The Consolidation Play: Google's $32B Wiz Acquisition
The Deal That Changed the Market
On March 18, 2025, Google announced it would acquire Wiz for $32 billion in cash. Wiz was barely five years old. It had turned down a $23 billion offer from the same buyer in July 2024, then told reporters in October 2024 that it had reached $500 million in annual recurring revenue (ARR).
The deal took a year to clear regulators. Google completed the acquisition on March 11, 2026, and Wiz now sits inside Google Cloud while keeping its own brand.
This wasn't just a big check. It was a statement about who will own the security layer of the cloud.
Google had already spent $5.4 billion on Mandiant in 2022, and it had built its Chronicle security operations platform. Wiz was different. It was a cloud security platform that worked across AWS, Azure and GCP at the same time. At closing, Google said Wiz is trusted by 50% of the Fortune 100.
My read is that the deal confirms something every CISO needs to plan for: the era of independent, best-of-breed security vendors is shrinking. Cloud providers and a few large platforms are consolidating the security stack, and that changes enterprise security strategy.
Why Google Paid 64x Revenue
To understand the price, look at what Wiz built. Four former members of Microsoft's cloud security group founded it in 2020: Assaf Rappaport, Ami Luttwak, Yinon Costica and Roy Reznik. Wiz built an agentless cloud security platform that scans a cloud environment without deploying software on each workload.
Its core is the Wiz Security Graph. The graph correlates vulnerabilities, misconfigurations, network exposure, identities and sensitive data across cloud providers into one view. Before Wiz, cloud security often meant stitching together separate tools for vulnerability scanning, IAM analysis, compliance and container security. Wiz collapsed much of that into one platform.
By the time of the deal, Wiz had:
- About $500 million in ARR in late 2024, with a stated goal of $1 billion in 2025
- Customers including half of the Fortune 100, by Google's count at closing
- Coverage across AWS, Azure, GCP and Oracle Cloud
- A valuation that had climbed to $12 billion in a May 2024 funding round
$32 billion is about 64 times that $500 million ARR figure. In my view, Google wasn't paying 64x revenue for a security tool. It was paying to own the multi-cloud security layer: the single view enterprises increasingly depend on to secure their whole cloud footprint.
The Security Consolidation Wave
The Wiz deal didn't happen in isolation. Cloud providers and the largest security platforms have been buying the independent vendors around them for years. Prices below are as announced, or as widely reported where the buyer did not disclose a figure.
| Acquirer | Target | Year | Price | Capability |
|---|---|---|---|---|
| Mandiant | 2022 | $5.4B | Threat intelligence, incident response | |
| Siemplify | 2022 | About $500M (reported) | SOAR (security orchestration) | |
| Wiz | Announced 2025, closed 2026 | $32B | Cloud security platform | |
| Microsoft | RiskIQ | 2021 | About $500M (reported) | Attack surface management |
| Microsoft | Miburo | 2022 | Undisclosed | Threat intelligence |
| Microsoft | CyberX | 2020 | About $165M (reported) | IoT/OT security |
| Palo Alto Networks | QRadar SaaS (from IBM) | 2024 | $500M plus incentive payments | SIEM |
| Cisco | Splunk | 2024 | $28B | Security analytics, SIEM |
| CrowdStrike | Adaptive Shield | 2024 | Undisclosed | SaaS security |
| Palo Alto Networks | CyberArk | Announced 2025, closed 2026 | About $25B | Identity and privileged access security |
The pattern is clear. Platforms are building end-to-end security stacks by acquiring strong independent vendors. Once a vendor is absorbed, its incentives change.
When your security vendor becomes a division of your cloud provider, its incentives shift toward keeping you on that platform. That is not cynicism. It is the basic economics of platform businesses.
What Enterprises Risk Losing
Pricing Leverage
Before the acquisition, Wiz competed hard against Orca Security, Lacework, Aqua Security and the native tools from AWS, Azure and GCP. That competition kept prices in check and pushed innovation. Under Google, there is a risk that Wiz capabilities get bundled into GCP at a discount no independent vendor can match.
Microsoft shows how bundling works. Defender, Sentinel and Entra ID are bundled into Microsoft 365 E5 licenses, so many buyers already pay for them. The security features feel "free" if you already pay for the productivity suite. Independent vendors like CrowdStrike and SentinelOne then have to justify themselves against a near-zero incremental cost.
The scale is real. Microsoft said in January 2023 that its security business had passed $20 billion in annual revenue, double the figure from two years earlier. That is larger than any pure-play security company. In my view, a large share of that growth came from bundling into enterprise agreements, not only from building better products.
Multi-Cloud Neutrality
This is the deeper concern. Wiz's value rested on being cloud-agnostic. It worked across AWS, Azure and GCP, and that neutrality was credible because Wiz had no financial reason to favor one cloud.
Google has committed that Wiz products will continue to work across all major clouds, including AWS, Azure and Oracle Cloud. That commitment matters, and buyers should hold Google to it. History suggests watching closely. After Microsoft acquired GitHub, GitHub stayed excellent, but its deepest integrations, such as Copilot and Codespaces, tilt toward Microsoft's ecosystem.
For enterprises running real multi-cloud strategies, this creates a structural question. The leading cloud security platform is now owned by one of the clouds it is supposed to evaluate neutrally.
Innovation Velocity
In my experience, independent startups move faster than divisions of large companies. Wiz shipped major capabilities at a fast pace from 2020 to 2025 and responded to customer feedback quickly.
After an acquisition, three forces tend to slow that pace. Key engineers often leave once retention packages vest. Product decisions start to run through the parent company's planning cycles. Integration work with the parent cloud consumes engineering time that would otherwise go to new features. None of this is certain for Wiz, but it is the pattern to watch.
The Vendor Lock-In Risk Assessment
Every CISO should review their vendor portfolio through a consolidation risk lens. Here is the framework I use to assess exposure.
Consolidation Risk Matrix
| Risk Factor | Low Risk | Medium Risk | High Risk |
|---|---|---|---|
| Cloud provider dependency | Multi-cloud with independent security tools | Multi-cloud with some provider-native security | Single cloud with provider-native security stack |
| Security vendor concentration | 5+ independent vendors across security domains | Mix of independent and platform-bundled tools | 80%+ of security from one vendor ecosystem |
| Data portability | All security data in open formats with export APIs | Some proprietary formats but export possible | Critical security data locked in vendor-specific formats |
| Contract structure | Annual contracts with 90-day termination | Multi-year with migration support clauses | Long-term ELAs with significant switching penalties |
| Team expertise | Broad skills across multiple platforms | Moderate depth in 2-3 platforms | Deep expertise in single vendor's ecosystem only |
The thresholds in this matrix are my working benchmarks, not an industry standard.
Scoring Your Risk
Count how many "High Risk" factors apply to your organization:
- 0-1 High Risk factors: You're in reasonable shape. Monitor, but don't panic.
- 2-3 High Risk factors: Start a diversification plan now. You're exposed to pricing pressure and capability changes.
- 4-5 High Risk factors: You have a strategic problem. A single vendor decision (an acquisition, a price increase, a deprecation) could materially change your security posture.
The goal isn't to eliminate all vendor concentration. That's impractical and creates its own operational problems. The goal is to make sure no single acquisition or vendor business decision can leave you exposed.
The Multi-Cloud Security Dilemma
The Google-Wiz deal forces a practical question. If the strongest cloud security platforms are being bought by cloud providers, how do you keep multi-cloud visibility?
There are three approaches:
1. The "Best Native" Strategy
Use each cloud provider's native security tools for that provider's environment: AWS GuardDuty for AWS, Microsoft Defender for Cloud for Azure, and Google Security Command Center for GCP.
Pros: Deep integration, often included in existing licensing, optimized for that specific cloud.
Cons: No unified view, different alert formats, separate expertise needed for each cloud, gaps at the boundaries between clouds.
2. The "Independent Overlay" Strategy
Choose a security platform that operates across all clouds and is not owned by a cloud provider. Options include Orca Security, Lacework (now part of Fortinet) and Palo Alto Networks' Cortex Cloud (formerly Prisma Cloud). Wiz itself still runs across all major clouds, but it is now owned by one of them.
Pros: Unified view, vendor neutrality, one team can manage it.
Cons: Fewer independent options as consolidation continues, possible feature gaps against native tools, additional cost.
3. The "Open Standards" Strategy
Build your visibility layer on open-source and open-standard tools. Examples include OpenTelemetry for observability, Sigma for detection rules, STIX/TAXII for threat intelligence, and open-source SIEM platforms like Wazuh.
Pros: No vendor lock-in, full data ownership, community-driven development.
Cons: Significant engineering investment, requires deep expertise, and the integration burden falls on your team.
Most enterprises will end up with a hybrid. The key is to make that choice deliberately rather than drifting into concentration through convenience.
What CISOs Should Do Now
1. Audit Your Vendor Concentration
Map every security tool to its parent company. The answer may surprise you. That "independent" SIEM you bought might now belong to a cloud provider, a larger platform or a private equity firm with different priorities. Build a dependency map that shows which vendors would leave gaps if they were acquired or shut down.
2. Negotiate Exit Clauses
When you sign or renew a contract with any security vendor, negotiate explicit terms for acquisition scenarios. Key terms to include:
- Data export rights: The right to export all data in open formats within 90 days of an acquisition announcement
- Pricing protection: Caps on price increases for 2-3 years after an acquisition
- Feature parity commitments: A contractual commitment to keep feature parity across all supported platforms for a defined period
- Termination rights: The ability to terminate without penalty if the product is materially changed or deprecated
3. Invest in Data Portability
Make sure your security data (logs, alerts, policies, configurations) exists in formats you can move. If your detection rules are written in a proprietary query language, start translating them to Sigma. If your security data lake uses a vendor-specific format, set up regular exports to an open format.
4. Build Cross-Platform Expertise
Don't let your team's skills concentrate in one vendor's ecosystem. Train across multiple platforms. When hiring, favor candidates with experience across cloud providers. The teams that handle vendor consolidation best can evaluate and operate several tools.
5. Engage with Open-Source Security
Open-source security tools have matured. Falco (runtime security), Wazuh (SIEM/XDR), OpenTelemetry (observability) and Trivy (vulnerability scanning) are real alternatives to commercial products. You don't need to go all-in on open source. Operational experience with these tools still gives you options.
For more on how cloud provider consolidation affects enterprise security strategy, see my breakdown: Google's $32B Wiz Bet: Why Security Consolidation Means You're Losing Negotiating Power
The Private Equity Factor
Hyperscalers are not the only consolidators. Private equity firms have been rolling up cybersecurity companies too, building large platforms through acquisition rather than organic development.
Thoma Bravo has acquired SailPoint, Ping Identity, Proofpoint, Sophos and ForgeRock, and it merged ForgeRock into Ping Identity in 2023. Vista Equity Partners owned Ping Identity until Thoma Bravo bought it in 2022, and it took KnowBe4 private in 2023.
PE-backed consolidation follows a different logic from hyperscaler acquisitions. It optimizes for margin expansion, not platform lock-in. The effect on customers can look similar: fewer independent choices and pricing power on the vendor's side.
The pattern I have seen in PE-owned software is predictable. Costs get cut, support teams get consolidated, prices rise at renewal, and the company is prepared for resale or IPO within a few years. Not every PE owner behaves this way, but buyers should ask.
For CISOs, ownership structure is now a real due diligence step. A PE-owned company behaves differently from a founder-led startup, which behaves differently from a division of a hyperscaler. Your vendor's ownership shapes its incentives, and its incentives shape how it will serve you over time.
Lessons from History: What Past Consolidation Tells Us
This isn't the first wave of security consolidation. In the 2000s, Symantec, McAfee and CA Technologies absorbed dozens of point products into large suites that promised unified management and lower cost. In my experience, many security teams found those suites slow and bloated, while procurement teams liked them because they simplified vendor management.
A new generation of independent vendors (CrowdStrike, SentinelOne, Zscaler, and later Wiz itself) then displaced those suites with focused products. The current wave could repeat that cycle. The strongest security products of 2020 to 2025 could become the legacy platforms of 2030 if their acquirers favor integration and margin over continued investment.
The difference this time is speed. A single hyperscaler acquisition can reshape a product category within months. Organizations that wait to diversify may find the alternatives have already been acquired.
The Bigger Picture
The Google-Wiz deal is a symptom of a broader shift. Enterprise security is moving from hundreds of point products toward a landscape dominated by a handful of platform players.
Consolidation has genuine benefits. Integration between security tools has historically been poor, and platforms whose tools work well together provide real operational value. Consolidation also reduces competition, concentrates risk and gives a small number of vendors significant pricing power.
For CISOs, the strategic task is clear. Plan for a world where your cloud provider may also be your primary security vendor. Build the optionality to change course if that relationship stops serving you.
Google will look to recoup its $32 billion through platform retention, competitive displacement and pricing power. The question is whether your organization ends up on the paying side of that equation. The alternative is to build the flexibility to choose the best tools regardless of who owns them.
The market has changed. Your move.