Wiz

The same foursome, a second time

Wiz was founded in January 2020 by Assaf Rappaport, Yinon Costica, Roy Reznik and Ami Luttwak, four people who had already been down this road together once, at Adallom, which was sold to Microsoft. The second time matters for understanding the story. After years of working inside Microsoft's cloud, they knew the problem from the inside, and they knew which product was missing and why the existing tools did not provide it. Legally, the company is registered in the United States, and its development center is in Israel. Under this category's geographic rule (a company whose development center is in Israel), it counts as Israeli, and the business press in Israel and around the world treated it that way too. One more point worth clarifying: Wiz is included in this encyclopedia under the exception defined in the category's criteria. AI is not the core of its original product, but cloud security is part of the infrastructure that the entire AI world actually runs on, and the picture is hard to explain without it. This background also explains why the company reached large customers relatively quickly. People who have already sold to organizations of that size know their purchasing process, who needs to be convinced and which objections will come up along the way. Second-time founders do not start from zero, even when the product itself is entirely new.

What the attack graph is, and why it changed things

The product scans entire cloud environments (Amazon Web Services, Microsoft Azure, Google Cloud, Oracle Cloud and Kubernetes) and builds a single graph of connections from them. The difference from the security tools that came before it is not the amount of information but the question being asked. A classic tool ranks vulnerabilities by their theoretical severity and produces a long list of alerts that no one has time to read. Wiz asks a completely different question: is there actually a path that someone on the internet could follow, step by step, to a sensitive asset? A severe vulnerability on a server no one can reach is not urgent. The very same vulnerability on an exposed server that holds permission to a customer database is an incident you deal with tonight. This combination of several factors, each tolerable on its own, is what professionals call a toxic combination, and the ability to find it automatically across an entire organization is what explained the pace of adoption. It is important to understand why this approach was not obvious. Building such a graph requires reading the entire configuration of the cloud environment (permissions, networks, machines, databases) and understanding the relationships between them, not just counting vulnerabilities. The hard part is not finding the single vulnerability but assembling the full picture from it.

The pace: from $1 million in revenue to $100 million

Wiz's growth was considered exceptional even on a global scale. The move from $1 million in annual recurring revenue to $100 million in annual recurring revenue took less than a year and a half, from February 2021 to July 2022, and was described at the time as the fastest ever recorded by a software company. Annual recurring revenue, or ARR, is the standard measure for subscription software: not how much money came in last year, but how much money existing contracts are expected to bring in over the year ahead. In February 2024 the company reported annual recurring revenue of $350 million and said it served 45 percent of Fortune 100 companies. At the same time, its workforce grew to more than 1,500 employees. Numbers like these, within four years of its founding, explain why two cloud giants held talks about acquiring it even before it reached the size of a public company. A caveat is also in order: annual recurring revenue is a figure that companies report themselves, and it is not audited like a financial statement. It is best treated as an indication of pace rather than an accounting figure, but the pace alone explained the interest the company attracted.

Funding rounds and acquisitions, and why valuation is not money raised

A series of funding rounds accompanied the pace: $100 million in a Series A in December 2020; $130 million in a Series B in March 2021, at a valuation of $1.7 billion; another $250 million in a Series C in October 2021, at a valuation of $6 billion; $300 million in a Series D in February 2023, at a valuation of $10 billion; and $1 billion in a Series E in May 2024, at a valuation of $12 billion. Total funding added up to about $1.9 billion. The distinction between the two numbers matters and is often blurred in writing about tech. The valuation is the price investors agreed on in a particular deal, while the amount raised is the money that actually went into the company's bank account. Wiz also made acquisitions of its own: Raftt in December 2023 for about $50 million, Gem Security in April 2024 for about $350 million, and Dazz in November 2024 for about $450 million. All of them were meant to close gaps in the product faster than building them from scratch. These acquisitions show another pattern: a company that has raised large sums uses them not only to grow but to buy time. Each such acquisition saved a year or two of in-house development in a neighboring field, at a time when speed was worth more than savings.

$23 billion turned down, $32 billion accepted

In 2024 it was reported that Google had offered to acquire Wiz for about $23 billion, and the company turned it down, saying it preferred an independent path toward an IPO. Less than a year later, on 18 March 2025, the two sides announced a different agreement: a full acquisition for about $32 billion, all in cash. The road from agreement to closing took almost a year, most of it spent with antitrust authorities. The US Department of Justice cleared the deal in November 2025. The European Commission approved it in February 2026, finding that it does not significantly harm competition in the cybersecurity and cloud markets. The deal actually closed on 11 March 2026. The distinction between the two dates is not just a formality. The 2025 announcement was an agreement, not a completed acquisition, and the gap of almost a year between them is exactly the time it takes regulators to review a deal of this size. It is also the window in which such deals can still fall apart. It is also worth noticing what happened between the two offers. The first refusal was not a mistake: in the year between them the company kept growing, and the deal price rose by about $9 billion. This is one of the few times you can measure in money how much a company's confidence in itself is worth.

What this number says, and what remains open

$32 billion, six years after founding, is at the same time the largest acquisition in Google's history, the largest acquisition ever of a venture-backed company, and the largest exit in the history of Israeli tech. A sum like this changes the scale by which deals in Israeli tech are measured: what used to be considered a mega-deal is now measured against a number more than twice as large. Alongside this, an open question remains that is worth stating plainly. A product built entirely on the ability to scan and compare competing cloud environments has now been bought by one of those competitors. Google and Wiz's management have stated explicitly that the product will continue to support all the major cloud environments, including those of Amazon and Microsoft. A commitment like that is tested not on the day it is announced but over years. Customers whose workloads this product protects in a competitor's cloud will be watching closely. Finally, a point about the category itself. Wiz is not an AI company in the narrow sense. It is here because every model, every service and every agent you use ultimately runs in someone's cloud, and whoever protects that cloud is part of the field's infrastructure, even if its own product contains no model.