Security Week

What’s Behind Google’s $32 Billion Wiz Acquisition?

Ryan Naraine Published: March 19, 2025 | Updated: March 19, 2025 4 min read

Just shy of two years after its blockbuster $5.6 billion all-cash acquisition of Mandiant, Google announced another seismic move in the enterprise cybersecurity business with plans to shell out an eye-popping $32 billion to acquire hotshot Israeli startup Wiz.

The proposed deal, which comes a year after Wiz walked away from a $23 billion offer, is a high-priced declaration that Google is serious about challenging the entrenched players in enterprise cloud security, reordering the competitive landscape with Microsoft, and reshaping how investors think about funding cloud security startups.

Google has long struggled for relevance in enterprise cybersecurity (despite strong attempts with Chronicle and VirusTotal) but with the addition of Wiz’s technologies alongside Mandiant assets, the company is chasing an ambitious strategy to integrate reactive and proactive security solutions under one roof.

Today, Google hawks threat intelligence and security operations products under three pillars:

Google Threat Intelligence delivers detailed, timely, and actionable threat data so security teams can understand and counter emerging risks.
Google Security Operations aggregates telemetry data to identify high-priority threats and drive automated response through playbook automation and collaboration.
Mandiant Consulting brings incident response expertise and a deep understanding of global attacker behavior, skills honed through handling some of the largest enterprise data breaches.

Into this mix, Google is adding the highly-touted Wiz platform to scan cloud environments across all major clouds to build a comprehensive graph of code, resources, and connections.

The Wiz product pinpoints potential attack paths and prioritizes risks based on impact, promising tooling for enterprise developers and security teams to secure applications before deployment.

In short, while Google’s existing threat-intel and SOC services react to threats, Wiz is designed to preempt them, offering a seamless, unified security platform that covers every stage of development and operations.

The vision is obvious: a unified security platform that protects code, CI/CD pipelines, and cloud infrastructure (across all major clouds) with the power of Google’s AI investments driving everything from threat detection to automated incident response.

The Google/Wiz transaction is certainly ruffling feathers at Microsoft. Wiz was founded by ex–Microsoft engineers and made its name by securing Microsoft Azure deployments and exposing gaping security flaws in Redmond’s enterprise cloud code.

Advertisement. Scroll to continue reading.

Wiz is also a key security partner for Microsoft Azure, integrated deeply through co-selling arrangements and even recognized as a top Marketplace partner. Now that Wiz is part of Google Cloud’s arsenal, Microsoft faces the dual challenge of filling the gap left by Wiz and reinforcing its own cloud security narrative.

In a market where multi-cloud strategies are increasingly the norm, Microsoft must ensure that its native offerings can effectively counterbalance the appeal of a Google-backed Wiz that spans all cloud environments.

The timing is also crucial, coming on the heels of a scathing CSRB (Cyber Safety Review Board) report that criticized Microsoft’s culture and triggered a major ‘Secure Future Initiative’ overhaul of Redmond’s cybersecurity practices.

At the time, Google published a sharp statement warning of “long-standing risk to public-sector organizations using the same vendor for operating systems, email, office software, and security tooling” and called on the government to mitigate risks from a Microsoft-centric monoculture.

For venture-backed cloud security startups, particularly those in the DSPM (Data Security Posture Management) space, the Wiz exit at a premium valuation validates the enormous potential in this space.

However, there’s a darker side: such consolidation could stifle competition by reducing the number of independent players, pushing emerging startups to either align with larger platforms or risk being edged out by giants with near-unlimited resources.

The fallout may also extend to venture capital behavior. With the promise of multi-billion-dollar exits, investors might double down on funding the next Wiz-like company. Yet, this trend risks narrowing the field to a few “winners” who ultimately become acquisition targets instead of a healthy ecosystem of independently operating innovators.

Wiz’s decision to sell, rather than navigate through an IPO, is also a strong signal that M&A might be the safer and more lucrative exit strategy for high-growth security startups. The premium Google paid — reportedly a 92% increase over Wiz’s previous valuation — suggests that the next wave of cybersecurity innovation might be locked up in the portfolios of tech giants rather than floating independently on public markets.

The implications are significant: fewer IPOs mean less diversity in publicly traded cybersecurity stocks, potentially reducing options for investors seeking to capitalize on the sector’s long-term growth.