Wiz — cloud security platform, fastest-growing software company ever by some accounts
September 14 at 04:29 · $0.134 total
Investment Memo: Wiz
Date: Hypothetical Series A
Thesis
Wiz is a potential fund-returner because it attacks the largest and fastest-growing pain in enterprise security — cloud misconfiguration and vulnerability risk — with an agentless, graph-based platform that can become the system of record for cloud security. The founding team previously built Adallom, sold it to Microsoft for $320M, and then ran Microsoft’s cloud security group. That gives them rare insight into both buyer psychology and hyperscaler limitations. If Wiz executes, it can reach $1B+ ARR and define a new category. Later public data validate this: Wiz reportedly reached $100M ARR in ~18 months, $350M by 2023, $500M by 2024, and Alphabet agreed to acquire it for $32B in 2025. At Series A, the combination of team, market, and early product signal justifies investment.
Product & Wedge
Wiz scans AWS, Azure, GCP, and Kubernetes without installing agents. In minutes, it builds a graph of compute, identity, network, and data resources, then correlates vulnerabilities, misconfigurations, exposed secrets, and excessive permissions to surface “toxic combinations” — e.g., an internet-exposed VM with admin role and a critical CVE. The wedge is replacing fragmented CSPM, vulnerability management, and cloud inventory tools with one prioritized risk engine. Security teams get immediate value; developers get a single pane of glass. Land is security; expansion is to cloud/platform teams and eventually runtime protection, IaC, and data security.
Market & Competition
Cloud security spending was already $10B+ and growing >20% annually, accelerated by COVID-driven cloud migration. Competitors include Palo Alto Prisma Cloud (broad but heavier, agent-based legacy), Check Point CloudGuard, Lacework (agentless but weaker graph/prioritization), Orca Security (closest agentless rival), Aqua Security and Sysdig (container/runtime), Microsoft Defender for Cloud and AWS Security Hub/GuardDuty (native but single-cloud and less risk-prioritized). Wiz’s differentiation is speed, cross-cloud visibility, and graph-based risk prioritization. However, incumbents have distribution and hyperscalers can bundle.
Traction & Business Signal
At Series A, Wiz had just emerged from stealth (December 2020) with reported Fortune 500 design partners and a large funding round. Revenue, NRR, logo count, and burn were not publicly disclosed — unknown. Later public reports indicate $100M ARR within 18 months of launch, $350M ARR by 2023, $500M ARR by 2024, and a $32B acquisition agreement with Alphabet in 2025. These are exceptional signals, though not knowable at Series A.
Risks
- Hyperscaler bundling. Microsoft, AWS, and Google can give away basic CSPM and use native telemetry to undercut Wiz. If they close APIs or bundle equivalent risk prioritization, Wiz’s paid wedge could erode. This is the most likely kill: Wiz becomes a feature, not a platform.
- Platform expansion execution. Wiz’s initial wedge is visibility and prioritization. To become a fund-returner, it must expand into runtime protection, IaC, data security, and more without losing product quality or sales efficiency. Many cloud security startups stall at $50–100M ARR because they cannot cross from security team tool to enterprise platform. If Wiz remains a point solution, its ceiling is a $1–2B acquisition, not a $10B+ outcome.
- Capital intensity and valuation mismatch. At Series A, Wiz raised large capital at a high valuation. Hypergrowth requires heavy sales, marketing, and R&D. If growth decelerates due to competition or macro, the valuation cannot be defended; a down round or modest acquisition would cap returns. For a fund-returner, Wiz must become an independent category leader, not just a fast-growing startup.
Verdict
Invest at the hypothetical Series A. The team, market, and wedge are exceptional, and later public signals confirm the thesis. The one question I would need answered first: “Beyond agentless scanning, what is the durable data/network effect moat that prevents Microsoft or Palo Alto from replicating the graph and bundling it for free?” If the answer shows a proprietary risk graph that improves with each customer and spans multiple clouds, I would invest.
Thesis
Wiz could be a fund-returner because it appears to have compressed the time required to build a large, enterprise-grade security company. The core opportunity is not merely “cloud security”; it is becoming the control plane for how enterprises understand and reduce risk across their entire cloud estate.
The company’s most compelling attributes are unusually strong in combination: a painful and expanding problem, a product that can be deployed quickly, a sales motion capable of reaching large enterprises, and evidence of exceptional revenue growth. If Wiz becomes the default security layer across AWS, Azure, Google Cloud, and other environments, it could support a multibillion-dollar revenue business with durable strategic value to platform vendors, cybersecurity consolidators, and public markets.
The fund-return case depends on Wiz becoming a system of record for cloud risk—not a point tool that is eventually absorbed by Microsoft, AWS, Palo Alto Networks, or another incumbent. The market is competitive, but the category is still being defined. A company that owns the data model, workflow, and executive reporting layer could compound into adjacent areas including cloud detection and response, identity risk, vulnerability management, data security, and application security.
Product & wedge
Wiz is a cloud security platform commonly categorized within CNAPP—cloud-native application protection platforms. Its initial wedge is agentless discovery and risk assessment across cloud environments. Wiz connects to a customer’s cloud accounts, maps assets and relationships, identifies vulnerabilities, misconfigurations, exposed services, identities, and attack paths, and prioritizes the combinations most likely to create material risk.
The important product insight is that individual findings are less useful than correlated risk. A vulnerable workload is not necessarily dangerous; a vulnerable workload exposed to the internet, connected to sensitive data, and accessible through an overprivileged identity is. Wiz’s graph-oriented approach is designed to surface those attack paths.
Agentless deployment is a strong enterprise wedge. Security teams can obtain broad visibility without installing software across every workload, waiting for application teams, or disrupting production. That supports rapid proof-of-value and can shorten time to initial deployment. From there, Wiz can expand into runtime protection, cloud detection and response, vulnerability remediation, data security, and developer workflows.
Its limitation is that visibility and prioritization must ultimately lead to prevention or remediation. If Wiz becomes a dashboard that produces more findings than customers can act on, incumbent platforms with deeper enforcement capabilities may win.
Market & competition
Cloud adoption, software supply-chain complexity, identity sprawl, and regulatory pressure create a large and growing market. The relevant market is broader than cloud posture management, but its boundaries are contested and the ultimate category size is unknown.
Competition is intense. Palo Alto Networks competes through Prisma Cloud and has broad security distribution, a large sales force, and capabilities spanning network, workload, application, and cloud security. Microsoft competes through Defender for Cloud and benefits from privileged access to Azure, Microsoft 365, identity, and enterprise procurement. AWS and Google Cloud offer native security products that are increasingly integrated into their platforms.
Specialist competitors include Orca Security, Lacework, Sysdig, Tenable, CrowdStrike, Rapid7, and Snyk, depending on the workload and use case. Wiz also competes indirectly with cloud-native engineering tools, internal security platforms, and consulting-led approaches. Its advantage must therefore be measurable deployment speed, superior risk prioritization, and a materially better user experience—not simply a larger feature checklist.
Traction & business signal
Publicly reported company figures indicate extraordinary growth. Wiz was founded in 2020 by Assaf Rappaport, Ami Luttwak, Yinon Costica, and Roy Reznik, previously associated with Adallom and Microsoft. The company has publicly stated that it reached $100 million in annual recurring revenue roughly 18 months after launch, $200 million in 2022, and approximately $500 million in ARR in 2024. These figures are company-reported rather than independently audited.
Wiz has raised substantial capital from investors including Sequoia Capital, Index Ventures, Insight Partners, Greenoaks, and Andreessen Horowitz. Public reports have described customers among major global enterprises, but exact retention, gross margin, customer concentration, cohort expansion, sales efficiency, and implementation costs are unknown. The proportion of revenue from its original posture-management wedge versus newer products is unknown. Net revenue retention is unknown, as are churn and the percentage of ARR contracted under multiyear agreements.
The business signal is nevertheless compelling: rapid adoption, strong brand awareness, and apparent ability to sell into sophisticated enterprises. The missing metrics are precisely those required to distinguish durable product-market fit from highly efficient, heavily subsidized growth.
Risks
1. Incumbent platform bundling could kill the deal. Microsoft, AWS, and Palo Alto can bundle security into broader contracts, underprice standalone functionality, and integrate more deeply into enforcement layers. Wiz must prove that independent, cross-cloud visibility remains valuable enough to overcome bundling.
2. The product may not translate into durable operational ownership. Security buyers may love fast discovery but fail to renew if engineering teams do not remediate findings or if Wiz does not become embedded in prevention and response workflows. The key risk is high initial enthusiasm with weak expansion and retention.
3. Valuation and growth quality may be incompatible. Wiz’s headline growth creates a risk that investors underwrite exceptional performance indefinitely. If growth depends on large enterprises, expensive sales cycles, discounts, or a narrow set of early adopters, the eventual margin profile could disappoint. Exact sales efficiency and cohort economics are unknown.
Verdict
Invest at a hypothetical Series A, subject to unusually rigorous diligence. The product wedge is clear, the market is large, and the early growth signal is rare enough to justify backing a category leader before the category fully matures.
The one question I would need answered first is: What are Wiz’s dollar-based net retention, gross margin, CAC payback, and renewal rates by customer cohort—and do customers expand from visibility into higher-value prevention and response products? Without evidence of durable expansion, this may be a spectacularly successful feature rather than a fund-returning platform.