of findings on the same cloud resource where all four risk factors are present simultaneously: the resource is publicly exposed, it carries a critical or high-severity vulnerability, it runs under an over-privileged identity, and it has a path to sensitive data. Remove any one factor and the path collapses to low-risk.

The insight Wiz is built on: risk is combinatorial, not additive. A critical CVE alone scores high on paper but low in practice if the instance is internal and unprivileged. Public exposure alone matters only if an attacker can do something useful once inside. Privilege alone is interesting only if data worth reaching exists. The Security Graph is the engine that finds the intersections — in real time, without agents.

② The Wiz Security Graph — how risk chains are modelled

Wiz uses an agentless Security Graph — a continuously updated, relationship-aware map of every resource, identity, workload, data store, network connection, vulnerability and security finding across a cloud environment. Instead of a flat list of alerts, the graph stores edges between nodes: this EC2 instance is reachable from the internet; this role is attached to that instance; that role can read this S3 bucket; that bucket contains PII data — all traversable in a single query.

Why graph matters for attack paths

Graph traversal lets Wiz answer the question an attacker would ask: starting from the internet, which chain of steps leads to sensitive data? The engine prunes paths that are theoretically possible but blocked by a compensating control, and surfaces only validated, exploitable attack paths. A typical large cloud environment might generate tens of thousands of individual findings; the Security Graph collapses those to dozens of genuinely critical toxic combinations.

③ Prioritizing attack paths — what to fix first and why

Wiz assigns each attack path a risk score that weighs the severity of the vulnerability, the reachability of the resource (internet-facing vs internal), the blast radius of the attached identity (can it admin your whole cloud?), and the sensitivity of the data at the end of the path. Paths that score in the critical band are surfaced as Issue cards in the Wiz console and can be routed to Jira, ServiceNow, Slack, or PagerDuty automatically.

The prioritization heuristic: fix the shortest path to the most sensitive data first. A one-hop path (internet ▸ vulnerable instance with DB credentials) beats a three-hop path even if the three-hop path has a higher CVSS score on one of its nodes. Wiz also lets you tag resources as critical assets (crown jewels), so any path leading to them is automatically elevated regardless of intermediate scores.

④ Attack-path queries and breaking the toxic chain

Wiz exposes its graph through a query language accessible in the Security Graph Explorer. A typical toxic-combination query filters for resources that are publicly exposed AND have a critical or high CVE AND run under an identity with write access to a sensitive data store. Wiz ships built-in query templates for the most common toxic-combination patterns — internet-facing-VM-with-crit-vuln-and-privileged-role is one click.

Breaking the chain — remediation that works

You do not need to fix all four conditions to eliminate the path. Breaking any single link collapses the toxic combination. The fastest mitigations in order of typical speed: (1) remove public exposure — tighten the security-group rule or move the load balancer behind a WAF; (2) revoke excess privilege — scope the IAM role to least-privilege; (3) patch or virtually patch the CVE — apply the vendor fix or add a WAF rule; (4) restrict data access — add a bucket policy or data-perimeter control. After any of these, re-run the query in Wiz — the attack path should disappear from the critical list.