Wiz + Cloudflare: Mapping How Attackers Reach Your Cloud

When assessing an organization's attack surface, simply knowing which resources exist in the cloud is not enough. It's also crucial to understand how these resources are accessed from the outside.

DNS records, Load Balancers, Application Endpoints, and services exposed via Cloudflare are all part of the pathway connecting the internet to the workloads running in the cloud environment. However, when this information is scattered across different systems, getting a complete picture can be challenging.

Introducing the Wiz and Cloudflare Integration

This is where the integration between Wiz and Cloudflare comes in. Through the Cloudflare Connector, Wiz gains read-only access, adding vital information about DNS Zones and DNS Records managed within Cloudflare to its Security Graph. This means you can now connect what Cloudflare sees at the exposure layer with the existing cloud context already present in Wiz.

Mapping the Attack Surface

Consider this example:

• 🌐 DNS Record in Cloudflare
• ↓
• ⚖️ Load Balancer
• ↓
• ☁️ Virtual Machine / Cloud Workload

Instead of merely knowing that a public DNS record exists, you can now understand which Load Balancer it points to and which workloads reside behind it. Wiz even provides a dedicated Security Graph Query to identify Virtual Machines exposed through Load Balancers to which Cloudflare directs traffic.

Adding Security Context

The insights become even more compelling when security context is added. For instance, you can identify public DNS records that lead to endpoints containing sensitive data or secrets.

This transforms a simple observation like:

“I have an asset exposed to the internet”

Into a comprehensive understanding of:

What is exposed —> How it is accessed —> What lies behind it —> And what risk is created by the connection between them.

An AI Dimension

The integration also offers an interesting angle for AI. Wiz can incorporate Cloudflare AI Security for Apps Guardrails, which protect endpoints, into its Security Graph. This allows for mapping which application endpoints are protected by these guardrails.

The True Value of Integration

Ultimately, the value of this integration isn't just about feeding more data into Wiz. It's about connecting the external exposure layer with the workloads, data, and risks behind it, all within a single, unified Security Graph.