top of page
Business & Enterprise
Cybersecurity
Cybersecurity Software
Wiz
Built the fastest-scaling cloud-security platform by replacing fragmented, agent-heavy tools with an agentless Security Graph that shows exploitable attack paths, then expanding from visibility into full cloud-native application protection.
1
MODEL
BUSINESS MODEL
SaaS
- Wiz was founded in 2020 by Assaf Rappaport, Ami Luttwak, Roy Reznik, and Yinon Costica to solve cloud-security complexity created by rapid cloud adoption. → It targeted security teams overwhelmed by misconfigurations, identities, vulnerabilities, and fragmented tools. → Its founding insight was that security teams needed attack-path context, not more isolated alerts.
- It built an agentless platform that connected to AWS, Azure, Google Cloud, and other environments through APIs. → This allowed deployment in minutes without installing software across workloads. → The approach reduced friction and accelerated enterprise onboarding.
- It created the Security Graph to map relationships among resources, identities, configurations, vulnerabilities, and network paths. → Instead of showing isolated findings, Wiz identified exploitable attack paths and prioritized remediation. → This made the product relevant to both security and engineering teams.
- It expanded from cloud security posture management into a full Cloud-Native Application Protection Platform covering code, identities, workloads, and runtime. → This increased account value and made Wiz a system of record for cloud risk. → Wiz reached more than 40% of the Fortune 100 and approximately $500 million ARR by 2024.
1. Identify a workflow where the buyer has many point tools but lacks a unified decision layer; validate that the pain is prioritization and context, not merely more detection.
2. Build an agentless or low-friction integration path so the customer can see value before a long implementation.
3. Create a data model that connects the customer’s existing signals into a decision graph—in Wiz’s case, attack paths.
4. Start with one high-value use case, such as cloud-risk visibility, before expanding into runtime, code, identity, or AI security.
5. Expand modules only when they reuse the same data graph and buyer; otherwise the platform becomes another fragmented suite.
6. Avoid selling alerts without remediation context; the common mis-build is creating more security noise instead of reducing the customer’s time to act.
DISTRIBUTION MODEL
Wiz had to prove that an agentless cloud-security platform could scale across complex enterprise environments without creating operational burden. It reached $100 million ARR within 18 months of launch, $350 million revenue in 2023, and roughly $500 million ARR in 2024; Google agreed to acquire Wiz for $32 billion in 2025, validating both product velocity and enterprise distribution.
HOW THEY BUILT IT
HOW TO ARCHITECT IT
Direct Sales, Enterprise Sales, Partnerships, Community-Led
HOW THEY OPERATIONALIZED
HOW TO REPLICATE WHAT WORKED
dm
- Wiz sold directly to security leaders and CISOs in mid-market and enterprise accounts.
- Its agentless architecture created a fast proof-of-value motion: connect through cloud APIs and demonstrate risk visibility quickly.
- Cloud marketplace partnerships with AWS, Azure, and Google Cloud supported procurement and co-selling.
- Security-community credibility, founder reputation, and technical content built trust among practitioners.
What worked: remove implementation friction so the buyer can see the platform’s value quickly, then expand from one security use case into a broader platform.
Trap if copied blindly: agentless distribution fails if the product cannot deliver deep, accurate findings without endpoint-level context; the cost is weak differentiation and customer distrust.
| PATTERNS OF THIS MODEL
PATTERNS IN CLOUD-SECURITY PLATFORMS:
1. VISIBILITY IS THE WEDGE; CONTEXT IS THE MOAT. Customers first buy visibility, but they stay for prioritized, actionable risk context.
2. AGENTLESS DEPLOYMENT REDUCES TIME-TO-VALUE. API-based onboarding removes implementation friction and accelerates proof of value.
3. A SECURITY GRAPH CONVERTS ALERTS INTO DECISIONS. Correlating identities, configurations, vulnerabilities, and network paths makes risk actionable.
THE WEAKNESS: platform dependence. A security product built on cloud APIs is exposed to provider changes, native-tool competition, and evolving cloud architectures.
What companies with this model reveal
| OPPORTUNITY INTELLIGENCE
GOLDMINE 1 — AI SECURITY GOVERNANCE. Enterprises need visibility into AI workloads, model access, data flows, and agent permissions; AI security can become a new graph-based control plane.
GOLDMINE 2 — REMEDIATION WORKFLOWS. The opportunity is not finding more risks but closing them: ticketing, ownership assignment, fix validation, and engineering-friendly remediation.
GOLDMINE 3 — IDENTITY-SECURITY CONVERGENCE. Cloud identities, permissions, and non-human identities are now central attack surfaces; correlating identity risk with infrastructure exposure is a major opportunity.
THE PIT — ALERT FATIGUE. A security tool that produces thousands of disconnected findings increases workload rather than reducing risk.
THE SECOND PIT — AGENTLESS AS A PERMANENT STRATEGY. Agentless deployment accelerates onboarding, but some runtime, workload, and threat-detection use cases may eventually require deeper instrumentation.
MOVE WITH CAUTION — Do not build a security platform around one cloud provider’s native APIs without a multi-cloud abstraction; otherwise the product becomes vulnerable to platform changes and native-tool competition.
Untapped Business Model / Gaps / Goldmines / Pits
Patterns & Insights
2
MARKET
mkt mt es
Wiz competed against Palo Alto Networks, Microsoft Defender for Cloud, Orca Security, Lacework, and native cloud-provider tools. It flanked them by offering an agentless, multi-cloud Security Graph that prioritized exploitable attack paths rather than isolated configuration findings.
MARKET TYPE
Mature Market
ENTRY STRATEGY
Brownfield Entry
WHY THEY WON
Cloud security was a mature and fragmented market with CSPM, CWPP, CIEM, vulnerability management, and application-security tools. Wiz’s opening was that enterprises had visibility but not context: teams could see misconfigurations and vulnerabilities, yet could not easily determine which combinations created real attack paths. It changed the decision frame from “which tool finds the most issues?” to “which platform tells us what an attacker can actually reach?” This mattered because security teams were drowning in alerts. Incumbents had broad portfolios, but their products were often assembled through acquisitions and carried integration complexity. The transferable lesson is that mature markets reward entrants that change the buyer’s decision unit—from individual findings to a unified risk decision.
EXECUTION
Wiz entered by replacing fragmented cloud-security workflows rather than creating a new security need. It targeted enterprises already using cloud infrastructure and multiple security tools, offering agentless visibility and attack-path prioritization. The critical bet was that API-based onboarding could deliver value in minutes and displace incumbent tools. This required deep cloud APIs, graph technology, security expertise, and enterprise-grade scalability. The founder-level lesson is that brownfield entry succeeds when the new product changes the customer’s decision framework while fitting into existing cloud environments. It fails if the product creates another silo or cannot integrate with the customer’s operational workflow.
FOOTHOLD STRATEGY
Beachhead Strategy
Wiz’s beachhead was cloud-first enterprises with complex AWS, Azure, and Google Cloud environments. They were reachable through CISO networks and cloud-security communities; they could adopt quickly because agentless onboarding avoided lengthy deployment. They had meaningful security budgets and urgent need to prioritize cloud risk. The expansion path moved from CSPM into CNAPP, identity security, code security, runtime protection, and AI security.
GROWTH CAMPAIGN
CAMPAIGNS THAT WORKED
SO WHAT: Wiz’s strongest acquisition asset was fast time-to-value: an enterprise could connect its cloud environment and see prioritized risk without a heavy deployment.
KEY LEARNING: in security software, reducing time-to-first-insight can be more persuasive than adding another detection capability.
HOW TO USE: Design a proof-of-value experience that surfaces the customer’s most urgent problem quickly, then expand only after that first insight creates trust.
KEY LEARNING
In a mature market, the entrant must change the buyer’s decision framework. A better point tool rarely displaces an incumbent; a unified decision layer can.
gc
Market Context
| MARKET INTELLIGENCE
PATTERNS IN ENTERPRISE SECURITY DISTRIBUTION:
1. FAST PROOF OF VALUE REDUCES SALES FRICTION. Security buyers want evidence before committing to a platform.
2. PRACTITIONER CREDIBILITY DRIVES ENTERPRISE TRUST. CISOs rely on peer validation and technical depth.
3. PLATFORM EXPANSION RAISES ACCOUNT VALUE. Starting with visibility and expanding into prevention, detection, and response increases retention.
4. THE WEAKNESS: alert fatigue. More findings without prioritization reduce trust and adoption.
| MARKET ENTRY PLAYBOOK
Use brownfield entry when the buyer already has the underlying need but lacks context or prioritization. Build an integration path that delivers value without heavy implementation.
How to enter
| FOOTHOLD STRATEGY PLAYBOOK
Choose customers with complex environments and urgent risk-prioritization needs. Expand into adjacent security modules only after the core graph and workflow are trusted.
How to get the first strong position
MARKET PATTERNS & PLAYBOOK
3
MONEY
money rev pri
Wiz monetizes through annual enterprise subscriptions based on the scale of cloud workloads, assets, or consumption across its platform. Expansion comes from adding cloud accounts, workloads, modules, and security use cases; its growth from $100 million ARR in 18 months to roughly $500 million ARR in 2024 shows strong land-and-expand economics.
REVENUE MODEL
Subscription
PRICING MODEL
Tiered Pricing, Flat Rate Pricing, Custom Enterprise Pricing
WHY THEY WON
Wiz earns recurring subscription revenue from enterprises using its cloud-security platform. The meters are cloud workloads, assets, accounts, and selected security modules. Revenue expands as customers add cloud environments, increase workloads, adopt CNAPP modules, and expand from visibility into prevention and runtime protection; margin depends on cloud infrastructure, data processing, R&D, and enterprise support.
Wiz uses custom enterprise pricing based on the customer’s cloud footprint and selected modules. Public pricing is not disclosed; enterprise buyers typically purchase through annual contracts, cloud-marketplace transactions, or negotiated agreements.
TARGET AUDIENCE
Cloud-first enterprises (core CNAPP; want multi-cloud risk visibility and attack-path prioritization); security teams (CSPM and vulnerability management; want actionable remediation); DevOps and platform teams (code and workload security; want developer-friendly controls); regulated industries and public sector (enterprise security; want compliance, governance, and multi-cloud coverage).
CUSTOMER BUYING BEHAVIOUR
A CISO or security leader usually discovers Wiz through peer recommendation, analyst coverage, or a cloud-security evaluation. The team connects Wiz to its cloud environment, reviews prioritized attack paths, and expands from visibility into remediation workflows and additional security modules.
| PRICING INTELLIGENCE
What makes this model effective & make customers pay
Customers are not buying security alerts; they are buying the ability to know which risks matter and what to fix first.
RULE 1 — PRICE THE DECISION LAYER, NOT THE DETECTOR. A Security Graph creates more value than another isolated scanning tool.
RULE 2 — MONETIZE CLOUD FOOTPRINT EXPANSION. As customers add accounts, workloads, and environments, platform value and spend grow.
RULE 3 — SELL TIME-TO-REMEDIATION. Security teams will pay for fewer, more actionable priorities.
RULE 4 — WATCH THE VENDOR COST TRAP. Cloud data processing, graph computation, and enterprise support can erode margin if pricing does not scale with workload complexity.
The buyer is really buying risk reduction and operational clarity, evidenced by the security-tools and cloud-governance budget.
PRICE & REVENUE
| Revenue Risk - The biggest threat to revenue stability
Cloud-provider native competition: AWS, Microsoft, and Google can bundle security into their platforms.
Platform dependency: Wiz relies on cloud-provider APIs and architectures that can change.
Alert fatigue: if findings are not accurately prioritized, customers may lose trust.
Enterprise implementation drag: large multi-cloud environments require integration, governance, and support.
Competitive consolidation: Palo Alto, Microsoft, CrowdStrike, and other platforms can bundle security capabilities.
AI-security transition risk: new AI workloads and agent-based systems may require different security models and data access.
Wiz was acquired by Google in 2025 for $32 billion; it reported approximately $500 million ARR in 2024 and was projected to cross $1 billion ARR in 2025.
Where the model can break
4
MOTION
motion ge cs
Wiz reduced dependence on paid acquisition through CISO referrals, practitioner credibility, cloud-marketplace co-selling, and fast proof-of-value deployments. Its agentless architecture created a repeatable enterprise motion: connect through APIs, demonstrate attack paths, then expand modules.
GROWTH EXPANSION MODEL
Land & Expand, Product Line Expansion
HOW THEY EXPAND
Wiz expanded from cloud security posture management into a full CNAPP spanning code, identities, workloads, and runtime. It acquired Gem Security in 2024 to strengthen cloud detection and response, and Raftt to enhance developer workflows, while expanding across AWS, Azure, Google Cloud, and Oracle Cloud.
COMPETITIVE STRATEGY
Flanking Attack
HOW THEY COMPETE
Against incumbent security vendors, Wiz flanked the market with an agentless, multi-cloud Security Graph. Against point tools, it differentiated by correlating signals into exploitable attack paths and prioritized remediation.
GROWTH ENGINE
GTM
Content Flywheel
A security team connects Wiz to one cloud environment → sees prioritized attack paths within minutes → remediates high-risk exposures → expands to additional cloud accounts and teams → adopts CNAPP modules for code, identity, workload, and runtime security. The compounding trigger is cloud-footprint growth plus module adoption: each new environment increases the value of the Security Graph. The engine weakens if findings lose accuracy, cloud providers improve native security, or implementation complexity rises. A founder can reproduce this by creating a fast proof-of-value wedge that becomes more valuable as the customer’s usage footprint expands.
Wiz uses an enterprise-sales-led GTM supported by product-led proof of value and cloud-marketplace partnerships. Security leaders enter through peer trust and technical evaluation; Wiz demonstrates attack-path risk quickly, then expands through multi-cloud coverage and CNAPP modules. The primary motion is enterprise sales, supported by practitioner credibility and partner co-selling. The founder-level implication is that security platforms need both a fast technical wedge and a durable enterprise expansion system.
SUSTAINING MOATS
High Customer Lock-In
moat
The moat is Wiz’s Security Graph: its accumulated understanding of relationships among cloud resources, identities, configurations, vulnerabilities, and attack paths. This context improves prioritization and remediation in ways a new point tool cannot quickly replicate.
| MOAT INTELLIGENCE
THE STANDARD: A data moat lasts when customer environment data continuously improves risk prioritization and remediation.
RULE 1 — CONTEXT CREATES DECISION QUALITY. Correlating identities, configurations, and vulnerabilities reveals exploitable paths.
RULE 2 — MULTI-CLOUD COVERAGE INCREASES VALUE. A graph spanning AWS, Azure, and Google Cloud becomes more useful as environments grow.
RULE 3 — REMEDIATION FEEDBACK IMPROVES THE MODEL. Knowing what teams fix and what risks recur improves prioritization.
THE SIGNAL: Wiz reached $100 million ARR in 18 months, roughly $500 million ARR in 2024, and protected more than 40% of the Fortune 100. The moat does not protect against native cloud-security improvements, major platform shifts, or a competitor with superior graph intelligence.
Why this company remains defensible
ARR & TAKEAWAY
ARR Journey - what to do at each stage
PRE-$1M ARR — VALIDATE AGENTLESS CLOUD VISIBILITY. Founded in 2020, Wiz built an agentless platform that connected to cloud APIs and mapped security risk across environments. WATCH: whether enterprises would trust API-only visibility without agents.
$1–5M ARR — WIN FAST PROOF OF VALUE. Wiz used rapid onboarding and attack-path visualization to convert security teams quickly. WATCH: accuracy of risk prioritization and enterprise integration.
$5–10M ARR — SCALE MULTI-CLOUD COVERAGE. The company expanded across AWS, Azure, and Google Cloud, increasing relevance for complex enterprises. WATCH: cloud-provider API dependency.
$10–50M ARR — BUILD THE SECURITY GRAPH MOAT. Wiz deepened its graph-based correlation of identities, configurations, vulnerabilities, and network paths. WATCH: alert fatigue and remediation workflow adoption.
$50–100M ARR — CROSS $100M ARR IN 18 MONTHS. Wiz became the fastest software company to reach $100 million ARR, expanding into CNAPP and enterprise accounts. WATCH: platform breadth versus product focus.
$100M+ ARR — EXPAND INTO FULL CNAPP AND AI SECURITY. Wiz reached roughly $500 million ARR in 2024, acquired Gem Security and Raftt, and agreed to be acquired by Google for $32 billion in 2025. WATCH: native cloud competition and AI-security evolution.
Rule: in security platforms, prove that the decision layer reduces time-to-remediation before expanding into additional detection modules.
COPY PLAYBOOK : What Worked → What Failed → What to Replicate → What to Avoid
THE STANDARD: Build a security platform by removing deployment friction, creating a unified decision layer from fragmented signals, and expanding into adjacent workflows that reuse the same data graph.
SEQUENCE: 1. Identify a security workflow where customers have visibility but lack prioritization; prerequisite: access to the customer’s existing cloud signals through low-friction integration. 2. Deliver a fast proof of value that surfaces the highest-risk, actionable issues; decision gate: security and engineering teams act on the findings. 3. Expand into adjacent modules only when they strengthen the same decision graph; prerequisite: accuracy, scalability, and enterprise support.
WORKED: Wiz’s agentless onboarding and Security Graph created rapid enterprise adoption and strong land-and-expand economics.
CAUTION: Do not build another alert-generation tool; security buyers are already overwhelmed. Do not depend entirely on one cloud provider’s APIs or native security roadmap without a multi-cloud abstraction and differentiation.
bottom of page