Wiz Integration (Code & Cloud)
Learn how to integrate Wiz with Sprinto to automatically import vulnerability findings from your cloud environment and codebase, track remediation against SLAs, and collect audit-ready evidence for vulnerability management controls.
Wiz is a cloud security platform that scans your cloud infrastructure, workloads, and source code to surface security risks such as misconfigurations, exposed secrets, insecure dependencies, and exploitable vulnerabilities.
Sprinto supports two Wiz vulnerability sources:
Wiz Cloud – imports cloud and workload vulnerability findings (CSPM / cloud vulnerability management).
Wiz Code – imports code and application-layer vulnerability findings (SAST, software composition analysis, secrets, IaC).
Integrating Wiz with Sprinto allows Sprinto to continuously pull these findings and evaluate them against your vulnerability-management controls, so that detected vulnerabilities are tracked and resolved within your defined Service Level Agreement (SLA).
Beta
The Wiz Code and Wiz Cloud vulnerability integrations are currently in Beta and are enabled on request. If you do not see Wiz listed as a vulnerability source in your account, contact Sprinto Support to have it enabled.
Sprinto checks for Wiz
Below are the available Sprinto checks for the Wiz vulnerability sources:
Sprinto check
Reference procedure
Wiz Cloud vulnerability alert should be resolved within SLA
Wiz Code vulnerability alert should be resolved within SLA
These checks activate when Sprinto detects an open vulnerability on your connected Wiz account. To fix a check, resolve (or dismiss, where justified) the finding at the source in Wiz — the check passes automatically on the next sync once the finding is no longer open.
How It Works
Wiz is connected to Sprinto through Leen, Sprinto's security-integration aggregator. Leen brokers the authenticated connection to the Wiz API on Sprinto's behalf, so you authorise once and Sprinto pulls findings on a recurring schedule. For more on how Sprinto handles data through aggregators, see Trust and Data Handling in Integration Aggregators.
What Sprinto imports
Wiz Cloud — vulnerability and security findings detected across your connected cloud accounts and workloads in Wiz.
Wiz Code — vulnerability findings detected across your repositories and application code in Wiz (dependencies, secrets, IaC, and code issues).
For each finding, Sprinto imports the metadata needed for compliance tracking — identifier, title, severity, affected asset/resource, status, and detection/resolution timestamps. Source code is never accessed or stored.
Vulnerability Monitoring
Imports open vulnerability findings from Wiz Cloud and Wiz Code.
Maps each finding to your vulnerability-management controls.
Tracks remediation timelines against your configured SLA by severity.
Automatically closes the corresponding Sprinto task once a finding is resolved at the source.
Sync Behaviour
The initial sync typically completes within 15–20 minutes of connecting.
Sprinto may take a few hours to finish evaluating the synced data and activate the relevant checks.
Thereafter, Wiz vulnerability data syncs periodically (typically every 6–12 hours).
Connection Type
Wiz Cloud and Wiz Code are pull-based integrations — Sprinto retrieves data from Wiz using the credentials you provide. There is no agent or pipeline job to install.
Permissions and Data Access
Sprinto connects to Wiz using a Wiz Service Account with OAuth 2.0 client credentials.
Permissions Required
Create a Service Account in Wiz with read-only scopes sufficient to retrieve findings, at a minimum:
read:issues – read security issues/findings.
read:vulnerabilities – read vulnerability data.
read:reports – read reports (and create:reports if your configuration generates reports via the Wiz API).
Data Collected
Sprinto only collects metadata required for compliance:
Vulnerability and issue findings (identifier, title, description).
Severity and status.
Affected asset, resource, or repository reference.
Detection and resolution timestamps.
Sprinto does not access or store your source code. All data is transmitted securely over HTTPS, and credentials are encrypted at rest.
Prerequisites
Before connecting Wiz to Sprinto, ensure:
You are logged in to Sprinto as an administrator.
You have administrator access to your Wiz tenant and can create Service Accounts in Wiz.
The Wiz integration (Beta) is enabled on your Sprinto account — contact Sprinto Support if it is not yet visible.
You know your Wiz API endpoint / region (for example, https://api.us.app.wiz.io/graphql). This can be confirmed under Tenant Info or User Settings in Wiz.
How to Integrate Wiz with Sprinto
Generate Wiz Service Account credentials
Log in to your Wiz portal.
Navigate to Settings > Access Management > Service Accounts.
Click Add Service Account.
Provide a name — for example, Sprinto Vulnerability Integration.
Assign the required read scopes (read:issues, read:vulnerabilities, read:reports).
Click Add Service Account.
Immediately copy and securely store the:
Client ID
Client Secret (shown only once)
Note your Wiz API endpoint URL (region-specific).
Important
The Client Secret is shown only once at creation. Copy it before closing the dialog. If it is lost, you will need to regenerate the secret and reconnect in Sprinto.
Connect Wiz in Sprinto
Log in to the Sprinto dashboard.
Navigate to Data Library > Vulnerabilities.
Click Add Vulnerability Source (or Set up monitoring source).
Select the Wiz source you want to connect — Wiz Cloud or Wiz Code.
Review the supported checks, permissions, and data used by Sprinto, then click Next.
Authorize and complete the connection
On the setup screen, enter your Wiz connection details:
Client ID
Client Secret
API Endpoint URL / Region (often pre-filled with the default regional endpoint)
Click Connect.
Once validated, the integration is marked as Connected and the credential status displays as Active.
Post-Connection Configuration
After connecting, Sprinto begins importing findings and activating checks.
Initial Sync
Initial sync typically completes within 15–20 minutes.
Sprinto may take a few hours to evaluate the synced data and activate the relevant checks.
Configure the Vulnerability SLA
Go to Data Library > Vulnerabilities and configure your SLA by severity (for example, Critical within 7 days, High within 30 days).
The "resolved within SLA" checks evaluate Wiz findings against these timelines.
Review Imported Findings
Navigate to Data Library > Vulnerabilities.
Click Wiz Cloud or Wiz Code to review imported findings and the status of each Sprinto check.
Resolving and Dismissing Findings
Resolve at the source: fix the vulnerability in Wiz. On the next sync, the finding closes in Sprinto and the task passes automatically.
Not applicable: if a finding does not apply to your scope, mark it as a special case in Sprinto with a justification. See Mark Vulnerabilities as Special Cases.
Troubleshooting
Connection or credential shows as inactive
Verify that the Client ID and Client Secret were copied correctly and the secret was not regenerated after creation.
Confirm the API endpoint matches your Wiz region.
Confirm the Service Account still exists and retains the required scopes.
No findings appear after connecting
Allow the full initial sync and evaluation window (up to a few hours).
Confirm the Service Account has all required read scopes.
Verify that Wiz is actually reporting open findings for the connected scope (cloud accounts for Wiz Cloud, repositories for Wiz Code).
API authentication errors (e.g. 401)
The credentials have expired or been revoked in Wiz. Regenerate the Client Secret in Wiz and reconnect the source in Sprinto.
Re-confirm the regional API endpoint.
A resolved vulnerability still shows as open in Sprinto
Confirm the finding is closed/resolved at the source in Wiz.
Wait for the next sync cycle — the check updates automatically once Wiz reports the finding as no longer open.
Support
Please contact Sprinto Support if you have any queries related to the integration or need any assistance.
Last updated