Wiz Data Foundations: Where’s My Sensitive Data—And Who Can Access It?

A hands-on walkthrough of how to use Wiz to find sensitive data and uncover who can access it.

Cloud data security starts with a deceptively simple question:Where is my sensitive data, and who has access to it?

For most teams, answering that isn’t straightforward. Data is sprawled across cloud accounts, services, and environments. Access is often indirect, inherited, or forgotten. And traditional tools rarely show both the data and the access context in one place.

This blog kicks off theWiz Data Foundationsseries—an overview into how Wiz helps organizations discover, classify, and act on data risks in the cloud. In this first post, we’ll focus on thevisibilitylayer:

Surfacing where your sensitive data lives

Understanding how it’s exposed

And identifyingwho can access it

We’ll cover classification and response in upcoming parts.

Before diving into access, it’s helpful to understand how Wiz surfaces data security insights in the first place. Wiz performs anagentlessscan across your environment across allsupported data services. Sensitive data detection and classification is built into the platform and available out-of-the-box.

Data insights are surfaced through:

Findings– raw, granular detections (e.g. a file with PII )

Issues– correlated risks that include context (e.g. sensitive data + public exposure + no encryption)

Start with the big picture: The newData Stores Treemapgives you a visual breakdown of where sensitive data lives across your environment. It’s grouped by resource type, environment, and sensitivity level—helping you spot trends and outliers instantly.

✅Example: See how much sensitive data is stored in S3 buckets across production vs dev environments.

This is just one way Wiz helps teams understand the landscape before zooming in.

Once you knowwherethe data is, the next question iswho can get to it?Wiz provides multiple workflows, depending on your goal:

If you’re looking at a particular resource—like an S3 bucket—you can view all identities with access from theDatastore page.

✅Click into a datastore → Identity tab → See access level, path (direct, inherited), and whether the access is risky.

Use this when you’re focused on a critical asset and want to audit its exposure.

If you want to understand access patterns across users, head to theIdentity Entitlementsview.

Filter by identity type (e.g., human vs machine)

Sort by access level (read/write/admin)

See how access was granted (policy, trust relationship, etc.)

Filter down further (e.g., identities without MFA that have write access to sensitive resources)

✅Great for answering questions like: “Who can write to sensitive storage and how did they get that access?”

If you’re interested in a particular user or service account, start from theirIdentity Profilepage. You’ll see a full list of resources they can access, including those with sensitive data.

✅From here, explore access relationships, filter by sensitivity, or see if access spans environments or accounts.

You can also ask custom questions right on this page.Want to know if a specific role has write access to unencrypted databases? Write your own query inline and go.

TheSecurity Graphgives you ultimate flexibility. Ask a question—any question—and build a path-based query to explore relationships across data, identity, exposure, and risk.

✅Example: “Show me identities with transitive access to sensitive data via a public-facing role.”

It’s powerful but designed for targeted exploration when you need full control.

Surface org-wide trends, coverage metrics, and top data risks directly in Wizdashboards.It’s an easy way to track high-level KPIs or share with leadership. You can quickly view publicly accessible resources, data related issues, identity insights and more on the data dashboard.

With agentless scanning and prebuilt insights, Wiz gives you a full picture of your sensitive data exposure—what exists, where it lives, and who can get to it. You can start from data, identity, or relationships—and explore as broadly or as deeply as needed. We're continuously innovating to ensure Wiz customers can answer critical data security questions—quickly, intuitively, and in the way that works best for them.

In upcoming posts, we’ll go deeper into how Wiz classifies sensitive data and how teams can take action using the Wiz 5R framework. Stay tuned—or check back soon to explore the full series.

Discover how Wiz DSPM helps you secure your critical data . You can request a personalized demo to address your specific requirements.

Unified model context, real-time security answers, and a faster path to remediation.

The present and future of security for the Model Context Protocol.

Learn how to secure your cloud identities and operationalize Zero Standing Privileges with the Wiz and CyberArk integration

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings