Introducing Runtime Threat Detection for Google Cloud Run

Wiz Runtime Sensor support for Google Cloud Run Containers is now generally available, giving teams real-time threat detection and response for their serverless container workloads.

Google Cloud Run has become one of the most widely adopted platforms for deploying containerized workloads without managing infrastructure. Teams across industries use it to run APIs, event-driven pipelines, AI inference endpoints, and production services at scale. But as Cloud Run adoption grows, security teams face a persistent challenge: detecting threats, malicious processes, and active attacks inside containers while they're running.

Today, we're excited to announce that Wiz Runtime Sensor support for Google Cloud Run Containers is now generally available (GA).Teams running workloads on Cloud Run can now get continuous, real-time visibility into what's executing inside their containers, investigate with the help of theWiz Blue Agentand respond automatically when something malicious is detected.

This release completes Wiz's serverless container coverage alongsideAWS Fargate and Azure Container Apps, bringing the same runtime threat detection and response experience to Google Cloud.

Cloud Run's managed nature means Google handles the underlying infrastructure. Everything above that layer is your security team's responsibility: the container images you deploy, the IAM permissions your services run with, how they're exposed to the internet, and whether malicious activity is occurring inside those containers at runtime.

Wiz already provides agentless security coverage for Cloud Run as part of the core platform. With the Wiz GCP Connector, Wiz discovers and inventories every Cloud Run Service and Revision across your GCP projects, surfaces misconfigurations through built-in cloud configuration rules, identifies network and identity risk per revision, detects vulnerabilities at the package level with SBOM, surfaces attack paths through the Wiz Security Graph, and traces issues back to source via Code to Cloud.

With this release, Wiz now also provides runtime visibility, detection, and response capabilities for your Cloud Run containers: knowing what code is actually executing, identifying active threats as they unfold, and responding before damage is done.

Real-Time Threat Detection

The sensor continuously monitors process execution, system calls, and runtime behavior inside your Cloud Run containers. When suspicious activity is detected, such as a binary executing that wasn't present in the original image, a reverse shell being initiated, or a DNS query to a known malicious domain, Wiz surfaces a detection immediately. Each detection is enriched with cloud context from the Security Graph: what IAM permissions the revision holds, what data it can reach, and what other resources are at risk. The Wiz Runtime Sensor ships with 2000+ built-in threat detection rules. Customers can extend the detection library with their own rules tailored to their environment and application behavior.

Correlating Detections into a Threat

Rather than surfacing individual alerts for every suspicious event, Wiz correlates related detections across the workload layer into a single consolidated threat. This is powered by Wiz's Detection Engine, which uses Correlation Threat Detection Rules to evaluate related events across a time window and group signals from different origins into one threat. A cryptomining attack on your Cloud Run Container, for example, may trigger multiple detections in quick succession: a file associated with a known cryptominer, a DNS query to a known mining pool, a cryptominer command line argument, and reverse shell activity. Instead of your team triaging each of those signals separately, Wiz groups them into one threat with all the underlying detections in a single view. Your team sees the full picture of what happened, with MITRE ATT&CK context for each detection, without the noise of managing every signal independently.

AI-Powered Threat Investigation with Wiz Blue Agent

When a threat is identified, theWiz Blue Agentautomatically investigates the threat end to end. Using specialized sub-agents for forensics and code analysis, it correlates runtime detections with cloud context and source code, surfaces a transparent chain of reasoning behind every verdict, and recommends response actions — reducing the manual triage burden on your security team.

Runtime Response Policies

Configure automated responses to detections: terminating a malicious process, blocking specific runtime behavior, or triggering a workflow. For ephemeral Cloud Run containers that may disappear before a human can respond, automated response closes the gap between detection and containment.

To deploy the Wiz Runtime Sensor on Google Cloud Run, see theInstall Runtime Sensor for Google Cloud Runguide in Wiz Docs (login required). To test the sensor against a realistic attack scenario before deploying to production, see theSimulate a Live Attack for Google Cloud Run Sensorguide.

To review your existing Cloud Run posture without the Sensor, connect your GCP environment to Wiz and navigate to yourWiz Inventorytoday.

Want to see it in action?Schedule a demo.

Book a demo and learn how the Wiz Sensor can help you detect and respond to threats in your Google Cloud Run environment

Multi-ecosystem supply chain compromise by TeamPCP targets GitHub, NPM, and VSCode to steal credentials and establish persistence.

Eliminate cryptographic blind spots and neutralize legacy debt with an integrated cryptographic asset inventory. Identify risks across code, cloud, and runtime, using the Wiz Security Graph to prioritize migration and protect against "Harvest Now, Decrypt Later" attacks.

See proven, exploitable risk in the context of your full cloud environment

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings