Wiz

Companies are spending more on cloud infrastructure. The global cloud computing market was estimated to reach $680 billion in 2024. Within this, public cloud infrastructure revenue grew to $74 billion in Q4 2023, up $5.6 billion over Q3 2023 and $12 billion over Q4 2022. Increasing spend on cloud infrastructure is being driven by the continued trend toward greater digitization across the economy and the growth of data-hungry markets like generative AI.

As cloud infrastructure expands, so does the need for robust security measures to protect it. Cloud security was estimated at $40.7 billion in 2023, and was expected to rise to $62.9 billion by 2028. This comes amidst a rise in cyberattacks, which grew 38% in 2022 relative to 2021, which itself saw a 125% increase in cyberattacks from 2020.

Wiz offers a suite of cloud security solutions that allow security teams to manage their cloud infrastructure within a single platform. The company’s mission is to “help organizations create secure cloud environments that accelerate their businesses.” Cloud environments are complex relative to the old world of proprietary data centers. With Wiz, security teams can manage their cloud infrastructure within a single platform. The Wiz platform acts as a normalizing layer across cloud environments, allowing organizations to detect and mitigate critical risks quickly. As of March 2024, Wiz had protected 5 million cloud workloads, was scanning 230 billion files daily, and had 40% of the Fortune 100 as its customers.

Wiz was founded by Assaf Rappaport (CEO), Amy Luttwak (CTO), Roy Reznik (VP of R&D), and Yinon Costica (VP of Product) in 2020.

The four co-founders met in the Israel Defense Force (IDF). Rappaport served as a captain in the IDF’s 8200 Intelligence Unit. Luttwak, Costica, and Reznik also served in the 8200 unit. This unit is known for its talent contribution to the modern cybersecurity industry. Over 1K startups had been founded by 8200 alumni as of December 2023, including large cybersecurity companies such as Check Point Software and Palo Alto Networks.

After leaving the IDF, the four of them founded Adallom together in 2012. Adallom was a cloud access security broker (CASB). Rappaport served as CEO, Luttwak as CTO, Reznik as VP of R&D, and Costica as VP of Products. Microsoft acquired Adallom for $250 million in September 2015. Subsequently, Rappaport became the General Manager of Microsoft Israel, Costica became Principal Program Manager for Cloud Security, Reznik became a Principal R&D Group Manager, and Luttwak became the CTO of Microsoft’s Cloud Security group.

While at Microsoft, they identified a gap in the cloud security market: in contrast to on-premise cybersecurity solutions, there was a lack of a unified interface for security teams to oversee all cloud servers through a "single pane of glass.” In an April 2023 interview, Luttwak said:

In December 2019, Rappaport announced he was leaving Microsoft to start another company. Luttwak, Reznik, and Costica joined him. In an April 2023 interview, Luttwak recounted how the four co-founders made the decision to leave Microsoft and start Wiz:

In August 2022, 18 months after launch, Wiz achieved the milestone of becoming the fastest software company at that time to reach $100 million in annual recurring revenue (ARR).

In February 2024, former Zscaler COO Dali Rajic joined Wiz as COO and President to oversee the company’s growth strategy and help guide it through its next phases of growth. This included a $1 billion annual recurring revenue (ARR) target and a future IPO.

Wiz is a cloud security platform that helps secure services built and run in the cloud. It offers security and development teams a way to gain visibility, identify, and correct misconfigurations and vulnerabilities, and maintain compliance against industry regulations like PCI, GDPR, and HIPAA.

Wiz uses an API-based agentless deployment method. This allows the product to look into the client's cloud environment without the need for complex deployment work or a large team. The client can onboard with Wiz and secure its cloud infrastructure. The platform then scales to any cloud environment, with no impact on workload or resource performance as of March 2024.

Cloud Security Posture Management

Wiz’s Cloud Security Posture Management (CSPM) connects to a company’s cloud environment to continuously and proactively detect and fix cloud misconfigurations, including build time and runtime. As of March 2024, it supported hybrid clouds in AWS, GCP, Azure, OCI, VMware vSphere, and Alibaba Cloud.

CSPM collects management information from cloud accounts including firewall policies, identity entitlements, and networking settings. With these inputs, CSPM contextualizes the information and gains a comprehensive mapping into a client's cloud infrastructure. Wiz calls this the Wiz Security Graph.

Source: Wiz

Using this graph, clients can prioritize or ignore misconfigurations, such as ignoring empty virtual private clouds (VPCs), or resources managed by a cloud service. Conversely, teams can use the Wiz Security Graph to discover which misconfigurations compromise high-value assets such as “crown jewel” data stores and admin identities.

As of March 2024, CSPM offers over 1.4K built-in configuration rules across runtime and infrastructure as code (IaC) to detect misconfiguration and trigger automatic remediation flows. Users can also create custom misconfiguration rules using the Open Policy Agent (OPA) engine by querying cloud APIs through OPA’s Rego querying language.

Source: Wiz

Compliance

Wiz helps with cloud compliance monitoring and governance. As of March 2024, Wiz offered over 100 built-in compliance frameworks. Users can also create their frameworks or duplicate existing ones and assign them Wiz’s built-in or custom compliance policies. Additionally, Wiz provides a compliance heatmap — a “bird’s-eye view” that lets users “pick out [their] weak spots across multiple applications and frameworks.” Users can also generate compliance reports on-demand or periodically to provide a high-level posture assessment for stakeholders.

Source: Wiz

Vulnerability Management

Wiz's vulnerability management product provides agentless vulnerability detection across various environments and workloads, including VMs, containers, and serverless functions. It utilizes a single cloud-native API deployment for continuous assessment without ongoing maintenance. It supports over 70K vulnerabilities across 30+ operating systems and over 1K+ applications as of March 2024. Through its Threat Center, users can identify exposure to the latest vulnerabilities sources from Wiz Research, as well as third-party threat intelligence feeds. Once a vulnerability has been identified, users can take remediation action via automation rules or with a single click.

Source: Wiz

Vulnerability management comes with a “deep assessment” capability to uncover hidden vulnerabilities, including nested dependencies and CISA KEV exploitable vulnerabilities. The product also prioritizes vulnerabilities based on actual environmental risk, focusing on resources with significant exposure or impact potential. This approach enables organizations to quickly identify and prioritize emerging threats without the overhead of traditional agent-based systems.

Container & Kubernetes Security

Wiz’s Container and Kubernetes Security solution provides visibility and risk assessment for containers, Kubernetes, and cloud environments without requiring agents. It enables real-time threat detection in Kubernetes clusters and facilitates collaboration between developers and security teams to address security issues early in the development lifecycle. The product supports scanning infrastructure as code, container images, and runtime environments, prioritizing risks based on context and enabling proactive mitigation strategies. It extends a single policy framework across the development pipeline, ensuring compliance and security from code to runtime.

Cloud Detection & Response

Wiz’s Cloud Detection and Response (CDR) product continuously monitors cloud workload and activity for suspicious activity, leveraging intelligence from cloud providers to detect and respond to threats proactively. It offers contextualized detection and response, correlating real-time signals and cloud activities for threat visibility. The product also includes “Incident Response” capabilities with out-of-the-box response playbooks. These enable rapid investigation, isolation of affected resources, and automation of evidence collection for efficient containment and recovery.

IaC Scanning

Wiz’s infrastructure as code (IaC) scanning tool allows developers and DevOps teams to detect vulnerabilities, secrets, and misconfigurations in laC templates, container images, and VM images – across all stages of development workflows. With this tool, developers can enforce compliance across different cloud environments using Wiz’s 100+ built-in policies and frameworks. Users can also build their custom policies and frameworks. Additionally, users can assess vulnerabilities through a per-layer analysis of container images, or connect their registry to Wiz, receive an inventory of their repositories and images, and scan them by name, image age, or image tags.

Cloud Infrastructure Entitlement Management

Wiz's Cloud Infrastructure Entitlement Management (CIEM) analyzes cloud entitlements and permissions, offering visualization, detection, prioritization, and remediation of identity and access management (IAM) risks.

With CIEM, users can monitor human and service identities, employing auto-generated, guided least privilege suggestions to right-size the access and entitlements in their cloud environment. Wiz constructs a map of effective access between all principals and all resources, incorporating mitigating measures such as boundaries, Access Control Lists (ACLs), and Service Control Policies (SCPs). The product also detects exposed secrets or credentials, which could potentially be exploited by attackers to access sensitive assets or hijack accounts.

Data Security Posture Management

Wiz’s Data Security Posture Management (DSPM) tool scans for sensitive data including PII, PHI, and PCI across a company’s cloud environment and automatically alerts security teams when finding exposure paths that can be exploited. It enhances data security by correlating sensitive data with its cloud environment and identifying potential public exposures, access permissions, and vulnerabilities. This enables prioritization of risks to sensitive data, alerting to potential attack paths, and integrating with development pipelines to prevent insecure deployments. Wiz focuses on high-priority data risks and blocks security policy violations to safeguard data effectively. It also integrates with third-party services such as BigID and tools like Amazon Macie to provide more data context for risk prioritization and decision-making.

Cloud Workload Protection

Wiz provides Cloud Workload Protection (CWPP) — tools to protect cloud workloads including virtual machines, ephemeral resources, container registries, serverless functions, and virtual appliances. Security teams can use CWPP to discover, analyze, and secure multiple workloads running on the cloud without deploying agents. As of March 2024, this feature worked across AWS, Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure, and Alibaba Cloud.

Source: Wiz

AI Security Posture Management

Wiz's AI Security Posture Management (AI-SPM) enhances and secures AI pipelines and machine learning models in the cloud. It provides visibility into AI services, SDKs, and technologies without the need for agents. AI-SPM detects misconfigurations in the user’s AI services such as OpenAI and Amazon Bedrock, and identifies attack paths, ensuring AI implementations are secure. Wiz extends protection to sensitive training data, incorporates AI security best practices, and empowers developers with tools and insights to secure AI pipelines through project-based workflows and role-based access control (RBAC).

Code Security

Wiz streamlines code security from development to production. It scans code in IDEs or repositories, identifying and guiding the remediation of risks to accelerate secure code deployment. Developers can use Wiz to detect and correct vulnerabilities and exposed secrets early in the development process, leveraging Wiz's scanning and policy engine to ensure code is secure by design. As of March 2024, Wiz integrated with “any CI/CD platform including AWS CodeBuild, Atlantis, AzureDevOps, CircleCI, GitHub, GitLab, Jenkins, and TeamCity.”

Supply Chain Security

Wiz's supply chain security solutions allow users to secure all components in their software supply chain, providing agentless visibility into the software bill of materials (SBOM) and assessing risks across containers, machine images, IaC templates, and code repositories. It facilitates secure software development from the initial build to runtime by identifying vulnerabilities, misconfigurations, and exposed secrets in all software components, including third-party and open-source software.

Customer

Wiz’s core customers are enterprises with complex and valuable cloud infrastructure to manage. The Wiz team was able to understand and address the needs of these customers, in part, thanks to their experience working at Microsoft. In an October 2022 interview, CEO Assaf Rappaport recounted how Wiz targeted enterprises from the beginning, stating that “our first customers were thought leaders like JP Morgan Chase and Morgan Stanley. We also worked with Cloud 500 companies like Snowflake that are native in the cloud.”

In July 2022, Wiz counted 25% of the Fortune 100 as customers. Since then, Wiz's penetration among some of the largest companies has grown has continued to grow. As of March 2024, Wiz counted 40% of Fortune 100 companies as customers. As of March 2024, notable Wiz customers included DocuSign, Slack, BMW, Morgan Stanley, Plaid, LVMH, Fox and Priceline. As of March 2024, Wiz’s customers operated across several industries including media, health, retail, travel, education, technology, and energy.

Source: Wiz

Market Size

Cloud security is expected to grow at a CAGR of 9.1% to $62.9 billion by 2028, from $40.7 billion in 2023. Key growth drivers include (1) the increasing popularity of multi-cloud environments; (2) the use of AI and ML technology for cloud security; and (3) the rising demand for cloud security due to the adoption of bring-your-own device (BYOD) and choose-your-own device (CYOD) within companies.

A beneficiary of the growing demand for cloud security, the size of Wiz's addressable market is highly dependent on the underlying cloud consumption. The global cloud computing market was estimated to reach $680 billion in 2024 up from $591.8 billion in 2023 and $490 billion in 2022. This included business processes, platforms, infrastructure, software, management, security, and advertising services. Within this larger market, revenue for cloud infrastructure companies reached $74 billion in Q4 2023, up $5.6 billion over Q3 2023 and $12 billion over Q4 2022.

From its inception, Wiz “faced hundreds of competitors” as detailed by CEO Assaf Rappaport in an October 2022 interview. The company was able to stand out from the crowd thanks, in part, to early notable customers including JP Morgan Chase and Morgan Stanley. However, as of March 2024, Wiz faced direct competition from large cloud security players including Orca Security, Lacework, Palo Alto Networks, and Pingsafe.

Orca Security: Orca Security is a cloud security company that provides a platform for visibility and security compliance across cloud environments, without the need for per-asset agents or network scanners. It was founded in 2019 and had a $1.8 billion valuation as of its $340 million Series C funding round in October 2021. As of March 2024, Orca Security had raised $632 million in total funding across five rounds. It shares many platform features with Wiz, including CNAPP, cloud workload protection, container and kubernetes security, and CSPM.

Lacework: Founded in 2015, Lacework is a security solution that helps secure businesses as they build on public clouds. It offers a similar product suite to Wiz, including code security, CNAPP, CIEM, and CSPM. Lacework had raised a total of $1.9 billion across six rounds of funding as of March 2024. Lacework had a $8.3 billion valuation as of its $1.3 billion growth funding round in November 2021.

Palo Alto Networks: Palo Alto Networks offers a suite of security solutions to combat cyber threats and secure networks, clouds, and endpoints. It was founded in 2005. As of March 2024, Palo Alto Networks was a publicly traded company (NASDAQ: PANW) with a market capitalization of $96.7 billion. As of March 2024, Palo Alto Networks’ product suite was broader than Wiz’s; it included firewalls, secure access services, as well as CNAPP and an AI-driven security operations platform. Particularly, its Prisma Cloud platform competed directly with Wiz’s offerings.

PingSafe: PingSafe offers AI-based cloud security for infrastructure protection and compliance. It was founded in 2021. PingSafe had raised $3.3 million in funding before being acquired by SentinelOne for over $100 million in January 2024. As of March 2024, Pingsafe had a more limited product suite than Wiz but shared features such as CNAPP, CSPM, and CWPP.

As of March 2024, Wiz did not offer a typical self-serve SaaS model. Instead, customers set up a demo with the sales team and negotiate a quote. However, Wiz can be subscribed to via third-party marketplaces such as the AWS marketplace. As of March 2024, Wiz’s listed subscription plans in the AWS marketplace ranged from $24K to $114K. Terms can vary depending on contract length.

Source: AWS Marketplace

In a May 2023 article, CEO Assaf Rappaport was cited as saying that Wiz was “usually priced higher than any other product”, such as Palo Alto Network’s Prisma Cloud.

In August 2022, 18 months after launching, Wiz passed $100 million in annual recurring revenue (ARR). At that time, Wiz claimed this was the fastest any software company had achieved that milestone.

Source: Wiz

In May 2023, Wiz had reached $200 million in ARR. In June 2023, Wiz announced a new strategic collaboration agreement with long-time partner AWS. This announcement came after Wiz had surpassed $100 million in the AWS Marketplace. In February 2024, the company announced it had reached $350 million in ARR and was “eager to reach the future milestone of $1 billion as we look toward an IPO.”

One way Wiz garnered recognition early on was by uncovering vulnerabilities in mass-market software. For example, in September 2021 Wiz found “four critical vulnerabilities” in OMI, one of Microsoft Azure’s software agents. By July 2022, 25% of Fortune 100 companies were Wiz customers. In October 2022, that number had risen to 30%. By February 2023, 35% of Fortune 100 companies were Wiz customers. As of March 2024, 40% of Fortune 100 companies were Wiz customers.

Valuation

Wiz had raised a total of $900 million across five funding rounds as of March 2024. In February 2024, Wiz raised a $300 million Series D round co-led by Lightspeed Venture Partners and Greenoaks Capital Partners. This round put Wiz’s valuation at $10 billion. For context, Wiz had a valuation of $6 billion when it raised its $250 million Series B round in October 2021, and a valuation of $1.7 billion after its $130 million Series B round in March 2021. Based on Wiz’s February 2024 milestone of $350 million in annual recurring revenue (ARR), the company’s $10 billion valuation would represent a 28.5x revenue multiple.

Alongside its February 2024 announcement of having reached $350 million in ARR, Wiz hired former President and COO of Zscaler Dali Rajic to “help steer the company through the next phases of rapid growth on the road to IPO.”

Talent Shortage in Cybersecurity

Cybersecurity products are typically designed and built for security operations center (SOC) analysts to manage. There has been, however, a shortage of cybersecurity talent. An October 2023 article found that the cybersecurity workforce shortage had risen to a record high of around 4 million. This was despite the cybersecurity workforce growing by almost 10% the year prior. The gap between the number of workers needed and the available workers grew 12.6% year over year (YoY). According to the October 2023 article, 67% of cybersecurity professionals surveyed reported shortages of staff needed to prevent and troubleshoot security issues in their organizations.

As the cybersecurity industry continues to suffer from a talent shortage, there is a need for cybersecurity products to automate part of the workflow previously done manually. This shift towards automation can help bridge the gap created by the shortage of cybersecurity professionals. If Wiz continues to expand its cloud security platform with agentless, automated features, it can capitalize on this market need and grow its market share.

Generative AI in Cloud Computing

The rise of Generative AI is driving increased cloud usage. End-user cloud spending was expected to reach $566.6 billion in 2023, with AI investments contributing to this expansion. Spending on public cloud will reach $678.8 billion in 2024, increasing 20.4% year over year, according to a November 2023 Gartner report. In Q4 2023, enterprise cloud infrastructure services spending hit nearly $74 billion, up $12 billion year over year. Enterprise cloud spending increased by $5.6 billion from Q3 to Q4 2023.

Generative AI's impact is also reflected in the financial performance of leading cloud service providers. In January 2024, AWS reported a 13% year-over-year sales increase. Similarly, in January 2024, Alphabet reported its cloud unit grew by 26% in the prior year, with AI being a contributor to that growth. Google Cloud noted in January 2023 that AI firms like Anthropic are using its infrastructure for training and running models, and the use of its foundational model, Gemini, has surged. The number of generative AI projects on Google's Vertex AI platform increased sevenfold between the second and third quarters of 2023. Finally, Microsoft's Azure business expanded by 30% for Q4 2023, with AI demand accounting for six percentage points of its growth.

Wiz is well positioned to capitalize on this trend as its business model depends on cloud usage. Similarly, if enterprises continue to incorporate generative AI into their services, Wiz can position itself as the go-to cloud security for generative AI models. The company has already begun taking steps in this direction, as evidenced by the launch of its AI Security Posture Management (AI-SPM) feature in November 2023. In fact, according to Wiz, the launch of this feature made the company the “first CNAPP to provide native AI security capabilities.”

Cloud Dynamics

Wiz’s entire business is dependent on the rise of cloud infrastructure spending. Any shift in market dynamics towards reduced cloud project initiations or an increased emphasis on cost-cutting could severely affect cloud expenditure. For example, if companies were to deem cloud infrastructure too expensive and choose to migrate their infrastructure to on-premise, Wiz’s GTM momentum could slow or halt.

The need for on-premise software is unlikely to go away entirely given regulatory and cost considerations. Wiz’s architecture is tightly coupled with the cloud. Wiz’s cloud-centric architecture, while advantageous when enterprises adopt a cloud-first strategy, may not fully cater to organizations that balance their infrastructure across cloud and on-premise environments or are considering repatriating certain workloads due to cost or performance considerations. This could make Wiz less attractive to a wider range of companies and might require Wiz to rethink its products to support both cloud and on-premise setups effectively, without losing the quality of security or efficiency.

AI-Assisted Security Threats

AI and machine learning (ML) have significantly advanced cloud computing, offering benefits in efficiency, scalability, and performance through features like predictive analytics, anomaly detection, and automation. However, the widespread adoption of AI technologies also introduces new security vulnerabilities to cloud computing.

The easy access to AI tools heightens the risk of sophisticated adversarial attacks. Attackers can exploit ML models through tactics like evasion, poisoning, or model inversion, leading to the generation of inaccurate information. As AI becomes more accessible, the pool of attackers capable of exploiting these models expands. Furthermore, AI's capacity to swiftly identify vulnerabilities presents a potent advantage to cybercriminals. They can employ AI to uncover weaknesses and initiate attacks more rapidly than security teams can detect and mitigate them. AI's ability to produce advanced malware that can adapt and evade detection complicates defense efforts.

Another risk associated with AI in cloud computing is the increased dependency on automated systems. This dependency amplifies the potential impact of AI system failures or security breaches. In the cloud's distributed framework, addressing these issues without significant service interruption poses a considerable challenge.

If Wiz doesn't keep its cybersecurity tools up-to-date against AI and ML threats, it could put its clients' cloud security at risk and fall behind competitors. Wiz needs to invest in advanced threat detection, update its security practices with the latest AI changes, and ensure its team is always learning and adapting. Without these steps, clients' systems could become vulnerable, trust in Wiz could decrease, and its market position could suffer.

Wiz has seen significant growth in a short period, even while competing against mature incumbents such as Palo Alto Networks. Its founders’ experience in helping to scale Azure's cloud security division to a $2 billion revenue business has given them demonstrable expertise in building cloud-centric technology. With continued GTM momentum, Wiz could expand its platform to address even more of the security landscape; especially if the shortage of cybersecurity talent expands and cloud adoption continues to increase due to technologies such as generative AI. That said, whether Wiz can sidestep the risks inherent to cloud dynamics, or keep up with the potential proliferation of AI-assisted security threats remains a question.