Google wants a piece of Microsoft’s cyber-security business

IN LATE 2022 Wiz, a cyber-security startup, boasted that it was “the fastest-growing software company ever”. A stretch, maybe, but not a big one. At that point, 18 months after it was founded, annualised sales hit $100m. By 2023 they were $350m. In May Wiz raised $1bn at a $12bn valuation. On July 14th it emerged that Alphabet, Google’s parent company, was in talks to acquire Wiz for $23bn. It would be the biggest purchase of a cyber-security firm in history and Alphabet’s biggest takeover ever (see chart 1).

Wiz is the brainchild of four former Israeli soldiers. In 2015 they sold their three-year-old first startup, Addollum, to Microsoft. The quartet then worked for Microsoft Azure, the software giant’s cloud service, before launching Wiz in 2020. Its technology helps clients identify security risks in the cloud, such as which employees are using which apps or who has a weak password. By stitching together lots of data Wiz allows customers to spot vulnerabilities that hackers could exploit.

The firm sits at the intersection of two trends reshaping the cyber-security business. The first is computing’s inexorable move to the cloud. This year businesses will spend around $300bn worldwide on cloud services. This creates new vulnerabilities—and new opportunities for startups like Wiz. In 2023 global sales of cloud-security products grew by 32%, compared with 13% for computer-security overall, according to Gartner, a research firm. And whereas many cyber-security incumbents, such as Palo Alto Networks and Fortinet, mostly sell firewalls and other safeguards for older IT systems, Wiz has from the start specialised in protecting the cloud.

The second change is in how companies buy security software. They used to purchase lots of individual tools, layered one on top of another. As a result, big businesses often have between 50 and 70 separate security applications, notes Charlie Winckless of Gartner. Duplication is rife, costs high and IT managers unable to tell which tools work and which do not. In February Nikesh Arora, boss of Palo Alto Networks, admitted that “customers are facing spending fatigue.”

Nowadays IT departments favour one-stop shops. These are easier to manage and the tools talk to each other. Cyber-security providers are thus busily adding services, often via acquisitions. JPMorgan Chase, a bank, notes that over 50 security firms have been acquired this year, more than in all of 2022 or 2023. Wiz itself has bought two in the past year, and raised capital in May partly to buy more. Being swallowed by Alphabet gives Wiz a giant platform atop the world’s third-biggest cloud.

For Alphabet, swallowing Wiz bolsters its own cyber-security business. This is thought to be modest, especially compared with that of Microsoft, which last year said its cyber-offering surpassed $20bn in annual revenue, a tenth of its total sales. To catch up, in 2022 Alphabet bought Siemplify, another Israeli startup, for $500m and Mandiant, an American one, for $5bn. Wiz would enable Google’s clients to assess threats in other clouds they use, a capability that Microsoft has offered since 2022. It is an important one, given that four-fifths of cloud users have data spread across several clouds.

In recent years trustbusters have looked askance at big tech’s attempts to buy companies even outside their core business. Alphabet will be hoping that they will conclude that by taking the fight to Microsoft, the Wiz deal will make the cyber-security business more competitive, not less. ■

To stay on top of the biggest stories in business and technology, sign up to the Bottom Line, our weekly subscriber-only newsletter.