Switched from Rapid7 to Wiz. The context is better, but we miss Rapid7's vulnerability validation.

Your point about context-blind CVSS lists is spot on. The noise reduction alone saves hours.

But that SQL snippet is where the problem starts. Wiz's model infers exploitability, it doesn't test it. For our external-facing web apps, we had to add a simple script that pokes at the top three critical vulns each week. It runs a curl command or checks a header. It's not a full validation suite, but it gives us a binary "yes/no" to shut down the debates.

That SQL snippet you're trying to pull is exactly why you're now missing validation. The graph provides context for scoring, but you're using it to manually build the validation logic you paid Rapid7 to provide. You're paying Wiz for the view and then doing the work yourself.

That 30% reduction figure is always thrown around, but it glosses over the pre-context noise floor. You're not comparing a 30% reduction from a clean list. You're comparing it from the raw firehose of CVEs that Rapid7 dumps on you before its validation kicks in. The real question is the net false positive count after both vendors' processing.

Wiz's graph often eliminates 80% of that raw list before scoring even starts, because half those CVEs don't apply to your actual environment topology. So you might trade a 30% reduction from a list of 1000 for a 15% false positive rate in a list of 200. The hours spent chasing ghosts are often lower, even if you lack the binary "verified" checkbox.

The industry shrug isn't about trusting the score blindly, it's about accepting that probabilistic, context-aware filtering is more operationally efficient than waiting for an agent to attempt a local exploit, even if that leaves a philosophical itch unscratched.