By KIM BELLARD
When I saw the Wall Street Journal article about Alphabet being in “advanced talks” to buy cybersecurity firm Wiz for an eye-popping $23b, I must confess that – never having previously heard of the company – my thoughts flashed back to the Seinfeld episode (“The Junk Mail”) where Elaine dates a man whose job turns out to be an outlandish mascot for electronics store The Wiz, whose motto he gleefully repeats: “Nobody beats The Wiz!” That firm is long gone but this Wiz is alive and well, enough so that the acquisition would be Alphabet’s largest ever.
The Wiz was only founded in 2020, by four ex-Israeli military officers (they reportedly all originally worked together at Israel’s equivalent of the NSA). They had previously founded cloud cybersecurity firm Adallom in 2012, which they sold to Microsoft in 2015 for its Azure cloud computing firm. Wiz also specializes in cloud cybersecurity, and, according to WSJ, its clients include 40% of the Fortune 500 companies as customers, including Barclay’s, Mars, Morgan Stanley, and Slack. Other notable customers include BMW, DocuSign, EA, and Salesforce.
Pretty impressive for a four-year-old start-up.
Alphabet’s cloud business – Google Cloud Platform (GCP) — badly trails leaders AWS (Amazon) and Azure (Microsoft), although last year GCP’s revenue’s rose 26% and it recorded its first operating profit. It’s Q1 2024 revenue was up 28%. By the way, Wiz lists both AWS and Azure as partners, along with GCP, Oracle Cloud Infrastructure, VMware, and Alibaba Cloud.
Alphabet had bought security company Mandiant two years ago for $5.4b, as well as Siemplify, another Israeli cloud cybersecurity company, that same year, and evidently sees these acquisition as a way to bolster its cloud business.
For some perspective, just this past May Wiz raised $1b in a funding round that gave it a $12b valuation. Its annual recurring revenues are estimated at $500 million, so Alphabet’s offer is a 46 multiplier. By contrast, WSJ notes that competitor CrowdStrike has a market capitalization that is 25 times annual recurring revenues. “This could be one of the largest and fastest returns ever for a private security company in tech history,” Alex Clayton, a general partner at Meritech Capital, told WSJ.
“There are two advantages of Google acquiring Wiz,” Ray Wang, principal analyst and founder of Constellation Research, told CSO. “One, cloud security is hot and allows Google to cut into AWS and Azure clients, and two, having Wiz would give them some consistently large workloads to monetize.”
If you’re wondering why cloud security is hot, I need only mention AT&T, which recently disclosed that the records of “nearly all” of its cellular customers had been breached. Well, those records came from its cloud provider Snowflake — and that was not the first time Snowflake has been attacked and possibly breached. Azure has also suffered some serious breaches, and has been accused of “repeated pattern of negligent cybersecurity practices.” AWS has had its share of data breaches as well.
So, yeah, a cloud service better have good cybersecurity.
The Independent praised Wiz’s “innovative interface,” which “provided visual displays that use graphs and charts to illustrate a company’s entire cloud security architecture, making it straightforward to identify threats and potential weaknesses.” (The Independent also had the headline I wished I’d thought of: Gee Wiz).
Bank Info Security reported that “Wiz in January got the highest “current offering” rank from Forrester in cloud workload defense,” although “a weak cloud workload security strategy meant Wiz’s total score came in fourth behind CrowdStrike, Palo Alto Networks and Microsoft.” Wiz was also named the top rated cloud security company on the 2023 Forbes Cloud 100.
Pareekh Jain, CEO and lead analyst at Pareekh Consulting told CSO. “GCP is lagging behind AWS and Microsoft in the cloud and this acquisition could create a much-needed differentiator for GCP. There have been many cybersecurity incidents in the recent past and strong cloud security credentials could be a differentiator and deciding factor for enterprises considering their movement to cloud.”
“This was the missing piece in Google’s portfolio and helps them provide cybersecurity as a service bundled with their cloud offerings,” Neil Shah, VP for research and partner at Counterpart Research, also told CSO.
Much has been made of potential antitrust scrutiny of the deal, due to its size and the fact that Google is already being accused of being a monopoly. WSJ – which had another headline I wished I’d thought of (Google’s Wiz Deal Won’t Ease on Down the Road) – but Bank Info Security, for one, called those concerns “overblown”:
Despite Google being in the crosshairs of regulators on both sides of the Atlantic Ocean, antitrust probes are unlikely to sink a potential purchase of Wiz. Neither Google nor Wiz ranked among the seven market share leaders in cloud workload security in 2022, according to IDC, which said control of the market was in the hands of Trend Micro, Palo Alto, Microsoft, CrowdStrike, Check Point, Broadcom and Trellix.
It may take a while (less if Trump is reelected), but Google is likely to prevail. That being said, I expect that AWS, Azure, and GCP will end up getting spun-off or divested eventually, because they’re getting big enough to rival Amazon’s, Microsoft’s, and Alphabet’s core businesses. So, go ahead, power up the cybersecurity.
————
Look, I’m no cybersecurity expert, and I know even less about the cloud business. But I am an AT&T customer, not to mention a Ticketmaster one, and a United Healthcare one. For heaven’s sake, my local hospital system – which only serves my community – has been breached. So if GCP wants to spend $26b strengthening the security of its cloud business, I say more power to them, and I hope the other cloud companies follow suit.
Whatever worrying we’ve been doing about cybersecurity is nothing to how much we should be worrying about it once AI gets involved. “AI and Cybersecurity are the two biggest areas customers are investing their technology dollars,” Mr. Wang told CSO. “Google seeks to play in both areas.”
We’ve seen how much attention has been paid to A.I. companies, and how much investment is going to them, and we better see the same with cybersecurity.
Kim is a former emarketing exec at a major Blues plan, editor of the late & lamented Tincture.io, and now regular THCB contributor