[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOVzAiS1w1mrSXNhpeJG7DN2oYB-jYj6QCaADZ7RjM2Y":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"e70d8fff-ef01-453f-9353-458b9dd21d11","The Green Agent POV: Formulating the Fix for an Internet-Facing Container with Sensitive Data Access","the-green-agent-pov-formulating-the-fix-for-an-internet-facing-container-with-se-43a4d5","See how the Green Agent balanced security urgency with business continuity to turn a toxic combination into an executable remediation plan and ready-to-merge pull requests.","The Wiz Security Graph and Green Agent tool help security teams identify and remediate critical issues in internet-facing containers. The system maps attack paths, correlating vulnerabilities, insecure configurations, and sensitive data access to recommend fixes while balancing security urgency with business continuity. Green Agent investigates issues rapidly, validating exposure and exploitability to formulate executable remediation plans.","Green Agent tool identifies and formulates fixes for internet-facing containers with vulnerabilities and sensitive data","https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Finside-green-agent-investigation","https:\u002F\u002Fwww.datocms-assets.com\u002F75231\u002F1794575501-green-pov-2x.png","2026-11-13T17:05:02+00:00","2026-11-13T18:00:09.896971+00:00",7,[17,20,22,25,27],{"name":18,"type":19},"Green Agent","product",{"name":21,"type":19},"Wiz Security Graph",{"name":23,"type":24},"Kubernetes","technology",{"name":26,"type":24},"AWS EKS",{"name":28,"type":24},"IAM","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,37,42],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":49,"value":50,"context":51},"cve","CVE-2026-111497","Known initial-access vulnerability on the container image.",[18,21],{"controls":54,"vendors":142},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":85,"name":86,"problem":87,"products":88},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":114,"name":115,"problem":116,"products":117},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[143],{"slug":98,"name":99,"logo_path":100,"roles":144},[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"internet-facing-containers-with-sensitive-data-access-create-exploitable-attack-paths","Internet-Facing Containers with Sensitive Data Access Create Exploitable Attack Paths","Internet-facing containers that also have access to sensitive data represent a critical convergence of risk: a single exploited vulnerability or misconfiguration can give an attacker a direct path to crown-jewel data. The core problem is that security teams often evaluate vulnerabilities, misconfigurations, and sensitive data exposure in isolation, missing the compounded risk when all three exist on the same workload. Tools like Wiz's Security Graph and Green Agent address this by correlating these signals into mapped attack paths, making the true blast radius visible. This matters because attackers do not think in silos — they chain exposures together, and defenders must do the same to prioritize and remediate effectively.",[151,152,153,154,155],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 AC-6: Least Privilege","NIST CSF 2.0 ID.RA-01: Asset Vulnerabilities Are Identified and Documented","OWASP A05:2021 Security Misconfiguration",{"NIST SP 800-53 AC-6: Least Privilege":157,"OWASP A05:2021 Security Misconfiguration":158,"CIS Control 7: Continuous Vulnerability Management":159,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":160,"NIST CSF 2.0 ID.RA-01: Asset Vulnerabilities Are Identified and Documented":161},"This control requires that containers and workloads be granted only the minimum permissions necessary, directly preventing the scenario where an internet-facing container holds broad access to sensitive data.","Insecure container configurations that expose workloads to the internet while retaining sensitive data access fall squarely under this category of preventable security misconfiguration.","This control mandates continuous scanning and remediation of vulnerabilities; correlating unpatched CVEs on an internet-exposed container with sensitive data access is the risk scenario it addresses.","This control requires maintaining secure configurations for all assets, including containers — misconfigured internet-facing containers with excessive data access are exactly the drift this control is designed to prevent.","This category calls for identifying vulnerabilities across assets; mapping the compounded risk of vulnerability, misconfiguration, and sensitive data access on the same container is the kind of holistic risk identification it requires."]