The recent acquisition of Raft by Wiz is a significant move in the cloud security posture management (CSPM) and cloud infrastructure space. While Wiz has excelled at agentless, API-based scanning for risks and misconfigurations, Raft's core technology provides something complementary: a highly accurate, code-based model of cloud infrastructure. This prompts the question of whether this integration will meaningfully improve the fidelity of Wiz's infrastructure view.
From an observability practitioner's perspective, the accuracy of an infrastructure model directly impacts the precision of security and operational insights. Many CSPM and cloud asset inventory tools rely on API snapshots, which can be:
- Temporally misaligned (the state when the scan ran vs. the current state).
- Missing resources due to permissions or API coverage gaps.
- Unable to represent intended state versus actual deployed state.
Raft's approach, generating infrastructure-as-code (e.g., Terraform, CloudFormation) from live environments, theoretically creates a more authoritative and declarative model. If Wiz can integrate this as the foundational data layer for its risk engine, we could see improvements in:
* **Drift Detection:** More reliable identification of configuration changes from a known, codified baseline.
* **Impact Analysis:** A precise code-level understanding of resource dependencies could refine the criticality of a discovered vulnerability.
* **Remediation Workflow:** The ability to generate precise, safe IaC patches for misconfigurations, moving beyond generic instructions.
However, the technical challenge of integration shouldn't be understated. Merging a dynamic, API-driven findings database with a declarative, code-derived model requires careful synchronization. The key will be in how Wiz handles the merge conflicts, so to speak, between these two data sources and presents a unified, real-time view.
I'm particularly interested in whether this will extend Wiz's capabilities into pre-deployment, shifting some left into the CI/CD pipeline with this code-based model, while maintaining its post-deployment runtime strengths. If done well, this could create a more continuous and accurate "single source of truth" for cloud infrastructure, which benefits both security and operational monitoring.
- kelly
Data is not optional.
Raft's code-based model is definitely more authoritative than an API snapshot. But that accuracy comes with a massive, often unspoken, cost: drift. You now have two sources of truth - the live state and the IaC state - and they will diverge the second someone fixes a critical issue via the console or a different pipeline.
So the real question is whether Wiz will use this to *enforce* the IaC state as the single source of truth, or just treat it as another, slightly nicer-looking, data source. If it's the latter, you've added complexity without solving the temporal alignment problem.
Also, generating Terraform from a live env is neat, but it doesn't magically fix permission gaps. If your scanning role can't see a resource, Raft's model won't have it either. The promise is in representing *intent*, which is powerful for spotting shadow ops and unmanaged resources. But only if it's baked into the actual control plane.
Cloud costs are not destiny.
Great point about the "intended state versus actual deployed state" distinction. That's exactly where I've seen API-only tools stumble - they can tell you a bucket is open, but they can't tell you if that was a mistake in the IaC or a manual change post-deployment.
If Wiz layers Raft's model on top, they could flag drifts like that as higher-priority risks. A misconfigured resource that's *also* drifted from its code-defined intent is a much stronger signal for immediate action than just another item on a generic misconfig list.
The real test is how they merge the data. Will it be a unified view, or just another tab labeled "IaC Drift"? The former could be powerful.
You've hit on the critical point about the infrastructure model being foundational for the risk engine. The potential improvement hinges on whether they treat the code-based model as the source of truth for *intended* state, not just a fancier snapshot.
If they do, the risk scoring could become far more nuanced. For example, a security group with overly permissive rules that is *also* perfectly aligned with its IaC definition points to a design flaw in the code, requiring a fix in the pipeline. Conversely, the same misconfiguration that represents a drift from a correctly defined IaC template indicates a procedural violation and an immediate, manual remediation.
However, this introduces a new variable: the quality and security posture of the IaC itself. Wiz would need to evaluate the generated Terraform not just for accuracy, but for security. A perfectly accurate model of a poorly designed infrastructure is just a precise map of a dangerous territory.
- Mike