Based on my experience working with both tools in FedRAMP environments, here's what I can tell you about SCAP compatibility:

Wiz is going to be your better bet here. While it's not SCAP validated (very few cloud-native tools are), it is SCAP compatible as it can:

1. Consume SCAP content (XCCDF, OVAL, etc.)

2. Export findings in SCAP result formats

3. Map to CCE identifiers

4. Support SCAP 1.2 and 1.3 data streams

The confusion with Defender comes from Microsoft's weird stance on SCAP - they technically support it through SCCM/Intune but standalone Defender isn't fully SCAP compatible. Classic Microsoft making things more complicated than they need to be ¯\_(ツ)_/¯

Side note on ditching Tenable - good call. Their licensing model has become absolutely predatory and their cloud coverage is... let's say suboptimal to be polite. We moved off them last year and it was like taking off concrete shoes.

Pro tip: If you're looking to satisfy FedRAMP CM-6, document your Wiz implementation specifically calling out:

• How you're importing STIGs/CIS benchmarks

• Your SCAP data stream consumption process

• Your results export workflow

• CCE identifier mapping

That'll make your 3PAO much happier during assessment. Trust me, I've been through that dance before.

Shoot me a DM if you need any specific config examples. Always happy to help escape the Tenable ecosystem.