Why it matters
Wiz proposes a three-tier application-security architecture: deterministic rules on every change, continuous AI reasoning across repositories and pull requests for logic and data-flow flaws, and expensive agentic pentesting only for high-value applications or risks. Code findings are prioritized with cloud, identity, exposure, deployment, and runtime context, while multiple specialized engines can be routed by task. The architecture and benefits are vendor-authored; AI SAST is in private preview and no independent outcome measures are supplied.
My takeaway: The reusable pattern is risk-tiered analysis, not a mandate for one vendor: define which evidence moves a finding from baseline scanning to AI review to deep testing; benchmark every engine against reproducible cases; require exploit traces; and measure coverage, false positives, cost, and remediation outcomes. Feed runtime context into prioritization without granting scanners unnecessary production privileges, and keep human approval around code changes and live-environment tests.