Two months ago, Wiz Inc was basking in a major milestone: It had just raised a US$1 billion funding round, boosting its valuation to US$12 billion. Investors were excited about the cloud security startup, which was absorbing US$400 million in acquisitions, rapidly expanding its US footprint and starting to eye an initial public offering.

Then Google called.

Now, Wiz, which is run by Israelis and headquartered in New York, is in talks with Google’s parent Alphabet Inc and could walk away with as much US$23 billion just four years after its founding. Alphabet and Wiz haven’t commented on the potential deal, which would be Alphabet’s largest-ever acquisition, and it could still fall apart or face lengthy antitrust hurdles in the US and Europe. 

Should it go through, it will be the Wiz team’s second time selling out to a big US tech company. Wiz chief executive officer Assaf Rappaport and his co-founders were behind Adallom, another cloud security company that they sold to Microsoft Corp for US$320 million in 2015. 

Rappaport has pointed out the need for consolidation in the cybersecurity industry. In an interview with Bloomberg in March, the CEO said that the state of the market meant that even small companies need to use dozens of security tools and that was putting pressure on all-in-one cyber platforms to grow. It also increased pressure on niche startups, he said. “Like, hey, not every startup can go IPO and become a unicorn,” Rappaport said in the interview. “Maybe an exit route would be the right way.”

Rappaport declined to be interviewed for this story.

Investors and analysts credit Wiz’s meteoric rise to its early identification of cloud security as an uncrowded field with a rich and growing customer base. Wiz says 40% of Fortune 100 companies are its customers, and it pulls in US$350 million in annual recurring revenue. It’s also attracted major investors, including Sequoia Capital, Andreessen Horowitz, Index Ventures, Insight Partners and Cyberstarts. Billionaire Bernard Arnault has funded the startup, as has Starbucks’s former CEO Howard Schultz.

After quitting as head of Microsoft’s Israel research and development centre, Rappaport and his partners Yinon Costica, Roy Reznik and Ami Luttwak - who met in the Israeli military’s 8200 intelligence unit two decades before - decided to form another startup in 2020. They initially planned to develop a networks security solution under the name Beyond Networks. But they ultimately settled on creating another cloud security company, a decision that proved prescient - and as Rappaport has previously said - a bit lucky. 

As the Covid-19 pandemic hit, workers were forced out of their offices to comply with lockdowns and companies raced to migrate key applications and data to the cloud. Hackers took advantage of the chaos, ramping up attacks on corporate systems and targeting employees with insecure work-from-home setups. 

“Looking back, if you asked me to choose the best time in history to start a cybersecurity company in the cloud, I would have to say March 2020,” Rappaport said, in an article published on Index Ventures’ website.

Securely moving data to the cloud and on to computers operated by third parties can be fraught and time consuming. Cybersecurity software typically works by attempting to inspect each file on a machine to identify and fix potential problems. Scans by anti-virus and other security software are notorious for sometimes taking hours or days to complete.

Wiz’s technology addresses this by connecting to customers’ cloud computers remotely, rapidly examining them for everything from malicious software to exposed corporate secrets and personal data to insecure configurations that could lead to a breach.

Using these tools, security departments quickly get a complete view of their networks and vulnerabilities across different cloud providers, according to Neil MacDonald, a vice president at Gartner Inc. This is done by taking what amount to snapshots of those systems and identifying potential attack paths for hackers without requiring the installation of software directly onto the machines.

“Wiz has grown so rapidly because in a single console and within a matter of hours, a security professional can point the Wiz offering at complex setups in AWS, Azure, Google Cloud Platform - even applications that span these - and quickly identify and prioritise these risks,” MacDonald said.

The company competes primarily in two markets - “cloud workload protection platforms” that detects and shores up vulnerabilities in workloads and “cloud security posture management” that finds and fixes misconfigurations in hybrid clouds. Both businesses are growing at more than 25% per year and are forecast to reach US$5.2 billion and US$2.1 billion, respectively, this year, MacDonald said. Its competitors include Microsoft, Palo Alto Networks Inc, Check Point Software Technologies Ltd and CrowdStrike Holdings Inc.

For Google, acquiring Wiz would help it catch up to rivals on cloud security. However, the size of the acquisition would be unusual for a big tech company and may draw even more scrutiny from antitrust regulators. An acquirer may also have to deal with a lawsuit between Wiz and rival Orca Security - another Israeli startup that’s accusing Wiz of infringing on its intellectual property. Wiz has previously called the claims “baseless”.

It isn’t only regulators that will be keeping a close eye. The talks are being closely watched in Israel, where Wiz was founded. If completed, the deal would be the largest ever for an Israel-founded company, after Intel Corp’s US$15.3 billion acquisition of Mobileye, which makes technology for autonomous vehicles, in 2017.

Israeli officials are already estimating what they could collect. Tax proceeds from the deal could surpass US$3 billion, or about 0.5% of the country’s GDP - a windfall for a country in the middle of an expensive war with Hamas - according to Yaniv Shekel, a senior partner at the Shekel & Co law firm, which specializes in tax and commercial law. 

“You need to be very thoughtful about acquisitions and how you can create a single, coherent technology stack,” Rappaport said in March, speaking in his role as a buyer having just agreed to take over Gem Security. “Acquisitions are not a cure for everything.”

  - Bloomberg