Cloud Security
,
Security Operations
Major Competitive, Regulatory, Economic and Technological Changes Fueled This Deal
Google’s $32 billion acquisition of Wiz is record-setting in every sense of the word. It will forever change the way cloud computing and security are delivered.
See Also: How to Get the Most Out of Your Security Tech Stack
It is the biggest pure-play cyber deal of all-time, dwarfing Advent and Permira’s $14 billion buy of consumer cyber firm McAfee in March 2022. It’s the biggest deal in Google’s quarter-century history, besting the company’s $12.5 billion purchase of Motorola Mobility in 2012. It’s even the biggest sale of a venture-backed company ever, displacing Meta’s $19 billion buy of WhatsApp in 2024.
Why does Google believe a five-year-old firm with an estimated $700 million of annual recurring revenue is worth more than Zscaler, an 18-year-old company expected to reach $2.65 billion in sales this year? And why did Wiz opt for an exit just eight months after turning down Google’s previous overtures and just two months after hiring a CFO to pursue an initial public offering?
The acquisition underlines major changes in the cybersecurity market, the regulatory environment, the macroeconomic environment, customer buying behavior and technology itself. A deal of this magnitude would have been unthinkable just two years ago. Today, the proposed acquisition feels prudent and perhaps slightly inevitable (see: How Google’s $32B Wiz Acquisition Will Reshape Cloud Defense).
Multi-Cloud Security Becomes a Must-Have, Not a Nice-to-Have
Let’s start with the elephant in the room: Microsoft Defender for Cloud. The Seattle-area software and cloud computing giant historically focused on building security products for its own technology, but did an about-face in early 2022 when it began managing permissions for AWS and GCP in addition to Azure. Microsoft said it recognized the future is multi-cloud, and would adapt its strategy accordingly.
Google’s pivot to multi-cloud security came just 10 months ago with the debut of Security Command Center Enterprise to safeguard GCP, AWS and Azure. Prior to that, Google’s native cloud security protected only GCP, with customers having to tap third-party partnerships with the likes of Palo Alto Networks for multi-cloud security. Given its late start, Security Command Center Enterprise lags Defender for Cloud.
It’s become apparent to hyperscalers that large enterprises will in perpetuity have a foothold in each of the major public clouds as well as some private clouds. A credible cloud security strategy must include native protection for each of the major public clouds since partnerships don’t offer control over the product roadmap or a joint go-to-market motion that will never sunset or be deemphasized.
Owning Wiz gives Google a more direct path to the golden egg: becoming the public cloud market share leader. Google grew its IaaS public cloud services business by a quarter in 2023 to $11.45 billion, but that’s still only 8.2% of a $140 billion market. Google significantly lags Amazon and Microsoft in public cloud – who control 39% and 23% of the market, respectively. Perhaps Wiz will help close that gap.
The deal will help Google build out a cyber platform that includes the Mandiant threat intelligence and incident response assets it acquired for $5.4 billion in late 2022, the SOAR capabilities it acquired from Siemplify for $500 million in early 2022 and the SIEM capabilities developed in-house with Chronicle. Converging cloud security and security operations would mirror what Palo Alto Networks has done (see: Google Purchases Wiz in $32B Deal to Boost Cloud Security).
Palo Alto Networks announced earlier this year it would move its Prisma Cloud business over to Cortex, bringing cloud security and security operations much closer together. This will help the Silicon Valley platform security giant unify security operations on premise, across cloud environments and have all detection and response activities occurring in a single place. Google can now follow suit.
Why Wiz Abandoned Its IPO Plans for a Guaranteed $32B Payday
On Wiz’s side, an independent path to a $32 billion valuation would be a murky one. This year was supposed to usher in a glorious return of cybersecurity IPOs, but the results to date haven’t been auspicious, with SailPoint trading 10% below its initial price of $22 per share. Weeks of escalating tariff threats by the Trump administration have the United States teetering on the edge of a recession.
It’s therefore far from a sure bet that Wiz’s stock price would “pop” after going public the way that it did for cyber companies like CrowdStrike and Cloudflare following their 2019 IPOs. If market conditions won’t allow Wiz to become the next CrowdStrike or Palo Alto Networks, taking Google’s money becomes a more appealing option.
The risks associated with pursuing a combination with Google have also diminished. The Trump administration is expected to take more lenient approach to antitrust than the Biden administration did under former Federal Trade Commission Chair Lina Khan, which led to many deals getting squashed.
True, Trump’s Department of Justice sued to block HPE from moving forward with its proposed $14 billion buy of Juniper. But, the two situations aren’t analogous. Justice said eliminating Juniper as a disruptive competitor would consolidate more than 70% of the wireless networking market under HPE and Cisco. In contrast, Wiz has just 11% share in the cloud networking application protection platform market – behind both Palo Alto Networks and CrowdStrike – while Google didn’t even make it to the podium.
Nonetheless, Google moved to provide Wiz with downside protection, according to media reports, with the former set to pay the later $3.2 billion if regulators scuttle the acquisition. The 10% breakup fee is higher than the 5-to-8% typically offered by acquirers, and is more than the $2 billion and change Google offered last summer. Google really wants this deal to happen.
Google could have bought agentless cloud security posture management capabilities from the likes of Orca Security, Aqua Security or Sysdig for a fraction of the price. But just like when the company moved into incident response 18 months ago with the Mandiant acquisition, Google decided it wanted the best pure-play firm in the market. That’s why Google was ultimately willing to pay a steep premium for its number one target.