The alpha, twice a week
That was 5 min.
Get the best new moments in your inbox every Wednesday and Saturday. It's free.
Check your inbox
We sent a link to your address. Click it to finish signing up. Not there in a minute? Look in spam.
or
Sabrina Halper Show · 5 min · Oct 7, 2026
Wiz Atlas makes vulnerability research repeatable
Yinon Costica
Co-founder, Wiz
Co-founded Wiz, the cloud security company Google bought for $32 billion, and leads its product organization.
Sabrina HalperHost · Host, Sabrina Halper Show
Has worked as an investor at HOF Capital and founded SHS Media.
About this segment
Atlas breaks vulnerability research into specialized tasks and models, then chains them to validate findings. It found hundreds of vulnerabilities in heavily audited open-source projects, expanding research beyond scarce experts.
From “Google’s $32B Bet on Cybersecurity in the AI vs. AI Era | Wiz Co-Founder Yinon Costica”, Oct 7, 2026. Watch the full episode
Thanks. We'll look at and fix what's off.
“Maybe now, in a way, I don't need to be a vulnerability researcher to do vulnerability research.”
Takeaways
- Atlas splits research into code analysis, discovery, exploitation and validation.
- Different models handle different tasks in the research sequence.
- AI-assisted bounty research helped reveal the opportunity for an autonomous system.
In this episode
Full episode- 8:44Wiz followed customer pain instead of its original idea5:17
17:47Wiz Atlas makes vulnerability research repeatable5:06
- 38:32AI can give defenders a compounding advantage5:00Up next
- 5 more moments in the full episode
Transcript
Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.
- 17:54
are less familiar there is this maybe the the holy grail is a something called a vulnerability right because that a vulnerability allows you to move from one zone to another zone without the permission to do so okay so it's like it's like magic of cyber and vulnerability research has been one of these very very exclusive areas of research that very few were basically part of and the thing about AI is that it enabled the automation process of vulnerability research which is for for you know cyber professionals it's it's it's a holy grail automated and I think that with Atlas is basically so up until with Atlas I think the general modus operandi where was okay let's take a model and let's run it on you know on code and try to find vulnerabilities that sometimes work and but what with Atlas is doing is actually breaking down the vulnerability research process to specific tasks
- 19:08
like analyzing the code, trying to find the vulnerability, the entry points, trying to exploit them and validate them. So there is a whole chain of a sequence of tasks that are automated. By the way, each one is using a different model to do so. So the best model for the task. And then when we combine them into one system, then we found out that it can find vulnerabilities in a way better than what humans can do we found it we ran it on a heavily audited open source repositories and was able to find hundreds of vulnerabilities that were were there all of the time but you know we couldn't see them until with atlas came so i think that this unlock so you're asking about what what it means it means that now we have a system that it can replicate what very very few humans could have done until now and it unlocks
- 20:07
obviously speed we can do it in you know minutes hours rather than months years second it unlocked the scale because i can run multiple scans at the same time across many repositories unlike humans that can you know a human can only scan one repo at a time and the last thing it unlocked expertise Maybe now, in a way, I don't need to be a vulnerability researcher to do vulnerability research. I can have a system that does it for me, which is something that was, you know, a year ago.
- 20:40
I don't think many would have said, OK, yeah, this is the first problem I will solve in cyber that was really looked at as a holy grail. But here it is. Are you able to share any examples of anything that WizAtlas found that a human just wouldn't have? It's super technical, so I don't know how else to do it. But the open source example is really like the thing about the software. By the way, maybe another story to this.
- 21:11
When we started, why did we start with WizAtlas a year ago? Like we actually attended a conference. It was Black at Europe December last year. And we had this bounty program where we named like 20, 30 technologies that we all use across any application. They're very commonly, they're very known and highly researched for vulnerabilities. And then we did a bounty program where researchers can propose their vulnerabilities.
- 21:43
And we thought we're going to get one, two, three vulnerabilities. We ended up having more than a dozen. And the unique thing that the majority of them were found not using only AI, but assisted by AI. And when the team came back, we realized that there is something that is happening. Maybe not back then full vulnerability research, but we can create an assistive tool that can actually help us accelerate vulnerability research.
- 22:14
So that's when we went on that journey. And we've built that in order to have a vulnerability research team, like the WIS vulnerability research team built with Atlas for their purpose. And over time, we realized that it can actually be an autonomous system that can help defenders. And that's a bit where we got to this aha moment. And yeah, and I think that technology advances very fast, specifically the models, the AI behind it.
- 22:46
So we can only imagine where this would go from here.