JFrog and Wiz:
Closing the Security Gap Between Runtime and Fix

The JFrog and Wiz integration is a bi-directional API connection that unifies JFrog’s software supply chain platform with Wiz’s cloud runtime security platform. It gives security, DevOps, and release teams a single governed view from code to cloud, pairing artifact provenance from JFrog Artifactory, Xray, and AppTrust with live production context from Wiz. The result is one system of record for what was built, what is running, and whether it is trusted.

The integration exchanges data in both directions through an API-based connection. Wiz sends live runtime data — including container images, cluster and namespace location, and cloud resource context — into JFrog, where it is correlated with Artifactory and Xray to reveal what is running in production and whether it carries risk. JFrog sends artifact-level context such as SCA findings, scan results, ownership data, and AppTrust integrity attestations into the Wiz Security Graph, so Wiz users can prioritize runtime findings by real supply-chain exposure without leaving their platform.

No. The integration is fully agentless and API-based. Customers get immediate runtime visibility using the Wiz data they already have, with no need to deploy the JFrog Runtime Controller, DaemonSets, or eBPF sensors. Elevated cluster privileges are not required, which removes the coordination burden across security, DevOps, and platform teams. Customers who later want deeper behavioral visibility, such as which processes are running or which files are opened, can add JFrog’s Runtime Impact sensor as an optional upgrade.

An integrity violation occurs when a running workload is executing an artifact that does not exist in the JFrog Platform or that lacks an approved cryptographic signature from JFrog AppTrust. In plain terms, it means the software running in production is unauthorized, tampered with, or part of a shadow deployment that bypassed the approved release pipeline. This is different from a CVE, which is a known vulnerability in a package. An integrity violation is about whether the running software is trusted at all.

No. JFrog Runtime is sensor-agnostic by design and functions as an API landing point for runtime data from any supported source. Wiz is the first and most prominent integration, but customers can also feed in runtime data from Upwind, Palo Alto Networks, or JFrog’s own native sensor. Regardless of the source, JFrog delivers the same outcome: a correlated view of what is running, where it came from, and whether or not it is safe.

AppSec (Application Security) and CNAPP (Cloud-Native Application Protection Platform) address different phases of the software lifecycle. AppSec focuses on securing code and artifacts before they ship, using tools like SAST, SCA, and secrets detection to identify vulnerabilities during development and build. CNAPP focuses on securing workloads after they are deployed, using cloud posture management, workload protection, and runtime threat detection to identify risks in live production environments. The two disciplines have historically operated in isolation. AppSec teams lose visibility once code ships, and CNAPP teams see what is running but not where it came from. The JFrog and Wiz integration connects the two, so artifact provenance and runtime posture become two views of the same governed record.

The JFrog + Wiz integration requires three products on the JFrog Platform: JFrog Artifactory, JFrog Xray, and JFrog Advanced Security with Runtime Security enabled. Artifactory anchors the trusted-binary source of truth, Xray supplies CVE data and Contextual Analysis to filter which vulnerabilities actually matter, and Runtime correlates the live workload inventory pulled from Wiz against both. JFrog Advanced Security is recommended to unlock Contextual Analysis of CVEs. Because the Wiz connector is agentless and uses the Wiz API (OAuth2 client credentials), no JFrog Runtime Controller or sensors need to be deployed in your Kubernetes clusters.

Setup takes minutes. Because the connector is agentless, there is nothing to install in your clusters — you create a Wiz service account with read-only permissions, then enter the Client ID, Client Secret, and Wiz API URL in the JFrog Platform under Administration > Runtime > Cluster Management. Initial sync time depends on environment size: a few minutes for small environments under 50 clusters, 15–60 minutes for medium environments of 50–200 clusters, and up to a few hours for large environments of 200+ clusters. After the first sync, successful connectors are refreshed on a ~24-hour cadence with delta updates.

A native CNAPP with SCA scans running images in the cloud but has no visibility into the binary system of record where those images were built, signed, and approved. JFrog + Wiz closes that gap. Because Artifactory holds every trusted binary, JFrog Runtime can detect integrity violations — when a running image digest differs from the original Artifactory digest, indicating potential tampering or drift — something a standalone CNAPP cannot do. Xray Contextual Analysis further narrows CVEs to those actually exploitable in the running code, and untrusted-registry detection flags images pulled from registries not present in Artifactory. The result is end-to-end context from source and build to live runtime, not just a runtime snapshot.

A governed artifact is any binary — container image, package, library, or ML model — that lives in Artifactory as the single source of truth and has cleared the security, license, and provenance checks your organization requires before promotion. Governance means the artifact has been scanned by JFrog Xray for vulnerabilities and malicious packages, evaluated against Curation policies, packaged into an immutable, signed release bundle with an attached SBOM and build evidence, and moved through evidence-based promotion gates from development to production. In the JFrog + Wiz integration, governed artifacts are the baseline for runtime trust — JFrog Runtime compares every workload Wiz discovers in your clusters against the governed binaries in Artifactory to flag drift, untrusted-registry pulls, and integrity violations.