WizNxSCORE with Wiz.
Wiz shows what is wrong across your cloud. NxSCORE works alongside it on what happens next: an issue sorted by cause, a verdict with its evidence, a fix your engineers run, a guardrail so it stays fixed, and the evidence your auditors ask for.
You will recognise this if
- Wiz issues get triaged, and the same ones are back after the next deployment.
- The owner of a finding is not always the person who can change the resource.
- Half your audit is policies, reviews and records that no scanner looks at.
- Your regulator wants a quarterly pack, laid out against its own clauses.
What NxSCORE reads from Wiz, and what it never touches.
Wiz stays your scanner. NxSCORE reads what it already knows, so it only scans what nothing else covers, and it never changes anything in Wiz.
| NxSCORE reads | NxSCORE never |
|---|---|
| Policies, and which are switched on | Never changes a policy in Wiz |
| Alert rules, and which accounts they cover | Never creates or edits a rule |
| Compliance standards and their requirements | Never dismisses or resolves an alert |
| Cloud accounts and how they are grouped | Never writes anything back |
| Open alerts, and 90 days of resolved ones | Never sees your workloads’ data |
How NxSCORE sits beside Wiz.
Three things happen in the first days. None of them changes your cloud, or your CNAPP.
- 01
Connect Wiz with a read-only key.
Your team creates a read-only service account in Wiz and enters its credentials once. They are encrypted as soon as they arrive and never shown again.
NxSCORE reads Wiz the same way it reads any CNAPP: its policies and rules, compliance frameworks, cloud accounts and open issues, once a day, with 90 days of resolved issues on the first sync.
Wiz, first syncConnectedCloud accounts 48 Open issues 1,920 Resolved issues read, last 90 days 4,416 Of those, came back after a fix 512 - 02
Coverage worked out control by control.
For each control, NxSCORE looks at whether Wiz checks it, and for which accounts.
Whatever Wiz does not check, the NxSCORE scan does. Whatever no scanner can check, such as a quarterly access review, is met with evidence your analyst accepts.
Who checked itExample- S3 buckets block public accessWiz
Wiz checks it, and an alert rule covers every account.
- EC2 instances require IMDSv2Wiz and NxSCORE
Both see the same failing setting. One finding, not two.
- Unused IAM roles removed after 90 daysNxSCORE
No Wiz policy is switched on for it, so the NxSCORE scan checks it.
- Access reviewed each quarterEvidence
No scanner can check it. Your team uploads the review and an analyst accepts it.
- 03
Every account accounted for.
NxSCORE matches the accounts in your cloud organisation with the accounts Wiz monitors. One that Wiz has switched off, or never had, is listed by name, and scanned where NxSCORE has its own read-only role.
An account nobody can read is shown as not scanned. It never appears in a report as passing.
AccountsExample- prod-paymentsCovered by your CNAPP
- data-lakeScanned
- sandbox-17CNAPP only, not scanned
- dr-siteAccess denied
Then the work after the alert.
What happens after Wiz raises it.
This is the part a scanner leaves to your team. With NxSCORE, an analyst does the preparation and your people make the decisions and the changes.
- 04
A verdict before anyone touches it.
Before a fix is suggested, NxSCORE reads how the resource is used: what a security group is attached to, when a key was last used, who created it. The verdict comes with its reason, so your engineers can check it.
Findings are grouped into issues, ordered on the Priorities page, and given an owner from the resource’s tags and a fix-by date from its severity. How a backlog is sorted.
Is it safe to fix?Example- Access key for svc-reportingSafe to fix
Last used 214 days ago.
- sg-payments-edgeCheck first
Attached to two network interfaces behind the load balancer.
- 05
A fix kit your engineers run.
For a safe fix, NxSCORE writes the script, with its check, apply and rollback in one file. Your engineers run it. NxSCORE’s access stays read-only.
A finding closes only when a later assessment, or Wiz, no longer sees the problem. How fixes are kept safe.
Fix kit: S3 buckets that allow public access- CheckLists every change it would make. Changes nothing.
- ApplyAsks before it acts, in your change window.
- RescanClosed when NxSCORE, or Wiz, no longer sees it.
- 06
A guardrail, so it does not come back.
When Wiz raises the same issue again and again, your analyst writes a prevention plan aimed at its source. Your team agrees it and makes the change.
NxSCORE marks the plan verified after 14 days with no new findings from Wiz or from its own scan.
Prevention planVerified - 07
Evidence for the requirements no scanner can check.
Each requirement is met by checks, evidence or both. Findings from Wiz count towards the checks. Your team uploads the rest once, and your analyst accepts it.
PCI DSS 4.0.1Example- Settings Wiz and NxSCORE checkChecks
- Policies, reviews and training recordsEvidence
Questions about NxSCORE with Wiz.
Does NxSCORE replace Wiz?
No. NxSCORE works with Wiz. Wiz stays your scanner. NxSCORE reads what it finds, checks what it does not, and runs the work after the alert with your team.
Does NxSCORE change anything in Wiz?
No. It reads policies, alert rules, compliance standards, accounts and alerts with a read-only key. It never dismisses an alert, edits a policy or writes anything back.
Will we see every finding twice?
No. When Wiz and the NxSCORE scan report the same failing setting on the same account, it is one finding, marked as found by both.
Wiz already prioritises issues. Why another order?
NxSCORE starts from Wiz’s severity and adds what happens after a fix: whether the issue came back, whether it is past its fix-by date, and which compliance requirements fixing it would clear. The order your team works in reflects all of that.
Does NxSCORE use Wiz’s remediation guidance?
It writes its own fix kit for each safe fix, after reading how the resource is used in your account, with a check mode, an apply step and a rollback. Your engineers run it.
Keep Wiz. Add the work after the alert.
Connect Wiz and one cloud account. After the first assessment, your analyst shows you how your open issues sort by cause, which ones came back after a fix, and the guardrail that would have stopped the most frequent one.