Everyman Brand Archetype
Automotive
Cybersecurity Software
Wiz
Built the fastest-scaling cloud-security platform by replacing fragmented, agent-heavy tools with an agentless Security Graph that shows exploitable attack paths, then expanding from visibility into full cloud-native application protection.
• BUSINESS MODEL
• REVENUE
• MARKET TYPE
• MARKET ENTRY
• GROWTH MODEL
• MOAT
• EDGE
1
MODEL
Wiz had to prove that an agentless cloud-security platform could scale across complex enterprise environments without creating operational burden. It reached $100 million ARR within 18 months of launch, $350 million revenue in 2023, and roughly $500 million ARR in 2024; Google agreed to acquire Wiz for $32 billion in 2025, validating both product velocity and enterprise distribution.
Question this model answers
We need to know whether our business model can scale.
BUSINESS MODEL
SaaS
HOW THEY BUILT IT
'- Wiz was founded in 2020 by Assaf Rappaport, Ami Luttwak, Roy Reznik, and Yinon Costica to solve cloud-security complexity created by rapid cloud adoption. → It targeted security teams overwhelmed by misconfigurations, identities, vulnerabilities, and fragmented tools. → Its founding insight was that security teams needed attack-path context, not more isolated alerts.
- It built an agentless platform that connected to AWS, Azure, Google Cloud, and other environments through APIs. → This allowed deployment in minutes without installing software across workloads. → The approach reduced friction and accelerated enterprise onboarding.
- It created the Security Graph to map relationships among resources, identities, configurations, vulnerabilities, and network paths. → Instead of showing isolated findings, Wiz identified exploitable attack paths and prioritized remediation. → This made the product relevant to both security and engineering teams.
- It expanded from cloud security posture management into a full Cloud-Native Application Protection Platform covering code, identities, workloads, and runtime. → This increased account value and made Wiz a system of record for cloud risk. → Wiz reached more than 40% of the Fortune 100 and approximately $500 million ARR by 2024.
HOW TO ARCHITECT IT
1. Identify a workflow where the buyer has many point tools but lacks a unified decision layer; validate that the pain is prioritization and context, not merely more detection.
2. Build an agentless or low-friction integration path so the customer can see value before a long implementation.
3. Create a data model that connects the customer’s existing signals into a decision graph—in Wiz’s case, attack paths.
4. Start with one high-value use case, such as cloud-risk visibility, before expanding into runtime, code, identity, or AI security.
5. Expand modules only when they reuse the same data graph and buyer; otherwise the platform becomes another fragmented suite.
6. Avoid selling alerts without remediation context; the common mis-build is creating more security noise instead of reducing the customer’s time to act.
DISTRIBUTION MODEL
Direct Sales, Enterprise Sales, Partnerships, Community-Led
HOW THEY OPERATIONALIZED
'- Wiz sold directly to security leaders and CISOs in mid-market and enterprise accounts.
- Its agentless architecture created a fast proof-of-value motion: connect through cloud APIs and demonstrate risk visibility quickly.
- Cloud marketplace partnerships with AWS, Azure, and Google Cloud supported procurement and co-selling.
- Security-community credibility, founder reputation, and technical content built trust among practitioners.
HOW TO REPLICATE WHAT WORKED
What Worked
Remove implementation friction so the buyer can see the platform’s value quickly, then expand from one security use case into a broader platform.
Trap if Copied Blindly
Agentless distribution fails if the product cannot deliver deep, accurate findings without endpoint-level context; the cost is weak differentiation and customer distrust.
Insight on Untapped Business Model / Gaps / Pitfalls
GOLDMINE
GOLDMINE 1 — AI SECURITY GOVERNANCE. Enterprises need visibility into AI workloads, model access, data flows, and agent permissions; AI security can become a new graph-based control plane.
GOLDMINE 2 — REMEDIATION WORKFLOWS. The opportunity is not finding more risks but closing them: ticketing, ownership assignment, fix validation, and engineering-friendly remediation.
GOLDMINE 3 — IDENTITY-SECURITY CONVERGENCE. Cloud identities, permissions, and non-human identities are now central attack surfaces; correlating identity risk with infrastructure exposure is a major opportunity.
THE TRAP TO WATCH
THE PIT — ALERT FATIGUE. A security tool that produces thousands of disconnected findings increases workload rather than reducing risk.
THE SECOND PIT — AGENTLESS AS A PERMANENT STRATEGY. Agentless deployment accelerates onboarding, but some runtime, workload, and threat-detection use cases may eventually require deeper instrumentation.
MOVE WITH CAUTION
Do not build a security platform around one cloud provider’s native APIs without a multi-cloud abstraction; otherwise the product becomes vulnerable to platform changes and native-tool competition.
2
MARKET
MARKET TYPE
Mature Market
WHY THEY WON
Cloud security was a mature and fragmented market with CSPM, CWPP, CIEM, vulnerability management, and application-security tools. Wiz’s opening was that enterprises had visibility but not context: teams could see misconfigurations and vulnerabilities, yet could not easily determine which combinations created real attack paths. It changed the decision frame from “which tool finds the most issues?” to “which platform tells us what an attacker can actually reach?” This mattered because security teams were drowning in alerts. Incumbents had broad portfolios, but their products were often assembled through acquisitions and carried integration complexity. The transferable lesson is that mature markets reward entrants that change the buyer’s decision unit—from individual findings to a unified risk decision.
Wiz competed against Palo Alto Networks, Microsoft Defender for Cloud, Orca Security, Lacework, and native cloud-provider tools. It flanked them by offering an agentless, multi-cloud Security Graph that prioritized exploitable attack paths rather than isolated configuration findings.
Question this model answers
We need to compete against a large incumbent.
ENTRY STRATEGY
Brownfield Entry
EXECUTION
Wiz entered by replacing fragmented cloud-security workflows rather than creating a new security need. It targeted enterprises already using cloud infrastructure and multiple security tools, offering agentless visibility and attack-path prioritization. The critical bet was that API-based onboarding could deliver value in minutes and displace incumbent tools. This required deep cloud APIs, graph technology, security expertise, and enterprise-grade scalability. The founder-level lesson is that brownfield entry succeeds when the new product changes the customer’s decision framework while fitting into existing cloud environments. It fails if the product creates another silo or cannot integrate with the customer’s operational workflow.
FOOTHOLD STRATEGY
Beachhead Strategy
THE HOW
Wiz’s beachhead was cloud-first enterprises with complex AWS, Azure, and Google Cloud environments. They were reachable through CISO networks and cloud-security communities; they could adopt quickly because agentless onboarding avoided lengthy deployment. They had meaningful security budgets and urgent need to prioritize cloud risk. The expansion path moved from CSPM into CNAPP, identity security, code security, runtime protection, and AI security.
MARKET TYPE PLAYBOOK
RULE 1 — CHANGE THE DECISION FRAMEWORK. A unified view of risk across the cloud estate replaces comparison of single-purpose scanners.
RULE 2 — DELIVER VALUE WITHOUT AGENTS. Agentless connection shows findings within hours, so the buyer sees results before committing.
RULE 3 — PRIORITISE RISK, NOT ALERTS. Graph context shows which findings can be exploited and need attention first.
RULE 4 — EXPECT FAST FOLLOWERS. Established CSPM and CNAPP vendors will copy the model, so speed of coverage and depth must stay ahead.
In a mature market, the entrant must change the buyer’s decision framework.
A better point tool rarely displaces an incumbent; a unified decision layer can.
GENERAL RULES
WHAT HAPPENS IN THIS MARKET TYPE
RULE 1 — Enter where the buyer has the need but lacks context. Security teams already have findings without prioritisation.
RULE 2 — Build an integration path that works without heavy implementation. Read-only cloud connections deliver value quickly.
RULE 3 — Show prioritised risk quickly. A shortlist of exploitable paths is the proof.
RULE 4 — Reject brownfield entry when the customer requires on-premises coverage or deep agent-based controls first. The offer cannot satisfy them yet.
Use brownfield entry when the buyer already has the underlying need but lacks context or prioritization.
Build an integration path that delivers value without heavy implementation.
Choose customers with complex environments and urgent risk-prioritization needs.
Expand into adjacent security modules only after the core graph and workflow are trusted.
HOW TO APPLY FOOTHOLD STRATEGY
RULE 1 — Choose customers with complex multi-cloud environments. Companies on AWS, Azure and Google Cloud lack a single view.
RULE 2 — Target urgent risk-prioritisation need. Security leaders under pressure from board and regulators act quickly.
RULE 3 — Earn trust in the core graph and workflow. Findings must be accurate and actionable.
RULE 4 — Expand into adjacent security modules only after that trust exists. Early breadth dilutes the core product.
Wiz’s beachhead was cloud-first enterprises with complex AWS, Azure and Google Cloud environments; failure occurs when adjacent modules are added before the core graph and workflow are trusted.
HOW TO APPLY MARKET ENTRY STRATEGY
Wiz replaced fragmented cloud-security workflows with an agentless Security Graph, giving buyers context and priority; failure occurs when the customer requires on-premises coverage or agent-based controls first.
PATTERNS OF THIS MARKETING MODEL
PATTERNS IN ENTERPRISE SECURITY DISTRIBUTION:
1. FAST PROOF OF VALUE REDUCES SALES FRICTION. Security buyers want evidence before committing to a platform.
2. PRACTITIONER CREDIBILITY DRIVES ENTERPRISE TRUST. CISOs rely on peer validation and technical depth.
3. PLATFORM EXPANSION RAISES ACCOUNT VALUE. Starting with visibility and expanding into prevention, detection, and response increases retention.
WEAKNESS
Alert fatigue. More findings without prioritization reduce trust and adoption.
GROWTH CAMPAIGNS
Agentless deployment positioning; Security Graph and attack-path campaigns; cloud-marketplace listings; CISO and practitioner community engagement; multi-cloud security campaigns; CNAPP expansion campaigns; AI security positioning; enterprise proof-of-value programs.
| So What
Wiz’s strongest acquisition asset was fast time-to-value: an enterprise could connect its cloud environment and see prioritized risk without a heavy deployment.
| Key Learning
In security software, reducing time-to-first-insight can be more persuasive than adding another detection capability.
| How to Use
Design a proof-of-value experience that surfaces the customer’s most urgent problem quickly, then expand only after that first insight creates trust.
3
MONEY
REVENUE MODEL
Subscription
Wiz monetizes through annual enterprise subscriptions based on the scale of cloud workloads, assets, or consumption across its platform. Expansion comes from adding cloud accounts, workloads, modules, and security use cases; its growth from $100 million ARR in 18 months to roughly $500 million ARR in 2024 shows strong land-and-expand economics.
Question this model answers
We need to build a predictable revenue model.
PRICING STRATEGY
Tiered Pricing, Flat Rate Pricing, Custom Enterprise Pricing
WHY THEY WON
Wiz earns recurring subscription revenue from enterprises using its cloud-security platform. The meters are cloud workloads, assets, accounts, and selected security modules. Revenue expands as customers add cloud environments, increase workloads, adopt CNAPP modules, and expand from visibility into prevention and runtime protection; margin depends on cloud infrastructure, data processing, R&D, and enterprise support.
TARGET AUDIENCE
Cloud-first enterprises (core CNAPP; want multi-cloud risk visibility and attack-path prioritization); security teams (CSPM and vulnerability management; want actionable remediation); DevOps and platform teams (code and workload security; want developer-friendly controls); regulated industries and public sector (enterprise security; want compliance, governance, and multi-cloud coverage).
Wiz uses custom enterprise pricing based on the customer’s cloud footprint and selected modules. Public pricing is not disclosed; enterprise buyers typically purchase through annual contracts, cloud-marketplace transactions, or negotiated agreements.
CUSTOMER BUYING BEHAVIOUR
A CISO or security leader usually discovers Wiz through peer recommendation, analyst coverage, or a cloud-security evaluation. The team connects Wiz to its cloud environment, reviews prioritized attack paths, and expands from visibility into remediation workflows and additional security modules.
WILLINGNESS TO PAY
CORE INSIGHT
Customers are not buying security alerts; they are buying the ability to know which risks matter and what to fix first.
RULES OF ADOPTION
RULE 1 — PRICE THE DECISION LAYER, NOT THE DETECTOR. A Security Graph creates more value than another isolated scanning tool.
RULE 2 — MONETIZE CLOUD FOOTPRINT EXPANSION. As customers add accounts, workloads, and environments, platform value and spend grow.
RULE 3 — SELL TIME-TO-REMEDIATION. Security teams will pay for fewer, more actionable priorities.
RULE 4 — WATCH THE VENDOR COST TRAP. Cloud data processing, graph computation, and enterprise support can erode margin if pricing does not scale with workload complexity.
The buyer is really buying risk reduction and operational clarity, evidenced by the security-tools and cloud-governance budget.
REVENUE RISK
Cloud-provider native competition: AWS, Microsoft, and Google can bundle security into their platforms.
Platform dependency: Wiz relies on cloud-provider APIs and architectures that can change.
Alert fatigue: if findings are not accurately prioritized, customers may lose trust.
Enterprise implementation drag: large multi-cloud environments require integration, governance, and support.
Competitive consolidation: Palo Alto, Microsoft, CrowdStrike, and other platforms can bundle security capabilities.
AI-security transition risk: new AI workloads and agent-based systems may require different security models and data access.
Wiz was acquired by Google in 2025 for $32 billion; it reported approximately $500 million ARR in 2024 and was projected to cross $1 billion ARR in 2025.
4
MOTION
Wiz reduced dependence on paid acquisition through CISO referrals, practitioner credibility, cloud-marketplace co-selling, and fast proof-of-value deployments. Its agentless architecture created a repeatable enterprise motion: connect through APIs, demonstrate attack paths, then expand modules.
Question this model answers
We need to reduce dependence on paid acquisition.
GROWTH EXPANSION MODEL
Land & Expand, Product Line Expansion
HOW THEY EXPAND
Wiz expanded from cloud security posture management into a full CNAPP spanning code, identities, workloads, and runtime. It acquired Gem Security in 2024 to strengthen cloud detection and response, and Raftt to enhance developer workflows, while expanding across AWS, Azure, Google Cloud, and Oracle Cloud.
COMPETITIVE STRATEGY
Sales-Led Growth
HOW THEY COMPETE
A security team connects Wiz to one cloud environment → sees prioritized attack paths within minutes → remediates high-risk exposures → expands to additional cloud accounts and teams → adopts CNAPP modules for code, identity, workload, and runtime security. The compounding trigger is cloud-footprint growth plus module adoption: each new environment increases the value of the Security Graph. The engine weakens if findings lose accuracy, cloud providers improve native security, or implementation complexity rises. A founder can reproduce this by creating a fast proof-of-value wedge that becomes more valuable as the customer’s usage footprint expands.
GTM
Wiz uses an enterprise-sales-led GTM supported by product-led proof of value and cloud-marketplace partnerships.
$5–10M ARR
Security leaders enter through peer trust and technical evaluation; Wiz demonstrates attack-path risk quickly, then expands through multi-cloud coverage and CNAPP modules. The primary motion is enterprise sales, supported by practitioner credibility and partner co-selling. The founder-level implication is that security platforms need both a fast technical wedge and a durable enterprise expansion system.
SUSTAINING MOATS
Data Advantage
The moat is Wiz’s Security Graph: its accumulated understanding of relationships among cloud resources, identities, configurations, vulnerabilities, and attack paths. This context improves prioritization and remediation in ways a new point tool cannot quickly replicate.
| Why This Moat Lasts
A data moat lasts when customer environment data continuously improves risk prioritization and remediation.
| Standard Rules
RULE 1 — CONTEXT CREATES DECISION QUALITY. Correlating identities, configurations, and vulnerabilities reveals exploitable paths.
RULE 2 — MULTI-CLOUD COVERAGE INCREASES VALUE. A graph spanning AWS, Azure, and Google Cloud becomes more useful as environments grow.
RULE 3 — REMEDIATION FEEDBACK IMPROVES THE MODEL. Knowing what teams fix and what risks recur improves prioritization.
| The Signal
Wiz reached $100 million ARR in 18 months, roughly $500 million ARR in 2024, and protected more than 40% of the Fortune 100. The moat does not protect against native cloud-security improvements, major platform shifts, or a competitor with superior graph intelligence.
ARR
JOURNEY
Pre-$1M ARR
VALIDATE AGENTLESS CLOUD VISIBILITY. Founded in 2020, Wiz built an agentless platform that connected to cloud APIs and mapped security risk across environments.
WATCH: whether enterprises would trust API-only visibility without agents.
$1–5M ARR
WIN FAST PROOF OF VALUE. Wiz used rapid onboarding and attack-path visualization to convert security teams quickly.
WATCH: accuracy of risk prioritization and enterprise integration.
$5–10M ARR
SCALE MULTI-CLOUD COVERAGE. The company expanded across AWS, Azure, and Google Cloud, increasing relevance for complex enterprises.
WATCH: cloud-provider API dependency.
$10–50M ARR
BUILD THE SECURITY GRAPH MOAT. Wiz deepened its graph-based correlation of identities, configurations, vulnerabilities, and network paths.
WATCH: alert fatigue and remediation workflow adoption.
$50–100M ARR
CROSS $100M ARR IN 18 MONTHS. Wiz became the fastest software company to reach $100 million ARR, expanding into CNAPP and enterprise accounts.
WATCH: platform breadth versus product focus.
$100M+ ARR
EXPAND INTO FULL CNAPP AND AI SECURITY. Wiz reached roughly $500 million ARR in 2024, acquired Gem Security and Raftt, and agreed to be acquired by Google for $32 billion in 2025.
WATCH: native cloud competition and AI-security evolution.
BREAKDOWN
THE STANDARD
Build a security platform by removing deployment friction, creating a unified decision layer from fragmented signals, and expanding into adjacent workflows that reuse the same data graph.
THE SEQUENCE
1. Identify a security workflow where customers have visibility but lack prioritization; prerequisite: access to the customer’s existing cloud signals through low-friction integration.
2. Deliver a fast proof of value that surfaces the highest-risk, actionable issues; decision gate: security and engineering teams act on the findings.
3. Expand into adjacent modules only when they strengthen the same decision graph; prerequisite: accuracy, scalability, and enterprise support.
Wiz’s agentless onboarding and Security Graph created rapid enterprise adoption and strong land-and-expand economics.