Scan for Good: Using AI to discover and fix high-priority exposures across public services and critical infrastructure

What it is

Scan for Good is Wiz's program of AI-driven, human-validated testing of public-facing websites, APIs and applications. It uses the Wiz Red Agent and Gemini models from Google DeepMind. A September 30, 2026 update says it now runs Gemini 4 Argon alongside Gemini 3.8 Flash Cyber. CISA is named as a collaborator. Wiz says hundreds of exposures have been fixed so far.

Preconditions / Affected

Wiz tests only where authorization exists. That means either the organization has a bug bounty program or an established vulnerability disclosure policy, or it has given explicit authorization. Priority goes to public services, critical infrastructure, nonprofits, open-source projects and under-resourced organizations.

What to do

• If you run an in-scope organization and are worried about an exposed service, apply for an assessment at wiz.io/scan-for-good/apply.
• If you own public-facing systems, publishing a VDP or bug bounty is the page's stated authorization route for being tested.
• Check your own estate for the patterns the page cites as escalating quickly from a small public signal: a forgotten route, a missing permission check, an exposed credential.

Findings the summary does not list:

• Public hospital: missing access controls exposed staff contact details and gave anyone online control of a hospital-wide mobile alert channel.
• Municipality: a public data service exposed personal, health and financial data on about 5,000 elderly residents.
• Rail operator: a leaked production database exposed active administrator sessions, which allowed control of routes, schedules, announcements and admin accounts.
• Commerce platform: a zero-day in a shared payments service exposed names, card brands, expiry dates and partial card numbers across multiple stores.
• Cloud provider: a credential in public website code could have been used to publish malicious software across more than 500 production container images behind a flagship AI service. Wiz proved the reach without changing an image.

The CI/CD finding has a published case study, with the first part available.

Caveats

• Findings are anonymized, and the page gives no CVEs, payloads or detection queries. The detailed pattern research is promised only after remediation.
• No detection rates or false-positive figures are given. Model-generated hypotheses are not treated as vulnerabilities, and a human researcher validates every finding.
• The page is a vendor announcement. The "hundreds fixed" and "thousands of high and critical exposures" figures are Wiz's own claims.