Wiz CLI

Wiz CLI brings Wiz security scanning into a developer terminal or CI/CD job. It suits organizations that want to inspect code, infrastructure-as-code definitions, container images or virtual-machine images before deployment. It is a command-line client, not the Wiz web console or a general Mac desktop dashboard.

Scan workflow and findings

The publisher describes scanning for risks in application code, IaC and images, with results that can support development and deployment policy decisions. The selected scanner, input type and organization policy determine what is inspected and how a result is handled. A vulnerability finding, exposed secret or misconfiguration is evidence to investigate, not proof that every exploit path is understood.

Scan a deliberately chosen project or artifact rather than an entire machine by default. Image and VM scanning can require registry access, image archives or tooling appropriate to that input. Installing the CLI does not install every container runtime or provide a Wiz tenant. Current subcommand syntax and output or failure codes should be checked against the authenticated documentation for this 1.x release, not copied from old 0.x tutorials.

Installation and platform evidence

The official selected 1.78.0 download is the wizcli-darwin-arm64 executable and is 270,514,528 bytes. Install using the publisher's distribution instructions or brew install --cask wizcli; the cask exposes the command-line binary rather than an Applications-folder GUI. The filename identifies an Apple silicon build. The current binary's Mach-O slices and macOS deployment minimum have not been independently inspected, and no exact supported minimum was established from accessible public documentation.

The cask declares no additional formula dependency. External dependencies depend on the scan input and workflow. Do not treat an optional container or CI environment as a mandatory dependency for every directory scan. Use the organization's approved signature or checksum verification and download policy before executing a binary; no downloaded Wiz executable was run during this editorial inspection.

Account, network and access

Wiz is a commercial security platform. CLI use and capabilities depend on the organization's account, entitlement and authorization. The publisher's full setup and version documentation was not accessible through the public fetch used here, so exact authentication flags, credential locations and scan-publication defaults are not asserted. Ask the tenant administrator for a least-privilege setup and the current 1.x documentation.

Service credentials and registry access must be protected. Prefer the CI platform's secret storage and scoped tokens over putting secrets in a command history, repository or shared log. Authentication, policy retrieval and publishing or reviewing results can involve network services; this is not represented as a completely offline scanner.

A scanner needs read access to the selected code and artifacts. macOS can prompt for protected-folder access, but ordinary project scanning is not a reason to grant blanket Full Disk Access or administrator rights. Container tooling and remote registries have their own permissions. Confirm any write, publishing or tagging action separately from the intended read-only scan.

License and sensitive data

Wiz CLI is proprietary commercial software within the Wiz subscription framework. The official Legal Center’s current Subscription Agreement grants limited object-code use for internal business purposes during the subscribed term, subject to the applicable customer order and documentation. The official support agreement explicitly lists Wiz CLI as an Agent Service included in a customer’s subscription. Evaluation and separately negotiated agreements can have different terms; a publicly downloadable binary does not provide an independent free or open-source entitlement. Code, secrets, paths, vulnerability details and diagnostic files are sensitive. Review what a scan reads and transmits before selecting a production repository, and sanitize findings before sharing them externally.

Keep scanning policies and allowlists under review. A clean scan is not a security guarantee, while a blocking finding can be a false positive or need contextual assessment. No exact public change list was found for 1.78.0,1.77.0 or 1.76.0; product capability descriptions are not substituted for version-specific release notes.

Sources: Official Wiz Legal Center, Official Wiz CLI product, Official Wiz site, Publisher setup documentation.