Wiz — cloud security platform, fastest-growing software company ever by some accounts

Investment Memo: Wiz

Prepared as a hypothetical Series A evaluation (circa late 2020, when Wiz raised its actual Series A)

---

Thesis

Wiz is a bet that cloud security is being rebuilt from scratch — and that the winning architecture is agentless, graph-based visibility across the entire cloud estate rather than point tools bolted together. The team (Assaf Rappaport, Ami Luttwak, Yinon Costica, Roy Reznik) previously founded Adallom, sold it to Microsoft for ~$320M, and then ran Microsoft's Cloud Security Group. This is arguably the single best-credentialed founding team in security: they've built, sold, and operated at hyperscale in exactly this category.

The fund-returner logic: cloud infrastructure spend is compounding at 25%+ annually, security is the #1 stated blocker to cloud adoption, and the incumbent tooling (agent-based, siloed by function) generates alert fatigue rather than prioritized risk. If Wiz becomes the system of record for cloud risk, it's a $10B+ outcome in a market where Palo Alto Networks and CrowdStrike prove security platforms sustain premium multiples. In hindsight this thesis validated spectacularly — Wiz reportedly hit $100M ARR in 18 months (fastest ever claimed), $500M ARR by 2024, and agreed to be acquired by Google for $32B in 2025.

Product & Wedge

The wedge is deceptively simple: connect via cloud APIs (read-only, no agents), scan every workload, and build a security graph correlating vulnerabilities, misconfigurations, exposed secrets, identity permissions, and network exposure. Instead of 10,000 undifferentiated alerts, Wiz surfaces "toxic combinations" — e.g., an internet-exposed VM with a critical CVE and admin credentials to production data. That's the attack path that actually matters.

Deployment in minutes rather than months is the go-to-market unlock: a POC that produces jaw-dropping findings on day one. From this wedge (CSPM/CWPP, now called CNAPP), Wiz can expand into vulnerability management, DSPM, container security, and eventually runtime — a land-and-expand motion into the entire cloud security budget.

Market & Competition

The CNAPP market is projected to exceed $15–20B by the late 2020s. Real competitors:

• Palo Alto Networks (Prisma Cloud) — the assembled incumbent, built from ~6 acquisitions (RedLock, Twistlock, etc.); broad but fragmented UX.
• Orca Security — the closest analog; also agentless, also Israeli, filed patent disputes against Wiz. Genuine head-to-head competition.
• Lacework — heavily funded ($1.9B raised), but stumbled badly; ultimately sold to Fortinet for a fraction of peak valuation.
• CrowdStrike & SentinelOne — pushing into cloud from endpoint strength; agent-based DNA.
• Cloud providers themselves — AWS Security Hub, Microsoft Defender for Cloud, GCP Security Command Center. Free-ish, native, "good enough" risk.
• Aqua Security, Sysdig — container/runtime specialists.

Wiz's differentiation is less any single feature than execution velocity and the graph data model, which is hard to retrofit onto acquired point products.

Traction & Business Signal (publicly known)

• Founded January 2020; reportedly $100M ARR within 18 months — publicly claimed as the fastest software company ever to that mark.
• $350M ARR by 2023; $500M ARR by early 2024 (company-stated).
• Customers publicly cited: 40%+ of the Fortune 100, including BMW, Salesforce, Morgan Stanley, Slack.
• Raised >$1.9B total; valued at $12B (2023), $16B (2024); $32B Google acquisition agreed March 2025.
• Unknown: gross margins, net revenue retention, sales efficiency/CAC payback, actual burn rate, ARR verification (all figures are company-reported, not audited public disclosures), win rates vs. Orca and Palo Alto.

Risks (the three that actually kill the deal)

1. Hyperscaler commoditization. Wiz reads data via cloud provider APIs. AWS, Microsoft, and Google own the platform, the data, and the customer relationship, and each ships native security tooling. If Defender for Cloud or AWS gets to "80% as good, bundled free," Wiz's premium pricing collapses. Microsoft in particular knows this team and this playbook intimately. (Mitigant: multi-cloud neutrality is precisely what natives can't offer — and Google ultimately decided to buy rather than compete.)

2. Agentless ceiling. API-based scanning gives snapshots, not runtime protection. If the market decides real-time detection/response is table stakes, agent-based players (CrowdStrike, Palo Alto) hold structural advantage, and Wiz must build or buy its way into runtime — a different engineering discipline. Wiz's later runtime sensor launch confirms they saw this risk.

3. Category consolidation before Wiz reaches escape velocity. Security buyers are exhausted by tool sprawl; CISOs are consolidating vendors onto Palo Alto/CrowdStrike platforms. A four-product startup competing against a bundle discounted to near-zero inside a $5M enterprise agreement can lose deals on price despite winning on product. Lacework's collapse shows how fast a hot CNAPP company can crater.

Verdict: INVEST

At a hypothetical Series A, this is as close to a mechanical yes as venture offers: a repeat founding team with a category-defining exit, in a massive tailwind market, with a product wedge (agentless graph) that produces instant demo value. The valuation will be brutal and the entry price uncomfortable — pay it. Team quality of this caliber in security appears perhaps once a fund cycle.

The one question to answer first: What are actual competitive win rates and pricing outcomes in head-to-head deals against Microsoft Defender for Cloud and bundled Prisma Cloud? If Wiz wins on product but consistently concedes 40%+ on price against bundles, the terminal margin structure — and the fund-returner math — breaks.

Thesis

Wiz could be a fund-returner because it sits at the intersection of three unusually attractive dynamics: cloud adoption, escalating cyber risk, and a fragmented security stack that customers increasingly want to consolidate. Its core promise is simple and economically valuable: give security teams a continuously updated view of everything running in their cloud environments, identify the exposures that matter most, and help them remediate them without deploying agents everywhere.

The potential venture outcome is not merely “another security product.” Wiz could become the control plane for cloud security—an enduring system of record for identities, workloads, data, vulnerabilities, network exposure, and attack paths across AWS, Azure, Google Cloud, and Kubernetes. If it becomes embedded in security operations and executive risk reporting, it can expand from posture management into vulnerability management, cloud detection and response, identity security, data security, and remediation workflows.

The company’s reported growth is extraordinary. Public reporting has described Wiz as reaching $100 million of annual recurring revenue roughly 18 months after founding, $350 million in ARR in 2023, and $500 million in 2024. Those figures are company-reported or reported by the press, not independently verified financial statements. Even allowing for uncertainty, this is the kind of adoption curve that can support a very large outcome—provided growth is not being purchased through unsustainable discounts or concentrated in a handful of customers.

Product & wedge

Wiz’s wedge is agentless cloud security. It connects to cloud environments through APIs and builds a graph of assets, identities, configurations, vulnerabilities, network paths, and sensitive data. The product then prioritizes exploitable attack paths rather than presenting security teams with an undifferentiated list of thousands of alerts.

That matters operationally. Traditional security tools often require agents, complex deployment, or separate products for each cloud and workload type. Wiz’s “read-only, quick deployment” model lowers implementation friction and allows a chief information security officer to assess an entire cloud estate quickly. The buyer can begin with visibility and posture management, then expand into vulnerability management, cloud workload protection, identity exposure, and data security.

The strongest product signal is likely not any individual feature but the potential to become the shared context layer across security teams. A platform that understands how a vulnerable workload, an overprivileged identity, an exposed network path, and sensitive data connect can create much better prioritization than point tools can.

Market & competition

The market is large, urgent, and crowded. Public-cloud infrastructure spending is measured in hundreds of billions of dollars annually, while cloud security spending is a substantial and growing subset. Regulation, ransomware, software supply-chain incidents, and board-level scrutiny should sustain demand.

Real competitors include Palo Alto Networks’ Prisma Cloud, Microsoft Defender for Cloud, Orca Security, Lacework, Sysdig, Aqua Security, CrowdStrike’s cloud security products, Tenable Cloud Security, Rapid7, and Google’s Mandiant/CNAPP offerings. AWS, Microsoft, and Google also have a structural advantage: they control the underlying clouds and can bundle security into broader enterprise contracts.

Wiz’s differentiation is ease of deployment, cross-cloud visibility, graph-based prioritization, and an unusually polished user experience. However, these advantages are not guaranteed to remain unique. Hyperscalers can improve native tooling; platform vendors can bundle aggressively; and security incumbents can acquire or build equivalent functionality. The strategic question is whether Wiz becomes the neutral layer customers need across clouds, or merely a premium interface that clouds and large security suites eventually replicate.

Traction & business signal

Publicly known signals are strong. Wiz was founded in 2020 by Assaf Rappaport, Yinon Costica, Roy Reznik, and Ami Luttwak, who previously built Adallom, acquired by Microsoft. The company reportedly reached $100 million ARR in approximately 18 months and later announced or was reported to have reached $350 million ARR in 2023 and $500 million in 2024. It has publicly referenced customers among major enterprises, including Fortune 100 companies.

The company has also raised capital at rapidly increasing valuations, including a reported $10 billion valuation in 2024. Microsoft reportedly explored acquiring Wiz for approximately $23 billion in 2024, although the transaction did not close. Those events are meaningful validation of strategic importance but are not proof of durable economics.

Unknown: audited revenue, gross retention, net retention, customer concentration, average contract value, sales efficiency, implementation costs, free-cash-flow profile, percentage of ARR from new versus existing customers, and the proportion of revenue tied to discounts or multi-year prepayments. Unknown also is how much usage is genuinely mission-critical versus dashboard visibility that could be replaced by bundled tools.

Risks

1. Platform encroachment and commoditization. The deal fails if AWS, Azure, Google, Microsoft, or Palo Alto can deliver “good enough” cloud security bundled into existing contracts. Wiz must prove that neutrality and superior prioritization create enough value for customers to pay separately.

2. Growth without durable economics. The reported growth could conceal high sales-and-marketing intensity, discounting, channel dependency, or weak retention. If expansion is not exceptional, Wiz may be a large but ordinary software company priced like a category-defining platform.

3. Product breadth and execution risk. Cloud security is becoming a suite market. Expanding into identity, data, runtime, detection, and remediation creates cross-sell opportunity but also product complexity and competitive overlap. A company that wins on simplicity could undermine its advantage by becoming another sprawling security platform.

Verdict

Invest at a hypothetical Series A, assuming a valuation and ownership opportunity consistent with early-stage venture pricing rather than today’s reported scale. The founding team, market timing, product wedge, and early adoption would justify underwriting meaningful platform risk.

The one question I would need answered first is: Are customers renewing and expanding because Wiz is becoming an indispensable cross-cloud security system of record, or because it is the fastest and most attractive point solution available during an early buying wave? The answer—supported by cohort-level retention, expansion, and customer concentration data—determines whether this is a fund-returning platform or an exceptionally successful feature in a market that larger vendors can absorb.