How Cloud Security Acquisitions Are Changing the Tech Industry

Assuming the Wiz deal goes through, Google becomes the first cloud agnostic provider of best-in-class security solutions on the market. And this is a really big deal for the future of infosec. Investors and vendors alike have been worried about cloud providers "just offering something similar and winning the market." But this worry assumed: 1️⃣ They'd provide cloud agnostic tools (meaning ones that work off of aws for example) and 💡 they don't 💡 2️⃣ They'd build best-in-class tools to rival the functionality of vendor products that specialize in a given space and 💡 they don't 💡 (this can be debated but by and large true for a variety of reasons) These two failures of cloud provider's security tools have created huge opportunity for stand alone security providers to win big parts of the market with tools that cater to the practical needs of the enterprise buyer (who wants best of breed and cloud/platform agnostic tools). The Wiz deal changes things. Big time. I was keeping an eye on Google with the Mandiant deal. This was the most interesting part of that deal: Mandiant doesn't just work on Google tools. It's fully agnostic and was a major acquisition. Wiz is a completely different stratosphere of big for this strategy. Google now has a series of core software infrastructure products and a world class services group that can deliver security solutions to enterprises regardless of the cloud provider they use. And they're the first to do this. What does this mean? Google will likely be a major player in cyber M&A go forward and have some very unique competitive advantages against both the other cloud providers AND the other large scale security providers. Your move Amazon.

The 44 leading cybersecurity vendors tracked by Omdia announced 29 mergers and acquisitions in the first half of 2025, nearly matching the full-year total for 2024. The combined estimated deal value surged to $61.10bn, nearly 6x higher compared to the same period in 2024. Excluding the two mega-deals involving Google Cloud Security-Wiz ($32bn in 1Q) and Palo Alto Networks-CyberArk ($25bn in 3Q), the remaining 27 transactions totalled $5.10bn, with 16 valued at $100m or more. PANW announced its largest acquisition to date, a proposed $25bn takeover of identity security vendor CyberArk. The deal signals a strategic pivot for PANW, moving beyond smaller tuck-in technology acquisitions toward platform-scale diversification. CyberArk has itself been acquisitive, having added Zilla Security for $175m and Venafi for $1.54bn to its portfolio in the last two years. In the 3Q, AI security M&A accelerated, as vendors raced to add new capabilities to capture emerging opportunities in mitigating the expanding threat landscape posed by LLMs and agentic AI. Nearly $1bn was spent on four early-stage vendors, which had secured almost $150m. These included Check Point Software-Lakera, CrowdStrike-Pangea, F5-CalypsoAI, and SentinelOne-Prompt Security. CrowdStrike’ Onum SentinelOne’s Oberservo AI deals underscore intensifying SIEM competition. These acquisitions strengthen their platforms with enriched and consolidated telemetry data from multiple sources and reduced ingestion costs. Since 2022, 115 cybersecurity deals have been announced, totalling $181bn. 94 involved venture-backed vendors, acquired for $54.23bn after raising $8.04bn. Excluding Google Cloud–Wiz, the remaining 93 deals totalled $22.23bn, with $6.04bn in funding. Average funding-to-sale multiple: 12.5×; excluding Wiz: 8.1×.

Oasis Security raised $120 million 131 days ago. Cyera just agreed to buy them for $1 billion. That is $6.3 million per employee, across 158 people. Cyera paid $50 million for Genie in May. Five people. Ten million a head. Same buyer, thirty times the headcount, roughly the same price per person. Third acquisition of 2026. Ryft in April, Genie in May, Oasis in July, on a $12 billion valuation and a fresh $600 million round. Here's what the numbers say. Three weeks ago we published the Q2 momentum board. Cyera topped Data Protection. Oasis topped IAM. Adjacent categories, adjacent boxes. Cyera did not buy a leaderboard entry. It bought the company pulling away from everyone else in the category it needed next. So what's happening? Non-human identity stopped being an identity problem. Every AI agent is a credential with read access to your data. Data security and machine identity have been two separate buying centers, and the agent wave just collapsed them into one. Momentum in isolation is a vanity metric, but read it across adjacent categories and you could have an acquisition map. The playbook for founders is simple, yet difficult to pull off: 1. Find the category next to yours where a funded buyer has a hole. 2. Accelerate visibly enough that they cannot model their roadmap without you. Oasis did both in under four years. Watch who tops Cloud Security next.

Google’s biggest-ever $32B #Wiz cyber acquisition is so big that genAI news is ho-hum despite it being #Nvidia #GTC week... Or so it seems: As a CEO building deep tech right in the middle of all these things for years now, first with Graphistry and now also Louie.ai, the real story to me isn’t the future of cloud security. It’s cloud security **AI**. My three takeaways behind this: 1️⃣ Graph is the security intelligence layer Wiz's internals look similar to what top security teams do, whether it's one of the top 3 cloud providers or a three letter agency: they understand risk isn’t about asset lists, it’s about the relationships between them. Core Wiz tech tracks cloud physical and logical assets as a graph. Underneath it all? One of our favorite partners, #AmazonNeptune. Beyond Wiz's cloud asset tracking, we work with customers every day as they extend this concept to their other assets like on-prem devices, and at the next magnitude of intensity of understanding dynamic event activities. 2️⃣ Google is doubling down on security data tech Chronicle (Google’s cloud SIEM) and Google Cloud don’t just want to secure infrastructure; they want to own the entire security data layer. Compliance, attack surface management—those are just applications of a much bigger shift. Wiz buys Chronicle a semantic asset layer into other clouds, as well as their customers. 3️⃣ AI for security is the end game The next wave isn’t just asset mapping and continuous compliance —it’s making sense of it all: Quickly, correctly, and automatically. The more the Louie.ai team works with our customers on AI investigation copilots & autonomous investigation agents, the clearer I'm seeing it. Cleaning up the security intelligence layer is the difference between an AI stumbling through a swamp vs speeding down a highway. Graph is great for analysts today, and it is paving the way for AIs in the future. I've come to appreciate the best M&A deals are literally free. The stock jump covers the cost so you even make money. That’s not happening here, so the payback period will take time. For everyone in our community, however, this is a massive vote of confidence in graph, AI, and what is happening in investigation & security tech. Brad Bebee Dave Bechberger Pramod Gosavi Paco Nathan Ben Lorica 罗瑞卡 James Cham Victor Fang, Ph.D. Anton Chuvakin

𝐆𝐨𝐨𝐠𝐥𝐞'𝐬 𝐁𝐢𝐠 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐌𝐨𝐯𝐞: 𝐓𝐡𝐞 $32 𝐁𝐢𝐥𝐥𝐢𝐨𝐧 𝐖𝐢𝐳 𝐀𝐜𝐪𝐮𝐢𝐬𝐢𝐭𝐢𝐨𝐧 𝐄𝐱𝐩𝐥𝐚𝐢𝐧𝐞𝐝 Google is acquiring Wiz, for $32 billion, with plans to integrate it into Google Cloud by 2026. To put that price tag in perspective, it's roughly equivalent to what Microsoft paid for LinkedIn or what Salesforce paid for Slack. 𝐖𝐡𝐲 𝐖𝐢𝐳 𝐈𝐬 𝐖𝐨𝐫𝐭𝐡 $32 𝐁𝐢𝐥𝐥𝐢𝐨𝐧 𝐭𝐨 𝐆𝐨𝐨𝐠𝐥𝐞 Wiz has developed something special: an AI-powered security platform that gives organizations unprecedented visibility into their cloud environments. Think of it as having X-ray vision for your digital infrastructure—it spots vulnerabilities and threats that traditional tools often miss. What makes Wiz particularly valuable is its approach to multi-cloud security. Most large organizations today don't just use one cloud provider—they might use Google Cloud for some operations, AWS for others, and Azure for yet more. Managing security across all these environments has become increasingly complex, and Wiz offers a unified solution to this growing headache. 𝐓𝐡𝐞 𝐅𝐚𝐬𝐜𝐢𝐧𝐚𝐭𝐢𝐧𝐠 𝐃𝐞𝐚𝐥 𝐒𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞 Here's where things get interesting. Even though Google is buying Wiz, the company's products will continue to work on competing cloud platforms like AWS, Microsoft Azure, and Oracle Cloud. This is unusual but strategically brilliant for several reasons: - Customer retention: Wiz's existing customers won't need to switch cloud providers, preventing a mass exodus that would devalue the acquisition. - Regulatory smartness: By keeping Wiz operating across all major cloud platforms, Google avoids raising red flags with antitrust regulators who might otherwise worry about Google limiting a critical security tool to its own ecosystem. - Market expansion: Google can now earn revenue even from customers primarily using competing cloud services—essentially collecting "security rent" from its competitors' customer bases. The Price Negotiation Story What's particularly fascinating is that Wiz initially turned down an offer of about $23 billion last year. This confidence prompted Alphabet to increase its bid by nearly 40% to $32 billion. 𝐖𝐡𝐚𝐭 𝐓𝐡𝐢𝐬 𝐌𝐞𝐚𝐧𝐬 𝐟𝐨𝐫 𝐭𝐡𝐞 𝐈𝐧𝐝𝐮𝐬𝐭𝐫𝐲 While previous competition focused primarily on computing power, storage, and services, security has now emerged as a critical battleground. Microsoft and Amazon will likely respond with their own security-focused acquisitions. For enterprise customers, this is mostly good news. Google's resources will likely accelerate Wiz's product development, while the multi-cloud approach ensures continued choice and flexibility. However, this consolidation could eventually lead to higher prices if competition in the cloud security space diminishes. Early investors in Wiz are seeing exceptional returns, and this 𝐝𝐞𝐚𝐥 𝐰𝐢𝐥𝐥 𝐥𝐢𝐤𝐞𝐥𝐲 𝐭𝐫𝐢𝐠𝐠𝐞𝐫 𝐫𝐞𝐯𝐚𝐥𝐮𝐚𝐭𝐢𝐨𝐧𝐬 𝐚𝐜𝐫𝐨𝐬𝐬 𝐭𝐡𝐞 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐬𝐞𝐜𝐭𝐨𝐫.

10 years from now, every large B2B company will be a security company, whether it wants it or not. This is already happening: > Accenture just bought a majority stake in Dragos, alongside full acquisitions of runZero and NetRise, for a combined value of approximately $4.2 billion, an absolutely massive amount for them. > Google’s largest-ever acquisition is a cybersecurity player (Wiz). Even more shocking, if you look across the transactions where they’ve disclosed pricing, Google spent $37.9 billion on just three cybersecurity companies - Siemplify, Mandiant, and Wiz - compared with roughly $41 billion on the other 62 acquisitions combined. That is an insane number if you consider that Google is not really a security company. > ServiceNow’s largest-ever acquisition is also a cybersecurity player (Armis). Not only that, but in a single month ServiceNow acquired more than one billion-dollar security company (Veza). > Mastercard’s second-largest acquisition ever is also a cybersecurity company (Recorded Future). Before doing that deal worth almost $3 billion, Mastercard did a bunch of smaller M&As like Ethoca in 2019, RiskRecon in 2019, and Baffin Bay Networks in 2023. > Cisco’s largest-ever acquisition is also a security company. Splunk is not a pure-play cybersecurity vendor, but security represents a major part of its business. What people don’t know is that Cisco is actually the most active cybersecurity acquirer, having absorbed more than 40 security companies over the past two decades. > Mitsubishi Electric, Apple, HP, HPE, and many other major technology and industrial companies have also spent a lot of money to acquire cybersecurity startups and integrate their capabilities into broader offerings. In the next decade, I think we’ll see more of this. Ecommerce companies will be buying fraud detection, AI coding platforms will be buying code security platforms, and so on. As all B2B companies become security companies, we’ll see a big shift in the market. 

Google has spent $38 billion building a cybersecurity empire. The $32 billion Wiz deal closed on March 11, the largest cybersecurity acquisition. Combined with Mandiant, Siemplify, and VirusTotal, Google has assembled the broadest security platform in the industry. Highlights: 🔹 Four acquisitions since 2012: VirusTotal for malware intelligence, Siemplify for SOAR, Mandiant for threat intel and IR, Wiz for CNAPP. Plus Chronicle, BeyondCorp, Security Command Center, and Sec-Gemini built internally. 🔹 Forrester estimated Google paid 45-50x Wiz's annual revenue. The premium opens a door into the Fortune 100 IT and AI budgets through security. 🔹 Google owns the brain: the SOC where all telemetry converges, enriched by Mandiant intelligence, investigated by Sec-Gemini. Partners provide the sensors: CrowdStrike for endpoints, Palo Alto Networks for network security, Snyk for AppSec. My take: 1️⃣ Google is following Microsoft's playbook. Combined cybersecurity revenue is probably $3-4 billion annually with Wiz, well below Microsoft's $20 billion, but Google is already in the top-5 cybersecurity vendors club. 2️⃣ Google flips the cloud security sequence. Microsoft bundles Defender into M365 after you buy it. AWS adds GuardDuty after you're on its cloud. Google: run Wiz on AWS and Azure, Mandiant everywhere, then discover some non-security workloads actually run better on GCP. 3️⃣ Frontier labs entering cybersecurity is the most important trend. OpenAI and Anthropic are building security products and acquiring security companies. Security is becoming a platform feature paid through compute budgets. 4️⃣ The cybersecurity industry is getting absorbed into AI platforms. A startup opportunity is a multi-platform AI security layer so enterprises can build multi-platform strategies. A Wiz for the AI era. Full analysis on The Weather Report 👇

Google’s $32 billion acquisition of Wiz is a strategic investment in the future of cloud and AI security. This move accelerates two major trends shaping the AI era: improved cloud security and the increasing need for multicloud strategies. A single pain of glass is more important than ever with expanded attack surface. Cloud and AI are still in the early stages of enterprise adoption, and as organizations lean further into both, security challenges will only grow. Google is betting that securing this evolving landscape will be a long-term, high-value play. This acquisition highlights a key shift. Hyperscalers aren’t just providing infrastructure anymore, they want to own security across multiple cloud environments. The market for cloud security is still in its early days, and as AI adoption scales, the demand for integrated, AI-powered security solutions will rise exponentially. Will Google’s acquisition speed up Wiz’s innovation, or will it push enterprises toward deeper integration with Google Cloud? How will Palo Alto and Crowdstrike respond to this? And is this the beginning of a larger wave of cybersecurity acquisitions by cloud providers looking to dominate the space?This acquisition is a strong signal that we’re just at the start of a much larger transformation. https://lnkd.in/gw6Cd2AQ

I'm sure there will be a lot of thoughts today on Google's acquisition of Wiz. I believe this is a game changer for cybersecurity, startups and venture capital in general. Google’s $32B acquisition of Wiz isn’t just another big tech deal—it’s a defining moment for cybersecurity, cloud innovation, and startup valuations. For startups: This validates the massive market potential for security-first cloud solutions and the need for hyper-growth execution. The lesson learned is: stay focused on what you do great and then make it greater. Wiz exemplifies this in their execution. For VCs: It signals a continued appetite for late-stage M&A versus IPOs, proving that the right tech with the right traction can drive billion-dollar exits and it doesn't have to be through the public markets. For big tech: The competition to secure cloud environments is heating up, and strategic acquisitions are becoming the fastest path to leadership. The lesson? Security isn’t a feature—it’s foundational. The market is rewarding those who get it right. What are your thoughts on how this will shape future deals?