Scan for Good: Free AI security tool finds nearly 500 critical flaws - TechTarget
Cloud security provider Wiz's Scan for Good initiative has discovered over 475 high-severity and critical vulnerabilities across public sector, healthcare and open-source environments since its launch in September.
The initiative pairs autonomous AI scanning with human security researchers to uncover public exposures and complex attack paths across critical infrastructure at no charge. Wiz played a leading role in uncovering the high-profile PHP2Shell memory safety vulnerabilities that surfaced last month.
According to Wiz, the Scan for Good program has monitored more than 326,000 public endpoints across 17,700 domains since launch. The service prioritizes organizations where a successful attack could cause meaningful harm to communities and vital societal functions.
Our selection process prioritizes organizations where a successful attack could cause meaningful harm to communities and vital societal functions.
Complex attack chains
Unlike large enterprises with dedicated security operations centers, under-resourced public and open source environments often lack visibility across their application footprints. This leaves basic configurations unmonitored over time.
Wiz's initial findings show that exposures frequently emerge from multistep attack chains. Among the discoveries were exposed administrator credentials on nationally significant archives, unprotected mobile alert channels in public hospitals and leaked database sessions in public transportation networks.
What we've seen is that — rather than single code-level flaws — findings frequently consist of multistep attack chains combining missing access controls, exposed keys/tokens, unsafe uploads, NoSQL injections and public CI/CD credential leaks.
AI-powered detection
The service is driven by specialized AI tooling within the Wiz Red Agent, powered by Google DeepMind frontier models, including Gemini 3.8 Flash Cyber and Gemini 4 Argon. These models provide advanced reasoning capabilities that map complex relationships across identities, permissions, APIs and application behaviors.
These AI models have cyber capabilities that help defend at the frontier and uncover vulnerabilities that would otherwise remain undetected. The frontier reasoning of these models, specifically trained to become better patchers and fixers, helps teams fix faster.
Validation challenges
While autonomous AI agents can map perimeter exposures at machine speed, technical validation represents only the first step in a broader security lifecycle. Proving a vulnerability exists is fundamentally different from having the operational mandate to fix it.
Neil Osnato, founder of Persistence Analytics Group, explains that technical validation does not by itself determine institutional authority to act. Deciding to revoke credentials or alter production routing involves operational consequences that require explicit human leadership, materiality assessments and clear governance frameworks.
By combining autonomous AI discovery with rigorous human validation, Scan for Good provides a blueprint for how security teams can use offensive AI defensively. The first priority should be identifying what is truly exploitable today and preventing potential damage before adversaries can exploit these vulnerabilities.
Related
