Google to buy Wiz for $32B

Thats the kind of a company everyone wants to build in enterprise security.

Incognito unicorns.

There are many companies like these in security space. Another company I can think of is Rubrik. All these large security companies under the radar success.

This is wild to me. As someone in security, Wiz is definitely one of the whales.

It does not make sense. In 2024 Wiz had 10.7% market share. Revenue in the 1,5 to 1,7 Billion but they were not profitable in 2023. Become profitable in 2024 meaning costs are very high.

Also looks like Google is desperate for growth in Cloud and they need to do something.

They are paying as much money as their whole Google Cloud revenue in 2023. Revenue multiple is like 40x times revenue for Wiz. Exceptionally high, even for a high-growth company. Clearly overpaying.

Wiz had nine rounds so massive dilution, and VCs need to recover the money...

$350M ARR in less than 5 years. Aiming towards $1B by the end of 2025.

You never heard of them since perhaps your decisions were not in the cycles of their product. Those who are , heard indeed (type of folks who look at Gartner magic quadrants).

I read their website and there must be something secret they've got cooking behind the scenes cause the valuation makes zero sense to me.

The whole thing reads like all the dozen or so "cloud security" plays out there.

Either I'm missing something big, or their products are outrageously far ahead of all the other similar sounding products out there.

I've been known to roll my eyes at a lot of these sorts of product catalogues in the past though and so I'm definitely biased and not the target audience for their marketing.

Some CIO out there probably really does think that their security problems will finally be over once they purchase another half dozen dashboards click through and look at.

You didn't hear about them last time on HN, when it was $23 billion?

We use them and the product is very very nice and very lightweight to set up. Like for a cloud environment it takes about 5 minutes to get it up and running for a tenant.

They add features weekly or faster.

My company just started using them and I was part of the due dilligence evaluation of their product. I had never been so impressed with a cloud security provider before I started using their product. Absolutely phenomenal product offering l.

Guess what is common between Wix and Wiz....

Tight networks largely. THey've invested heavily into having these "assets" in US tech companies, and so pro-Israel folks in the US work hard to acquire them in.

See [1] to see the flow of people. I explain the connections a lot in [2], and [3] is our initiative to work on it.

[1] https://www.instagram.com/p/DAYsSPxpHFP/?img_index=1

[2] https://www.youtube.com/watch?v=LxvaembyMcQ&list=PLjHqnRFDnc...

[3] https://www.ethics.vc/get-involved

Military service in Israel is mandatory and the conscription rate in the core "educated" areas is ~90%. Each year, the intelligence corps then gets what is practically* first pick of the best minds of that year (typically kids who are already skilled in programing). They then get to have them for 4-6 years meaning unlike modern employers, they have time and motivation to invest in training them. Then you get the most apt programming minds of a generation spending six years together learning and building connections with each other in core programming and security skills.

Imagine if all the ivy league graduates in the US would be forced to work together for the same company, for free, for 4-6 years. Would you be surprised if suddenly former employees of that company found ways to become very successful in business?

* - Technically they get something like 3rd pick and there's negotiations and it depends on what sort of roles are involved etc. In practice, conscripts have some influence on where they'll go and if you have a choice in any role in the military, you are going to pick "write code in an air-conditioned office" over any other available option.

Intelligence communities tend to pick very smart people who are particularly good at acquiring niche skills and operating under extreme situational uncertainty. I think those are valuable attributes for someone in business.

Network

Blackmail

I swear some tech company acquisitions appear like more expensive art purchases for for when you need to launder larger amounts of money...

You are on to something. It is a company of the chosen.

This is the logo I envision in my head when hearing Wiz.

The primary founder (Nir Zuk) is a Unit 8200 alumni, as are the founders of Checkpoint and a bunch of other cyber security companies. Nir Zuk is also a US citizen and went out of his way to base PANW in the US, including their hardware manufacturing and software engineering operations.

You'll find former-intelligence blob operators in a great many cyber security companies. Including former American intel employees[0]. Hell, the CIA basically has their own VC fund[1].

Also, there is zero evidence any of these people are currently acting at the behest of their former employers, apart from obviously the CIA venture fund acts at the behest of the CIA.

0 - Robert M Lee https://dragos.com, Keith Alexander (formerly https://ironnet.com,) amongst many others

1 - In Q Tel https://www.iqt.org/

[flagged]

Military service is compulsory in Israel, so being a former member of 8200 isn't exactly unusual. Given the choice between spending two or three years as deployed infantry, or writing code in an air-conditioned office, I suspect a few of us here would choose the latter.

WTF does that mean?

> Look at the number of times other tech companies get hacked compared to Google.

Your whole post is confusing Security of the Cloud with Security in the Cloud. And conflating GCP with Google but those are just examples of why GCP has such a small market percentage.

Having previously used AWS, I would also say that GCP IAM is much better.

Yes, it's a lot less flexible than AWS IAM, but complicated IAM policies with conditions and stuff can be really hard to reason about.

Disclosure: my thoughts are my own.

Adding to it: deps.dev, osv.dev, SLSA (all are either free or fully open source) Google has been great contributor to the AppSec and Software Supply Chain community. I just pray daily that the “google graveyard” curse doesn’t touch these important projects.

> (I believe that was the first time a major company admitted to being hacked by government). That was a major turning point. Ever since then it's been "never again".

There was one other time Google was hacked by a major government that also spurred massive internal security posture changes! https://en.wikipedia.org/wiki/Snowden_effect#Tech_industry

I think this is also a good argument for why it is beneficial for society that Chrome stays in Alphabet; Google is good at some things and bad at some things - that people have access to a reasonably safe browser for free should not be underestimated

To me, the security posture of Android (esp, the Pixels) & Chromium stands out as an outstanding contribution to humanity (given the reach of both those platforms).

> Google got hacked in 2009 by China (I believe that was the first time a major company admitted to being hacked by government).

Do they mind if they're legally "hacked" by a (Western) govt? All that security sophistication couldn't prevent LEAs from owning us all, unfortunately: https://therecord.media/google-refuses-to-deny-it-received-u... / https://archive.vn/mzZtI

As a GCP user, my view is that Google does Googly things and hopes others will use them. And if not enough people don’t buy into whatever Google builds because it is built by Google, they will cancel it.

These are all Google things. How do I benefit from them as a GCP customer?

We have a relatively modest commit with GCP, around $1M a year, and have a dedicated account rep who I can contact whenever I need to. In fact, we've had a similar relationship even when we were half the size.

Google simply does not have a culture of giving a shit about people's experiences with their product. If you are having a problem you better either have that problem so frequently and severely that it shows up on whatever monitoring system they're using to evaluate release health, or you better get comfortable with it for the long haul.

I previously worked for a startup that used GCP with a less than 7 figure spend each year and we had no problems talking to people at Google.

This is such an underrated weakness of Google. When I was working at AWS ProServe, we never even took GCP as a serious competitor. Their customer service, acount management and enterprise sales team was so horrendous it was laughable.

I don’t think we even had talking points about why AWS was better than GCP like we did Azure.

Yep. That is top of my list when choosing a cloud provider.

Why do you think some of the largest companies are using GCP though? If there customer support is really that atrocious, what is the explanation?

GCP has been doing more multi cloud stuff lately though: Anthos for K8s in other clouds, BigQuery Omni for bigquery in other clouds

I'm slightly baffled by this acquisition but arguing against you actually helps me make some sense of it.

If Google wants to be "the best of the best" at security and some set of potential customers use Wiz as their "best of the best" security, then this is a way to convert those customers to Google.

Consider some org that prioritizes security, like at the board level. They maybe don't really care about the nickel and dime cost of AWS vs. Azure vs. GCP since it comes out to 10s or 100s of millions of opex in the end. What they do care about is the cleanest record possible with respect to security. And Wiz is a key component to their position on security that is communicated to investors - it is a social proof that they are taking security very seriously.

This now becomes a tool for Google when trying to win their business. By degrading the value of Wiz on AWS/Azure/Oracle/Salesforce they are taking away that bullet point on security for a subset of competitors customers. And that may entice some of them to move their entire cloud service to GCP. So whatever revenue they lose on the Wiz side from a dozen or so cancellations they would hope to make up with a few 100 million dollar whales.

I just find it hard to believe that enough whale level cloud compute business will be generated in this way to justify $32b. This is really the best take I have on the acquisition and it feels unsatisfying, as if there is some other decisive information that would provide a justification for such a valuation.

Maybe there is some government mandate coming down the pipeline that isn't very public yet? Some kind of legislation that will force companies to adopt stricter security policies? That could precipitate the kind of changes that would justify this kind of massive valuation.

that would immediately shed half the value of the company and Google would need to book a huge loss

e.g. half of Fortune 100 use Wiz and I assure you most of them do not use GCP (or do not use only GCP)

I don't think that makes much sense in business. They want to move customers from competitors and as an underdog you need to provide some migration path. You don't get these kind of system integration freely. Provide your service in competitors to smooth their transition path but keep the latest and best features in GCP. This was the idea of k8s.

Except their ARR is $500m and not $2bn. So that's x60?

Google's whole business for the last 20 years has been buying, growing, and profiting handsomely from acquisitions.

Fastest growing but because they participated in a pay-for-play kickback scheme [1][2]?

So that number isn't really signal. Now that they're not paying CISOs to adopt the product they're not going to be growing as fast.

[1] https://www.bankinfosecurity.com/blogs/cyberstarts-program-s... [2] https://www.calcalistech.com/ctechnews/article/b1a1jn00hc

We all know a lot of people frowned when YouTube was acquired.

Now we know that was an excellent deal for Google (now Alphabet), despite being a long bet.

Good to have top security talent and good cloud security tooling if you're in a cloud play.

According to a few articles (and Reuters) it is $500m/year

P/E is the earnings multiple, not revenue. Your assuming high margins is doing a lot of legwork here. Often untrue for growing startups.

They advertise "Unified visibility and security across code, CI/CD, and cloud environments" - maybe it's google's way to siphon off proprietary code from private Azure and AWS environments in order to train their AI. Google does not own Github, they must be severely lacking in private training data.

When you use a cloud provider to setup a VM, what policies do you apply to it in order to ensure it’s secure?

Wiz and other tools in the same space tell you and tracks compliance across your fleet.

Idk if wiz does this, but their competitors have “compliance packs” which are preset compliance patterns, IE hipaa, finra, etc.

That way you click a button and it tells you every change you need to make to be compliant

Edit: this is all just examples

it's a linter for your yaml spaghetti

I thought they made smart lightbulbs (I have some "WiZ" ones installed in fact).

thank you for asking on behalf of the many of us who are in the same boat.

If you don't mind a short blog post I run though the capabilities of something like Wiz: https://rakkhi.substack.com/p/choosing-the-best-cloud-native...

Wiz by itself is a great business and public markets will price it accordingly, but Google is able to price it much higher because of its unique position. Wiz + GCP sales team will boost adoption of the main product, a Google branded security tool keeps eyes from looking out, and of course, the ability to move huge amounts of revenue from competitors over to GCP is something only a hyper-scaler can tap. At 36x+ valuation, this is still a great deal for Google.

A lot has happened in the last 56 days that has resulted in significant uncertainty in the stock markets. That, combined with the higher offer, apparently changed the board's mind.

> Wonder what that implies about the larger IPO/exits market

The window is closed and locked. Haven't closed the storm shutters yet.

LOL IPO market is dead for observable future.

There are ways around it. If they look into specific customer's usage it is looking at customer data. If they look at more customers it will just be called anonymous analytics.

Then you slice and dice the analytics data to extract what you need in the name of planning & improving the product.

It's pro for Google, not pro for customers.

They don’t need to force people, just make them a very good targeted offer. This is also great for seeing which features their customers use most to help GCP catch up to the competition, too.

It doesn't force them to move, it just gets Google the information about how you use competitors products so they can out negotiate them come deal time.

Wiz itself doesn’t. But Wiz knows what is going on in everyone cloud. That data could be fed to GCP sales team though customers might riot if that happens.

There's no force but Google can now leverage the data from Wiz to target good customers for other services.

Wiz is a CNAPP provider. (Cloud Native App Protection Platform)

na you're right this would be a dumb move with a huge blow back

I'm guessing you would be the same guy who wouldn't torrent millions of books and copyrighted works to train your LLM. Zuck can afford not to care about that pesky detail

You are not naive, you are not considering that at certain scales, your concerns are the cost of doing business.

Facebook did exactly this with a VPN acquisition. They didn't break into customer data; they just mined it for usage patterns.

So as a pure speculation on Goog's motives, it doesn't sound farfetched enough to call ridiculous. Competitive data is valuable, particularly if you want to strangle the youth in their cradles (or acquire them).

> actually outrageous claim that Google will use this to illegally siphon customer data

Hypothetical question as much as anything: If Google purchases a company and the data the company stores about their customers, is it illegal for them to use this data for whatever they want?

Lets say it would give them an understanding of what features from AWS people tend to use the most, and they use that to improve Google Cloud, would that be illegal?

This is an incredibly useless comment [0]

At least say why you think so and contribute to the conversation a bit.

[0] https://news.ycombinator.com/newsguidelines.html#comments

"Trust" screams insecurity. Security is in the direction of trustless rather than requiring trust. Do you trust companies which say front and center "you can trust us"?

Wiz is a "security product"? Security isn't something you can buy and bolt on to your systems as an afterthought. It doesn't work like that!

I trust open source code I can see and compile and control. :)

How is "trusting wiz" (trusting some icons on website controlled by wiz leading to publicly inaccessible reports, half of which are done by a single company somewhere in Florida) related to what Google might do with it after aquisition?

> Google has the best security.

Care to elaborate?

Jimmy switched the numbers!

Discussed last year in the linked HN subthread.

It's based on your workload you are using it for basically. So its not a set price.

Whatsapp when it was acquired cost $1/year (with a year long free trial) and had a billion users and 55 employees. They were printing money.

Just to respond to the Whatsapp part of the comment, apparently Whatsapp made about $1.7 billion in 2024. https://www.businessofapps.com/data/whatsapp-statistics/

Like for whatsapp, they're buying the database, not the product.

Revenue and profit are very different. Like, it's easy to pump revenue at a loss.

I don't really see the benefits of this acquisition for Google, but congrats to the Wiz team!

WhatsApp purchase was for that sweet sweet data of everyone's contact lists (this was their original innovation for onboarding — just give us access to your phone book and we'll tell you who else is on WhatsApp). Their earnings were completely irrelevant in price discussions. The billions were paid for the dataset.

I think the main calculus is around estimating future profits. Do they make a profit? Is it a crowded space? Is the market space growing? What assets do they have? People, land, factories, or intellectual IP? Etc etc.

I don’t know the details of either deal but it’s easy to imagine a case where Craftsman tools is just a brand in a crowded market with no special sauce. For example Sears never even made the tools, they outsourced it. Also it sold for 900m, 500m was the initial payment.

Nobody thought Instagram and WhatsApp were good acquisitions at the time.

Instagram was roughly 10 people when it got bought, had less than 30M users and $0 in revenue.

This: "But like all bs startups Wiz will fade into irrelevancy 6 months after being acquire"

I don't know man, iPhones and Macs are really buggy, bloated/full of unnecessary features, and user hostile. Microsoft products are also hot garbage. The cars we get to pay tens of thousands (or even hundreds) are pretty much garbage now. It's not just Google.

Some policy is being continued, https://natlawreview.com/article/antitrust-under-trump-initi...

> FTC Chairman Ferguson and Omeed Assefi, Acting Assistant Attorney General of the DOJ’s Antitrust Division, announced on February 18, 2025, that the FTC and DOJ will continue to use the 2023 Merger Guidelines as the framework for their merger review process.

Rump likes to play favorites and use any power at his disposal to hurt his political / personal enemies or people he thinks don't "respect" him enough. He also is a fan of extorting people.

So I wouldn't count on it based on some generic "pro-business" position. Google is going to have to kiss the ring one way or another.

Depends on how many complements Google gives the emperor on his clothes. The DOJ reiterated selling off chrome last week, so it's not off the table.

I just don't think the anti trust case is as strong in the security industry vs. many other parts of the software industry. I don't think a Biden admin would necessarily have jumped to try and block this sort of acquisition either.

GOOG is up ~152% since Sundar took over...

What do you know, Assaf Rappaport also worked at McKinsey.

Ultimately they are buying the shares of all existing shareholders. Wiz tells Google who the shareholders are after all triggers of options to shares are resolved. Then Google wires each shareholder after the signatures are complete. No money should go into Wiz bank account. 10-25% of the cash is held back to make sure the company and key employees fulfill promises made as part of the transaction.

What if I don't want to pay capital gains?

The press releases say cash deal.

In cybersecurity history or the history?

I have 'wiz' lights in my place - home-networked lighting system. Which works. Well. For me....so glad g hasn't acquired them.

>> Growing up in the NYC area this is what I think of when someone says the wiz https://en.wikipedia.org/wiki/The_Wiz_(store)

Growing up in NYC, it is was impossible to not remember the "Nobody Beats the Wiz" jingle

As a fan of British comedy, this is what I think of when I hear wiz: https://en.wiktionary.org/wiki/wiz#Etymology_2

[narrator]: Excellent, until now! Soon, their beloved cloud infra security scanner will to be sucked dry of all the juicy usage data on AWS and Azure customers, bled of its innovation, to be discarded in a few years time...

I like it too. Don't care much for google buying them, it can only end badly.

[flagged]

[flagged]

What I read is that last year they weren't sure yet if they wanted to go public instead, but the current financial climate isn't good for going public so they went for an acquisition instead.

[flagged]