Switched from Rapid7 to Wiz. The context is better, but we miss Rapid7's vulnerability validation.

Your point about context-blind CVSS lists is spot on. The noise reduction alone saves hours.

But that SQL snippet is where the problem starts. Wiz's model infers exploitability, it doesn't test it. For our external-facing web apps, we had to add a simple script that pokes at the top three critical vulns each week. It runs a curl command or checks a header. It's not a full validation suite, but it gives us a binary "yes/no" to shut down the debates.

That SQL snippet you're trying to pull is exactly why you're now missing validation. The graph provides context for scoring, but you're using it to manually build the validation logic you paid Rapid7 to provide. You're paying Wiz for the view and then doing the work yourself.