The Wiz acquisition stakes Google's claim as the go-to hyperscaler for cloud security – now it’s up to AWS and industry vendors to react

Google’s acquisition of cloud security startup Wiz could have monumental implications for the sector, according to industry analysts, with the company raising the stakes for both key competitors and security vendors.

The acquisition, announced this week as a $32 billion all-cash transaction, will see Wiz bundled within the tech giant’s cloud computing division. It’s been a long time coming, as well.

Talks last year fell through at the final hurdle amid a raft of concerns, not least of all regulatory considerations and whether it would continue as an independent entity.

Founded in 2020, Wiz has emerged as a leading figure in the cloud security space; the broader industry has become a key focus for enterprise IT leaders in recent years amidst the widespread shift to the cloud, and more recently, hybrid and multi-cloud setups.

Research from CrowdStrike in 2024, for example, noted that the cloud has become a “major battleground for cyber attacks”, highlighting the escalating threats faced by enterprises across a range of industries.

Wiz specializes in cloud native security, providing enterprises with cloud native application protection platforms (CNAPP), threat detection, and incident response capabilities.

It’s the CNAPP element here that will be a key differentiator for the tech giant, analysts believe. These solutions differ from traditional security tools by offering users a unified platform aimed at bolstering security across the entire lifecycle of cloud native applications.

The advantage for enterprises is that by consolidating their cloud security toolkit, they can improve visibility across their cloud estates and better secure applications.

CNAPP has been growing in appeal among IT leaders in recent years. Research from Westcon-Comstor this month, for example, revealed that 84% of UK firms intend to invest in CNAPP solutions over the next 12 months.

Similarly, the market is growing at a significant pace. Analysis from Dell’Oro Group in July 2024 valued the CNAPP market at around $2 billion. But this is expected to surge to over $6 billion by 2028, representing a compound annual growth rate (CAGR) of 25%.

Given the value of the Wiz deal is more than five-times the expected value of the CNAPP market, it’s clear that Google is trying to capitalize on a lucrative opportunity.

Combine that with the need to ramp up multi-cloud security offerings and keep pace with competitors in the space, and the price tag attached to Wiz makes perfect sense.

Wiz deal could be the key to pipping customers

Microsoft has made significant strides in its cloud native security capabilities in recent years through notable acquisitions, according to Andras Cser, VP principal analyst at Forrester.

But Cser noted that while Google Cloud has been developing built-in CNAPP capabilities to bolster GCP security, these tools have “predominantly focused only on protecting GCP endpoints/assets”.

“After Microsoft’s 2021 early acquisition of CloudKnox and development of Defender for Cloud, Google is feeling the pressure to offer a true, multi-cloud-capable CNAPP tool given that so many organizations are multi-cloud today,” he said.

Cser added that, post-acquisition, the consultancy expects most CNAPP capabilities in GCP to be replaced by Wiz’s offering. With the firm bundled under the Google Cloud umbrella, this could become a tantalizing draw for prospective customers.

From a competition perspective, the deal also raises the stakes. With Microsoft’s acquisitions in this domain having placed pressure on Google to react, the Wiz deal will likely have the same effect on Amazon Web Services (AWS), another key competitor in the cloud space.

AWS provides tools such as Guard Duty and Config for customers. However, Cser insisted these “fall short” of the capabilities offered by a CNAPP solution, particularly with regard to multi-cloud coverage.

“If AWS is to maintain its position in cloud infrastructure, it has to beef up its productized, multi-cloud CNAPP (with coverage for CSPM, CIEM, agent-based and agentless CWP, container security, and IaC scanning) and, in general, cloud security offerings.”

The Wiz acquisition could hit vendors hard

While Google got what it wanted from the Wiz acquisition, independent vendors operating in the CNAPP space could feel immense pressure in the coming years, according to Cser.

A host of major vendors, including Fortinet, Palo Alto Networks, Rapid7, Sysdig, and Trend Micro offer CNAPP solutions, and Cser said they can not expect “fierce competition” to stay ahead in features.

“The planned acquisition plus Microsoft’s continued investments in CNAPP and app security will make it harder for these vendors to maintain and realize their growth,” he added.

Allie Mellen, principal analyst at Forrester, echoed Cser’s comments on this front, adding that this will place pressure on vendors to consolidate their offerings.

“Wiz’s key detection and response offering, Wiz Defend, takes a different approach to cloud detection and response,” she said.

“Instead of relying on built-in detection capabilities in its own cloud protection tools, it offers a unified tool solely for detection and response that takes in alerts and data from other tools and does detection engineering on them.”

All told, this reduces alert volumes from the cloud at a “critical time”, Mellen noted, thereby alleviating pressure on security practitioners and streamlining operations.

“With this acquisition, it will put pressure on other vendors to consolidate in a similar way — a big win for security operations teams.”

While some vendors will be bracing themselves in the wake of the acquisition, others are taking a more optimistic approach. Bill Welch, CEO of the aforementioned Sysdig, said there will be advantages for industry vendors.

“Regarding the potential $30B+ Google acquisition of Wiz – as Sysdig’s CEO, I say bring it on! This is great validation for the cloud security market,” he said.

Following communication with CISOs, investors, and cloud partners, Welch noted that one key talking point has emerged - mainly that “being forced into a single vendor is not good for business”.

“Most - if not all - cloud users and multi-cloud, and you can guarantee multi-cloud Wiz customers will struggle once the acquisition goes through. With a Google acquisition, this story ends well for the VCs, founders, and employees, but the customers are the ones who ultimately lose in a deal like this.”

MORE FROM ITPRO

• Google Cloud will make MFA mandatory by the end of 2025
• Google Cloud’s new security AI will explain how you’ve been breached
• AWS users are getting a big security boost with passkey support