Wiz

The AI cloud security platform that Google paid $32 billion for — agentless CNAPP protecting half the Fortune 100 across every major cloud.

Wiz Review: The Cloud Security Platform That Became the $32 Billion Standard for Multi-Cloud Protection

Wiz was founded in January 2020 by four Israeli entrepreneurs who had previously sold Adallom to Microsoft for $320 million. In six years they built the fastest-growing cybersecurity company in history — crossing $1 billion in ARR in 2025 and being acquired by Google for $32 billion in cash on March 11, 2026, the largest acquisition in Google’s history and the biggest cybersecurity transaction ever recorded. The reason Google paid that price is the same reason roughly half of the Fortune 100 uses Wiz — the platform solved the most pressing security problem of the cloud era, toxic risk combinations that span multiple cloud layers and are invisible to tools that only see one layer at a time, and did it with an agentless architecture that delivers full coverage in minutes rather than the months that agent-based alternatives require.

Quick Summary

Wiz is an AI cloud-native application protection platform acquired by Google for $32 billion in March 2026 — providing agentless cloud security across AWS, Azure, Google Cloud, and OCI with full coverage of code, pipeline, cloud infrastructure, identity, and runtime through the Wiz Security Graph, 150 plus AI detection models, and the Wiz Blue Agent for autonomous incident response — named a Forrester Wave Leader for CNAPP in Q1 2026.

Is it worth using? Yes for mid-market and enterprise organisations running workloads across AWS, Azure, or Google Cloud who want the most validated, most adopted cloud security platform to secure their full cloud environment from code to runtime without agent complexity.
Who should use it? CISOs, cloud security engineers, DevSecOps teams, and security operations professionals at organisations with meaningful cloud infrastructure across AWS, Azure, or Google Cloud who need comprehensive CNAPP coverage.
Who should avoid it? Organisations with primarily on-premises infrastructure where network-based detection and endpoint security are more relevant than cloud-native application protection.

Verdict Summary

Best for

Enterprise and mid-market organisations running significant workloads across multiple cloud providers who want one platform providing code security, cloud posture management, workload protection, identity security, and runtime threat detection without deploying and managing agents across every workload
Security teams who want AI to prioritise the threats that actually matter — the Wiz Security Graph identifies toxic combinations of risk that span multiple cloud layers, surfacing the attack paths most likely to lead to a breach rather than flooding analysts with individual vulnerability alerts
Organisations who need to secure AI workloads and AI systems alongside traditional cloud infrastructure — Wiz’s AI security capabilities detect threats to and from AI models and AI agents running in the cloud

Not for

Organisations whose infrastructure is primarily on-premises or in private data centres where network detection and endpoint security are the more relevant controls
Very small companies with minimal cloud footprint where the per-workload pricing and enterprise orientation exceed budget and scale requirements
Buyers who want a fully independent vendor unconnected to any major cloud provider — Google’s ownership creates a genuine conflict-of-interest consideration for AWS and Azure-primary organisations, though Google has committed to maintaining multicloud support

Rating
⭐⭐⭐⭐½ 4.6 / 5

What Is Wiz?

Wiz is a cloud-native application protection platform — a CNAPP — that unifies the security disciplines previously distributed across separate cloud security tools. Cloud Security Posture Management, Cloud Workload Protection, Cloud Infrastructure Entitlement Management, container and Kubernetes security, code security, and runtime threat detection all consolidate into one platform without requiring agents to be deployed and managed across each workload.

The Wiz Security Graph is the core architectural differentiator — a graph that maps every cloud resource, identity, network path, and vulnerability across the full cloud environment, then identifies the combinations of risk that create actual attack paths rather than reporting each issue in isolation. A single misconfigured storage bucket is a low-priority finding. A misconfigured storage bucket reachable from an internet-facing container running with excessive IAM permissions that has a critical vulnerability represents a real breach path — and the Security Graph makes that combination visible in a way that point tools examining each element separately cannot.

Following the Google acquisition in March 2026, Wiz operates as part of Google Cloud while maintaining its brand, multicloud commitment, and product roadmap. Google committed to maintaining Wiz’s support for AWS and Azure customers as a condition of US regulatory approval.

How Wiz Works

Connect cloud accounts agentlessly. Wiz connects to AWS, Azure, Google Cloud, and Oracle Cloud Infrastructure through read-only API access — no agents, no sidecars, no packet mirroring required. Full visibility across the environment is achieved in minutes, not months.
Security Graph maps the full environment. Wiz builds a real-time graph of every cloud resource, identity, network connection, vulnerability, secret, and misconfiguration — and the relationships between them — across the entire multi-cloud environment.
AI identifies toxic risk combinations. Rather than reporting individual issues, Wiz’s AI identifies the combinations that create real attack paths — container with critical vulnerability plus internet exposure plus excessive IAM permissions equals a high-priority finding that warrants immediate action.
Runtime Sensor detects active threats. Wiz’s kernel-level Runtime Sensor monitors process execution, system calls, and network connections inside workloads in real time — detecting active threats including container escapes, unauthorised code execution, and C2 communications as they happen.
Blue Agent investigates and responds autonomously. The Wiz Blue Agent investigates security alerts end-to-end — correlating runtime activity with source code, identifying related code changes and pull requests, and distinguishing legitimate application behaviour from actual attacks without manual analyst investigation.
Code security starts at the IDE. Wiz Code connects security to the development workflow — identifying vulnerabilities, exposed secrets, and misconfigurations in code and IaC before they reach production, with direct PR comments and IDE integrations.

Key Features

Agentless cloud security across AWS, Azure, Google Cloud, and OCI — full coverage in minutes without agent deployment
Wiz Security Graph mapping toxic risk combinations across code, cloud, identity, and runtime
150 plus AI detection models and 36 patents for threat detection across all major cloud environments
Cloud Security Posture Management for misconfiguration and compliance across the full cloud estate
Cloud Workload Protection for containers, VMs, serverless, and Kubernetes
Cloud Infrastructure Entitlement Management for excessive permission and identity risk
Runtime Sensor for kernel-level real-time threat detection inside workloads
Wiz Blue Agent for autonomous end-to-end incident investigation and response
Wiz Code for shift-left security in developer workflows — IDE integrations and PR comments
AI workload security — detecting threats to AI models, agents, and AI-related cloud infrastructure
Named Forrester Wave Leader for CNAPP Q1 2026
Named Gartner Magic Quadrant Leader or included in multiple security categories
Acquired by Google for $32 billion in March 2026 — part of Google Cloud
Roughly half of the Fortune 100 use the Wiz platform

Real-World Use Cases

Multi-cloud risk prioritisation: A security team at a 2,000-person technology company runs workloads across AWS and Azure — their vulnerability scanner produces 50,000 findings. Wiz’s Security Graph identifies the 12 attack paths that represent actual breach risk by correlating vulnerabilities with internet exposure, identity permissions, and network reachability. The security team focuses on 12 findings that matter rather than triaging 50,000.
AI workload protection: A company deploying AI models in their cloud environment uses Wiz to monitor AI workloads — detecting when an AI agent makes unusual API calls, when an AI model container is communicating with unexpected external endpoints, or when AI training infrastructure is misconfigured to expose sensitive training data.
Autonomous incident response: The Wiz Blue Agent detects a container executing a binary that was not in the original image — a potential compromise. The agent automatically investigates the runtime activity, traces it back to a recent code change in a specific pull request, identifies the code owner, and determines whether the action is a legitimate application change or a real attack — all before a human analyst has been paged.
Developer-first security: A DevSecOps team uses Wiz Code to shift security left — developers receive security findings directly in their IDE and as automated PR comments, fixing misconfigurations and exposed secrets before the code reaches production rather than discovering them after deployment.

Pros and Cons

Pros	Cons
Agentless architecture achieves full cloud coverage in minutes — no months-long agent deployment programme	Google acquisition creates a genuine conflict-of-interest consideration for AWS and Azure-primary organisations — buyers should confirm multicloud commitment terms directly
Wiz Security Graph identifies toxic risk combinations that point tools examining individual issues miss entirely	Per-workload pricing can scale unexpectedly at large cloud footprints — budget modelling requires workload count from cloud inventory
Roughly half the Fortune 100 use Wiz — the most validated enterprise cloud security platform by adoption scale	Runtime Sensor (agent-based component for active threat detection) requires deployment on workloads where runtime visibility is needed
Forrester Wave Leader for CNAPP Q1 2026 — sustained independent validation across the most important cloud security categories	Blue Agent autonomous response capabilities are powerful but require careful threshold configuration to avoid unintended containment actions
AI security capabilities cover threats to and from AI models and agents — the most forward-looking cloud security platform for the AI era	Very small companies with limited cloud footprints find the platform’s scale and enterprise orientation disproportionate to their needs

Pricing & Plans

Wiz pricing is per-workload and custom-quoted based on cloud environment size, modules selected, and commercial terms. Based on third-party buyer data:

Entry-level deployments for smaller environments start at approximately $30,000 to $50,000 per year
Mid-market deployments typically run $100,000 to $300,000 per year
Enterprise Fortune 500 deployments run $500,000 to several million per year
No public pricing — all quotes require a demo and sales engagement

Contact Wiz at wiz.io to book a demo and receive a custom quote based on your cloud environment.

Best Alternatives & Comparisons

CrowdStrike — Better for endpoint-first security with the strongest MITRE benchmark results and Charlotte AI conversational security analysis alongside cloud coverage
Darktrace — Better for network behavioural detection and autonomous response, particularly for OT and industrial environments
Orca Security — Similar agentless CNAPP approach at competitive pricing — direct comparison warranted for mid-market buyers
Palo Alto Networks Prisma Cloud — Better for organisations already invested in the Palo Alto security platform ecosystem

Frequently Asked Questions (FAQ)

What is Wiz?

Wiz is an AI cloud security platform — acquired by Google for $32 billion in March 2026 — providing agentless CNAPP protection across AWS, Azure, Google Cloud, and OCI with the Wiz Security Graph identifying toxic risk combinations, runtime threat detection, and AI workload security.

Was Wiz acquired by Google?

Yes — Google completed its $32 billion cash acquisition of Wiz on March 11, 2026 — the largest acquisition in Google’s history and the biggest cybersecurity transaction ever recorded. Wiz operates as part of Google Cloud while maintaining its brand and multicloud commitment to AWS and Azure customers.

Is Wiz agentless?

Yes — Wiz’s core platform is agentless, connecting to cloud environments through read-only APIs to achieve full visibility without deploying or managing agents across workloads. The Runtime Sensor for active runtime threat detection is an optional agent-based component for workloads where real-time detection is required.

What is the Wiz Security Graph?

The Wiz Security Graph is a real-time map of every cloud resource, identity, network connection, vulnerability, and misconfiguration across the entire cloud environment — and the relationships between them. Rather than reporting issues individually, it identifies toxic combinations of risk that create actual attack paths to a breach.

What is the Wiz Blue Agent?

The Wiz Blue Agent is an autonomous AI incident responder that investigates security alerts end-to-end — correlating runtime activity with source code, identifying related code changes, and distinguishing legitimate application behaviour from real attacks without requiring manual analyst investigation.

How does Wiz compare to CrowdStrike?

Wiz is cloud-infrastructure-first — agentless CNAPP protecting cloud workloads, identities, and code with the Security Graph for risk correlation. CrowdStrike is endpoint-first with the strongest validated endpoint detection benchmark performance and Charlotte AI for conversational security analysis. Wiz for comprehensive cloud infrastructure security. CrowdStrike for endpoint and XDR coverage with strong cloud capabilities.

Final Recommendation

Wiz is the most validated and widely adopted cloud security platform available — and Google’s $32 billion acquisition reflects both the strategic importance of cloud security in the AI era and the competitive advantage that Wiz’s Security Graph, agentless architecture, and Blue Agent autonomous response create. For any CISO or cloud security team trying to understand their true attack surface across a complex multi-cloud environment, Wiz provides the toxic risk combination visibility that individual cloud security tools cannot match. The Google acquisition adds cloud ecosystem integration while warranting buyer diligence on multicloud commitment terms for AWS and Azure-primary organisations.

Next steps