Ensuring Supply Chain Security: Verify container image integrity with the Wiz Admission Controller

The Wiz admission controller simplifies supply chain security by ensuring only trusted container images can be deployed in Kubernetes environments.

Developers are constantly building new microservices or native cloud applications using containers, which provide increased agility, flexibility, and portability. However, the creation of large numbers of new images brings new potential security risks and creates the need to ensure that these artifacts are sourced from trusted registries and have not been tampered with in any way.

At the same time, supply chain attacks have become apreferred attack vectors for attackers. These can take many forms, such as compromising an open-source library (log4j), modifying a package (Solarwinds), compromising a signature key (codecov), or gaining access to secrets that expose the supply chain itself (Hell's Keychain). Organizations need to consider the security of the supply chain at every stage of the software development cycle.

Forcontainer images, two processes need to be put into place: artifacts must be signed and then verified before deployment. While open-source solutions are available, they must be manually integrated and maintained, which can be very inefficient and time-consuming for capacity-constrained teams.

Wiz is proud to announce the general availability of image integrity validation usingtheWiz admission controller, becoming the first CNAPP solution to provide these supply chain security capabilities. Customers can now extend Wiz Guardrails into their software supply chain to ensure that only signed or trusted images can be deployed. This prevents teams from unintentionally deploying vulnerabilities or malware from malicious actors that have modified container images to further reduce the cloud attack surface.

These new Image integrity features enable customers with:

Image tampering protection:Validate container image signatures and use the Wiz admission controller to prevent images from being modified after creation for example to inject malware, and also to validate an image’s origin toprotect the supply chainof your containers.

Enforcement of trusted sources: Centrally define which trusted developers and teams are authorized to deploy containerized images so you can know and trust your pipelines.

Complete visibility for Kubernetes pipelines: Review all change attempts, both pass and fail, centralized view of all admisson controller events across all your Kubernetes clusters to quickly identify potential threats and usage patterns.

Threat detection automation: Get alerted in real-time to unauthorized or abnormal activity in your environments and use the context of the Wiz Security Graph to rapidly contain an unfolding threat.

Customers who have already set upcontainer image signingprocesses usingCosignorNotary, or who would like to implement them, can now use Wiz to enforce container image verification. With just a few clicks, integrity validators can be defined, and associated policies established to block unverified images. This will ensure that maliciously modified images (for example, those that incorporate vulnerabilities or malware) or images from invalid sources cannot be deployed on Kubernetes environments.

Additionally, customers can now detect unwanted image deployment attempts with full context of events taking place in their Kubernetes environment. By correlating these failure events coming from the Wiz Admission Controller with other cloud, container, and Kubernetes contexts, it becomes simpler to generate a high-fidelity alert and investigate a potential threat. In seconds, cloud defenders can see which user tried to deploy an unverified image and where, dramatically reducing mean time to detect (MTTD) andmean time to respond (MTTR)on supply chain risks.

With these new features, Wiz offers complete protection of the container supply chain, from code creation and build via theWiz CLI, to image storage via scanning ofcontainer registries, to deployment via the admission controller, and in runtime via our agentless risk-assessment andruntime sensor. This is just the first phase in the validation of container images by Wiz admission controller and more enhancements will be coming soon. You can learn more by visiting our Wizdocs(login required). If you prefer alive demo,we would love to connect with you.

What is it about certain vulnerabilities that makes them especially hard to deal with, and how can vendors make things easier for security teams?

We're excited to announce that JPMorgan Chase has made Wiz a new member of their Hall of Innovation!

Test your investigation skills and K8s knowledge in a new Wiz-sponsored CTF event: the EKS Cluster Games!

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings