> Wiz agreed to acquire Tel Aviv-based Raftt, a cloud-based developer collaboration platform, for $50 million in December 2023. In April 2024, the company acquired cloud detection and response startup, Gem Security, for around $350 million
> Wiz was founded in January 2020 by Assaf Rappaport, Yinon Costica, Roy Reznik, and Ami Luttwak, all of whom previously founded Adallom.
> Adallom was founded in 2012 by Assaf Rappaport, Ami Luttwak and Roy Reznik, who are former members of the Israeli Intelligence Corps’ Unit 8200 and alumni of the Talpiot program.
> Adallom was reportedly acquired by Microsoft for $320 million in July 2015
> On March 18, 2025, Google announced an all-cash acquisition of Wiz for $32 billion
Had never heard of Wiz until they posted the blog post about the DeepSeek database being public earlier this year.
https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepse...
It's interesting that many people working in intelligence found ways to become very successful in business. I wonder what is the reason.
It shouldn't be overlooked that acquiring Wiz is also a way for Google to secure a beachhead in half the Fortune 100, many of which are "enemy" territory.
The price is high, but there aren't many options available and Wiz has the advantage of being built on Google Cloud natively, and already have Marketplace integrations completed.
As a Googler who works in GCP security, security has been a key differentiator for GCP long before the Mandiant acquisition. Google invented BeyondCorp (a primary driver of Zero Trust). Google helped create security keys (U2F, FIDO, Webauthn), and was I think the first major company to adopt them, both for employees, and for consumers. Google was one of the first major companies to offer a bug bounty, in 2010. Google's Project Zero searching for vulnerabilities in other companies'/organizations' software I think was pretty much unprecedented when it was created. Look at the number of times other tech companies get hacked compared to Google. Google got hacked in 2009 by China (I believe that was the first time a major company admitted to being hacked by government). That was a major turning point. Ever since then it's been "never again".
Disclosure: my thoughts are my own.
If that is their objective, they will fail again, since this is the land of good account management. Being able to call somebody on the phone if required. Something AWS excels on, Microsoft a little bit, while Google is rumored to have humans working there, but they are rarely seen.
Assume 1,000 customers each generating $2m in ARR with contracts. That’s $2 billion. Assume generous 6x ARR valuation, that’s $12 billion.
Where is this $20 billion premium coming from? How could the board approve this? How is this fair to shareholders?
Heck, as a minor shareholder in GOOG, I don’t find this financially responsible at all.
I can’t help but think sometimes these tech acquisitions have some hint of nepotism/deeper underlying motivations behind them than meets the eye.
I think Wiz accepted 15x because it is all-cash.
The rate at which they are still growing, a series C/D company would dream of.
[1] https://www.wiz.io/blog/100m-arr-in-18-months-wiz-becomes-th...
The current Slope-Intercept is (NTM Revenue Multiple) = 36.677*(NTM Rev Growth Rate) + 2.0013. If Wiz is doubling revenue (100% Growth Rate) and they are at about $500M of revenue today [2], then the multiple according to that calculation is ~38.7 X Next Twelve Month Revenue ($1B) or $38.7B.
So, the price is in line with the market...or you could argue even a discount to it.
[1] https://cloudedjudgement.substack.com/p/clouded-judgement-31... [2] https://www.barrons.com/articles/google-stock-price-wiz-deal...
That's the thing , were any numbers released or are we all just gonna speculate here ? What is their growth rate, profit margin etc etc ? How do they fit in Google's business, can current Wiz clients be upsold on GCP more easily now? Can other clients be brought more easily to GCP now that Google has a good (I hope) cyber security solution to go with its cloud? Clearly there is some strategy going on here that is more than just the ARR of Wiz.
As a minor shareholder in GOOG as well I have no freaking idea about any of this, I sort of trust that they probably took a calculate risk and know what they're doing (and even if this is a mistake by 20B, that's not much for a company the size of Google).
One way to reduce that tendency is to use multiple POVs of analysis. You could phrase it as a question instead: what assumptions would you need to change for the valuation to make sense?
Other questions: What factors are you not including? / What would it take for nepotism to survive scrutiny and how much nepotism would be tolerated?
My guess here is there are long-term strategic factors that the decision makers weighed heavily. I’d be very interested in understanding their world view, since they have much better internal visibility of both companies.
They surely expect some kind of strategic advantage from that, probably something to do with security of their own infrastructure, or maybe competitive advantage for gaining government or gov-adjacent contracts, or maybe they were afraid that Microsoft or Amazon could buy it and hurt their existing business.
Take a look at other Unit 8200 startups, or even Palantir. Palantir is much much much more worth than what they are on paper, especially with their Lavender AI involvements.
Cyber strategies have become so critical that it's a race between nations right now. The leading ones being Russia, Iran, China, North Korea and the US (while the US is heavily losing control, just in terms of malware and campaigns). Stuxnet forced the hands of the other nations, and they invested fully in Cyber eversince.
These deals always have more than meets the eye. Google wouldn't acquire revenue at a fair market price just for revenue's sake - there's some reason they expect to get value beyond the revenue.
That doesn't mean its nepotism. It could be that they think they can triple revenue per customer with some synergy. Or any number of a large set of other possibilities.
If you want to understand this type of transaction better, you can read a book on M&A
Sure, your valuation could be based on revenue today. But why would you sell if you're "worth" $12bn right now, but you'll be "worth" 32bn in a few years? Why give up the control?
The only way for a company like Google to buy Wiz is to add a premium. Otherwise the company will just say "no".
This literally happened to Figma as well. And there is a history of this with companies like Instagram/WhatsApp.
In retrospect, was it stupid for Facebook to acquire Instagram/WhatsApp for large premiums?
Maybe they just need the tech. With Google behind, they can have 10,000 customers.
Disagreements on board levels are less and less frequent in the corporate world.
On top of that, many huge voters are simply ETFs, and their representatives virtually always side with management (state street, vanguard, etc have documents that explain their voting, but they are far from any kind of activist or naysayer.
But also, and may more important, you get to see everyones cloud usage, across all providers, with a high level of permissions. Said differently, Google can now target customers with massive spend across other cloud providers and work to migrate them to GCP, at a price that's just cheap enough to over come the switching cost.
Here's the letter sent by the CEO Assaf Rappaport to his team at the time (2024):
"Wizards,
I know the last week has been intense, with the buzz about a potential acquisition. While we are flattered by offers we have received, we have chosen to continue on our path to building Wiz.
Let me cut to the chase: our next milestones are $1 billion in ARR and an IPO.
Saying no to such humbling offers is tough, but with our exceptional team, I feel confident in making that choice."
https://techcrunch.com/2024/07/22/wiz-walks-away-from-google...
Yeah - that’s not likely to happen. Even the current in-house developed multi-cloud security stuff Google has doesn’t let internal people see customer data. It’s right there in the T&Cs they publish and agree to.
I suppose they could be violating them in egregious ways, but that wouldn’t last long before one or more of the 170,000 employees got upset and went all whistleblower, which would lead to billions of dollars in lawsuits.
Google already have one of the best security teams in the industry - Project Zero [0]. They don't need Wiz's "enterprise" expertise for security.
This deal is about DATA. Wiz, as a cybersecurity vendor, have full remote access to their customers cloud compute storage (EC2 EBS volumes, etc) in the name of "security scanning" - this is actually part of their unique selling point - "agent-less scanning" which is unlike traditional security tools that require an agent installed in the OS. Instead, Wiz is able to just clone your full data volume and scan it locally in their cloud accounts/VPC.
With this deal Google has bought a ton of confidential data from Wiz's customers without their explicit knowledge or approval, and they will use it to improve Google's AI models like Gemini and probably several other products.
A year ago Google struck a $60M/yr deal with Reddit to exclusively license their content [1] for the same reason, and that data is probably much smaller and less valuable than the data Wiz has access to from their customers, which include companies like Morgan Stanley, DocuSign, Slack, Plaid, and others. [2]
Sources:
0: https://googleprojectzero.blogspot.com
1: https://www.reuters.com/technology/reddit-ai-content-licensi...
Am I just naive?
maybe this deal is about a company with a lot of revenue in an area google is heavily investing in: cloud security?
I highly doubt Google or Wiz have a legal avenue that allows them to use customer data beyond fulfilling their product needs. Products like Wiz (voluntarily) go through security audits and certifications, from SOC2 type 2 to FedRamp. Also enterprise customers actually do read T&C (their legal team does at least) and having terms and conditions that allow you to train models on customer data without their consent is not going to fly under the radar for long.
The field of security is huge. It's unhelpful to lump unrelated things together.
Yes, because exploit discovery is exactly what enterprise security is.
1) Hidden cabals colluding in secret to control world events.
2) Extraterrestrial beings live among us secretly controlling world events.
3) Google illegally steals private data to secretly control world events.
https://www.theverge.com/2024/7/23/24204198/google-wiz-acqui...
> Wiz combines a graph search for asset management with agentless vuln and malware scanning that clones EBS volumes and scans them on their infrastructure. That's a great combo for vuln management, but has some downsides like delays between scans and cloud costs. They have a sensor with solid detection rules, and are okay at a bunch of other stuff like cloud log threat detection and sensitive data detection. They've basically pushed what you can do without an agent to the limit.
VC approach to enterprise sales, https://www.calcalistech.com/ctechnews/article/b1a1jn00hc & https://news.ycombinator.com/item?id=41042462
> [Cyberstarts] shows an internal rate of return of more than 100%, an unusual figure even for the best funds in the world.. The first sales come from the loyal CISOs who work with the fund.. Ra'anan offers [CISOs] the big dream of the world of employees - shares in a venture capital fund.. all funds that specialize in cyber go after CISOs and entice them with dinners, conferences, and some also offer them holdings in the fund. However.. he perfected it to a completely different level.. No CISO has ever received compensation for purchasing products.. They receive 4% of the success fees of the general partner (GP) in the fund.
I'm just trying to make sense of the numbers.
According to Amazon's Wiz integration (https://aws.amazon.com/marketplace/pp/prodview-ibgbkrqusncsm), the lowest cost they have is $24,000/year.
This is an enterprise product in a space where companies spend millions of dollars.
Still seems like an insane amount though.
Craftsman Tools was sold to Black and Decker for $500 Million. This was and is a respected tool brand with an international presence making physical and tangible products and it is apparently worth 1/64th of Wiz.
I'm not even saying Wiz is overvalued, I don't know, I'm just not sure how they come up with these numbers.
https://news.ycombinator.com/item?id=41042034
That being said, Instagram and WhatsApp were expensive for Facebook and those ended up being a steal. Time will tell, as usual.
Wiz is a SaaS b2b startup. Even on a forum for startups most people haven't heard of them.
Wiz reportedly has a revenue of 750m. It would take Google 30 years or more to break even on this deal. But like all bs startups Wiz will fade into irrelevancy 6 months after being acquired.
Google is getting completely scammed.
It's also possible the last Wiz deal happens without the antitrust swirling over Google.
What usually happens otherwise? Would they do partly google stock, etc? And each shareholder gets some kind of multiple? (you get your N amount of Wiz shares X .72 = your number of google shares), or something of that sort?
Google pays each of Wiz's shareholders 75-90% of the deal amount. The remainder is held in escrow and paid some time later based on a variety of conditions.
> What usually happens otherwise? Would they do partly google stock, etc? And each shareholder gets some kind of multiple? (you get your N amount of Wiz shares X .72 = your number of google shares), or something of that sort?
Yup, that's exactly how it works.
This will protect the buyer against misrepresentations.
There are often also targets that have to be met to achieve the full purchase price but not always disclosed
Typically these involve at least some stock (cash + stock or all stock) which would mean that each Wiz share gets some amount of money and some multiple of Google stock per share.
I'm sad they're being acquired, especially by a FAANG company. This constant consolidation is bad for IT (and the economy in general). I am happy for the employees holding shares though!
Companies like CrowdStrike have copied a lot of what Wiz has been doing (and I'm sure wiz has copied some CrowdStrike features).
This announcement is pretty disappointing to me. I would have more faith in Wiz as an independent company than as part of Google. I expect their innovation to fall off a cliff.
For Instagram and WhatsApp it was the user base and growth that was being bought, which is much harder to acquire than some random B2B saas security software.
How easy is this? Especially if you're doing it on an accelerated timeline, it seems like you'd have to pay above market to poach thousands of best-in-class engineers, and then you're stuck with higher salary expenses forever.
They announced in a blog post that they went from $1m ARR to $100m ARR in 18 months (Feb 2021 -> July 2022). [1]
Reuters in the article posted here reports they were at $500m ARR when they last raised in mid-2024, meaning they went from $100m to $500m in around 2 years.
One would thus speculate they are likely a few hundred million above the half-a-billion figure today.
The multiple still appears a little high to me (particularly given it's all-cash, which Google doesn't even have) but what do I know.
[1] https://www.wiz.io/blog/100m-arr-in-18-months-wiz-becomes-th...
GOOG's latest balance sheet showed $96B in cash.
I loved the product when I used it (huge improvement over Nessus), and am immensely disappointed Google owns it as it means I’ll have to find something else going forward. This is the sort of acquisition a regulator should block, because Wiz really is best-in-class at what they do for every cloud they support, and customers benefit more from it being agnostic.
They also snapshot your disks, cloning them to Wiz accounts to provide secrets scanning / vuln scanning / etc against your infra.
These resulting risks / findings are scored and provided in their SAAS Wiz console via dashboards / APIs / integrations with remediation guidance.
A lot of cloud providers already have little hints like "hey - did you mean to create this account in God mode?" or "It is recommended not to create this god mode json key file" - Wiz is taking this to the next level of detail
One exploit I remember Wiz finding was "ChaosDB". A flaw in Microsoft's Cosmos DB allowed anyone to use the default-enabled Jupyter Notebook to basically dump and modify anyone's databases, without authentication. Full admin access.
Like 32B is no small sum, and I don't really understand Wiz business (product yes, business and numbers much less).
https://en.m.wikipedia.org/wiki/Wiz_(company)#/media/File%3A...
It makes no sense for a company to have two mapping applications, yet 15 years later, more than a billion paid, one of the most valuable companies in the world failed to integrate another app.
Most people using Waze have no idea that it is owned by Google.
Absurd take. Google is the one AI company that is not completely dependent on Nvidia because they now use their own TPU chips for both inference and training.
Currently, Crowdstrike, Zscaler and other solutions compete in a similar space than Wiz.
Google likely believes if can offer Wiz sec products bundled with Google Cloud. It isn't a terrible idea.
But Wiz itself works on multiple clouds, so it seems that Google can also grow it on their own.
Cloud security companies are growing a lot, and might be a growth lever for Alphabet, as its other businesses' revenue growth are slowing down.
My assumption is that this will actually make it easier for Crowdstrike and Zscaler to keep their market share, as they are pure-play companies on Cloud security and Alphabet has too many businesses to manage.
For me, it looks overpriced. Wiz has been growing a lot, but under Alphabet it might not perform as well as it did.
The big winners are the founders and whoever owned Wiz options.
ZS specializes in SSE/SASE - and does really well in that segment.
https://www.forbes.com/sites/iainmartin/2024/10/28/this-vc-b...
https://web.archive.org/web/20250312193110/https://www.forbe...
[1] https://www.bankinfosecurity.com/blogs/cyberstarts- program-sparks-debate-over-ethical-boundaries-p-3763
[2] https://www.forbes.com/sites/iainmartin/2024/10/28/this-vc-b...
- Businesses pay the cloud providers to allow them to use compute/disk/network
- Businesses pay to hire the engineers who can work on cloud
- Businesses pay to hire security engineers who can secure the applications in cloud
- Businesses pay to hire FinOps to optimize their cloud usage
- Businesses hire security companies to secure their cloud usage (e.g. Wiz was one such company)
- Now cloud provider has to acquire the security company to secure their own cloud?
Either I am too old, or there is something wrong here. Let's not forget that at the same time many big businesses do just fine by not using AWS/GCP/Azure.
No - this acquisition is about selling Wiz to cloud customers. Deploying on cloud securely is a solved problem if you set and follow good policies. Virtually nobody is doing this, ergo companies like Wiz that will tell you when you're doing something stupid.
Among the wiz customers if they use GCP already then surely they will be willing to try the functionality of google builds it.
If the customer doesn’t use GCP, chances are they wont move to GCP and probably move away from wiz too after the acquisition.
I don’t get why they bought them instead of copying them
Whoever owns Wiz obtains read only access to large company and government cloud networks. Even in the Wiz outpost model where the scanning engine is deployed into the user's own cloud network, results from scans are sent back to Wiz Cloud, and this includes sensitive information such as "Installed packages, Exposed secrets, Malware detection".[1] For an example real world deployment, GitLab SaaS public documentation expects the "Wiz Runtime Sensor" to be installed in every container.[2] This Wiz software requires highly elevated privileges to a level that the GitLab security risk assessment only briefly describes.[3]
The data Wiz collects on customers appears to allow answering of queries such as:
1. Which containers of government agencies in country X have the xz-utils library installed? Of these containers, what other software is installed alongside? How many of these containers are exposed to the Internet, directly or indirectly?
2. Which government agencies in country X have a publicly exposed service vulnerable to CVE-20xx-xxxx?
3. For top 200 companies, plot the popularity of AWS or Azure service ACME123 over the past 12 months compared to competing Google service ACME456.
Aside from security risks of having sensitive information of entire governments or large organisations hoovered up by Wiz, use of the "Wiz Runtime Sensor" also includes the risk of an incident similar to the failed CrowdStrike Falcon Sensor update of 2024.
The criticisms above are not specific to Wiz. There are many other competing products/services with similarly poor architectures and lack of protection of sensitive IT system information of governments and large organisations.
[1] https://cloud.google.com/architecture/partners/id-prioritize...
[2] https://gitlab.com/gitlab-com/gl-infra/readiness/-/tree/mast...
[3] https://github.com/wiz-sec/charts/blob/master/wiz-sensor/tem...
It helped them “get to the point” quicker and “cleaner”.
The most amazing thing is that Wiz is a fairly young company. Founded in early 2000.
One thing for sure. If this guy ever starts another company, I'm sending my resume :)
There has been a full and total coup of Zionist influence peddles over over the United States government. This is the lens in which you should look at this deal.
The Department of Education is on the verge of being abolished, and the remaining skeleton staff have been redirected to investigate cases of "antisemitism". [2]
The administration is weaponizing 'antisemitism' to unleash once unthinkable retributions against opponents of the State of Israel. The Zionist lobby is using the full levers of the US government to direct their wrath against opponents, and no one is being spared, not universities, students and even entire nations.
It would be naive to think the leadership at Alphabet are unaware of that good things happen when you be good to Zionists.
It's really a shame really, from 'Don't be Evil' to funding decades more years of 'Israeli Americans' using this wealth to funnel to AIPAC and other nefarious political causes. [3]
[1] https://www.timesofisrael.com/trump-israel-literally-owned-c...
[2] https://time.com/7268749/education-department-staff-cuts-imp...
[3] https://www.timesofisrael.com/whatsapp-founder-jan-koum-dona...
Let me guess, when Trump says some crazy exaggeration you will immediately believe him if it sheds a bad light on Israel - but only then. Otherwise you wouldn't believe him because he's a pathological liar right?
The silly thing is he said it was a decade ago and today its the exact opposite, so that doesn't agree with what you said at all.
Wow. I wonder how Google justified this acquisition. I fear they will eventually shutter this service, and likely without even pulling anything good into their own cloud offerings.
G might be the modern day IBM.
You would think G would have the brain power to compete and provide out of the box security for their own platform. I guess the MBA losers at the top have been shaving too much from engineering to do this properly.
The acquisition hiring in big tech is wild to me. And the consolidation of power into a few companies continues.
That was the fastest to $100m ARR in history
> Some nobody company
That was a Decacorn ~3yrs after its founding
> Some nobody company
With ~half of the Fortune 100 as paying customers.
I get it - most people here aren’t in cybersecurity, nor do they understand the space, but let me put it this way - if you are looking for the top 5 cybersecurity companies by mindshare of people in the industry, Wiz is in the conversation.
Just because your ignorant about significant portions of the tech industry doesn't mean you need to be dismissive.
There is no pressure or need to buy Wiz.
While it seems like we aren't getting a ton of people who have used the product in the comments. I can tell you it checks a lot of boxes to make people sleep better at night with customer data in the cloud.
Mandiant wasn't/isn't "cloud security" - they're primarily security research, threat intel, and incident response. Completely different space, customer base, and product set.
Google + Wiz: Strengthening Multicloud Security
https://cloud.google.com/blog/products/identity-security/goo...
Being owned by Google probably would help in those regards too now.
The article says:
> The price tag is much higher than the roughly $23 billion Google had offered for Wiz last year before antitrust worries forced the startup to shelve the deal.
> Wall Street is optimistic that the Trump administration would drop some antitrust policies
Is that it? It's crazy to announce the deal before there's any actual policy changes. Why the rush? It's not like someone is outbidding them here.
> The price tag is much higher than the roughly $23 billion Google had offered for Wiz last year before antitrust worries forced the startup to shelve the deal. ... A harsh regulatory environment in 2024 had made it difficult for many firms to push through large deals, but Wall Street is optimistic that the Trump administration would drop some antitrust policies.
Wiz will do it.
Always happy to see a good exit, good show.
I've worked with cloud for a long time. I sorta blame myself for not seeing the market for this and not starting up my own company. I was too busy messing with machine learning, but never going much beyond sentiment analysis. Had I also stayed on that path, and maybe had a few million dollars in startup Capital laying around I'd be a billionaire by now ( yes this is hyperbole).
Oh well, time to cry myself asleep as a forever middle class software engineer...
And best of luck to the Wiz folks! Whenever I see Google acquisitions I just wonder how long until they end up in the graveyard listing.
Google could have built this in-house.
While millions and billions struggle this is how you do it at high level.
SoonDar goes brrrrrrr.
People who haven't forgotten what happened with Revolv remember.
#/media/File%3AWiz_company_logo.png){kind=link}