What metrics would you use to evaluate Wiz (Network Management Software)'s infrastructure-as-code scanning tool?

Introduction

Evaluating the success of Wiz's infrastructure-as-code scanning tool requires a comprehensive approach to product metrics. To address this product success metrics challenge effectively, I'll follow a structured framework covering core metrics, supporting indicators, and risk factors while considering all key stakeholders.

Step 1

Product Context

Wiz's infrastructure-as-code (IaC) scanning tool is a critical component of their cloud security platform. It helps organizations identify and remediate security risks in their IaC templates before deployment, reducing the attack surface and improving overall cloud security posture.

Key stakeholders include:

1. DevOps teams: Seeking to integrate security into their CI/CD pipelines
2. Security teams: Aiming to enforce security policies across cloud environments
3. Compliance officers: Ensuring adherence to regulatory requirements
4. C-level executives: Concerned with overall risk reduction and operational efficiency

User flow:

1. Integration: Users integrate the IaC scanning tool into their CI/CD pipeline or development environment.
2. Scan: The tool automatically scans IaC templates (e.g., Terraform, CloudFormation) when changes are committed.
3. Analysis: It identifies potential security issues, misconfigurations, and policy violations.
4. Reporting: Users receive detailed reports with actionable insights and remediation suggestions.
5. Remediation: DevOps teams address identified issues, either manually or through automated fixes.

This tool aligns with Wiz's strategy of providing comprehensive cloud security solutions and differentiates them from competitors by offering deep IaC scanning capabilities integrated with their broader cloud security platform.

In terms of the product lifecycle, the IaC scanning tool is likely in the growth stage, as the adoption of IaC practices is increasing, but there's still significant room for market penetration and feature expansion.