The $32 billion Wiz acquisition and the CNAPP market

Google’s massive cloud security bet

Google closed its acquisition of Wiz on March 11, 2026. While press reports cite a $32 billion headline value, the SEC filing lists a final price of $29.5 billion after purchase-price adjustments, making this the largest acquisition in the history of Google. This transaction reshuffled the cloud-native application protection platform (CNAPP) market overnight. Wiz remains an independent product line within Google Cloud that supports AWS, Microsoft Azure, and Oracle Cloud. I observe that this multicloud support prevents a massive loss of business that would follow if Wiz became a Google-exclusive tool. This deal places Wiz alongside Mandiant’s threat intelligence within Google’s Unified Security Platform. The economic choice to spend $32 billion involves significant opportunity cost, as Google could have allocated those scarce resources toward other research or infrastructure. Does the integration into a hyperscaler eventually compromise the neutrality required by multi-cloud customers?

Comparing Wiz and Prisma Cloud pricing

Wiz scaled its annual recurring revenue from $500 million to over $1 billion before this deal. The company serves more than 4,500 organizations, including 40% of the Fortune 100. I find the shift toward consolidation logical because 82% of cloud breaches trace back to misconfiguration, identity abuse, or vulnerable workloads. The CNAPP sub-category market remains highly contested, with KuppingerCole estimating its value at $11.43 billion and MarketsandMarkets placing it at $7.9 billion for 2026. Unlike Palo Alto Networks, which uses a credit-based model for Prisma Cloud, Wiz prices by protected cloud workload.

Median customer spend reaches approximately $111,500 annually. You likely know that Prisma Cloud modules like CIEM and AI-SPM require specific credit allocations. Palo Alto’s modules cover vulnerability management and runtime security, while Wiz uses agentless scanning to read cloud provider APIs and disk snapshots. Wiz integrates with Jira, ServiceNow, Slack, PagerDuty, Splunk, and Microsoft Sentinel. A CNAPP replaces the need for five separate point tools: Cloud Security Posture Management, Cloud Workload Protection, Cloud Infrastructure Entitlement Management, container and Kubernetes security, and AI Security Posture Management. This consolidation connects a misconfigured S3 bucket to the over-permissioned role that can reach it and the vulnerable container exposed to the internet.

Shifting security priorities

Defenders face a shrinking window for response. Data from ZeroDayClock shows the average window between vulnerability disclosure and active exploitation dropped from over two years to 21.5 days. I find that most high-severity alerts exist in isolation. While security teams often obsess over entry points, software remote code execution accounted for only 9% of observed findings. Most exploitable risk concentrates in information disclosure, credentials exposure, and unauthorized access. 30% of observed cloud environments contain at least one externally exposed machine tied to high-impact lateral movement paths. Cisco attempts to compete in this space by providing AI-optimized networking and agentic SOC capabilities to protect against such lateral movement. Cisco delivers zero-trust segmentation and application protection with a highly-distributed security fabric that scales to support any AI application while simplifying complex environments. I find that chasing endless vulnerability feeds provides diminishing returns when compared to managing the toxic intersections of access and privilege. Security teams must use scarce engineering hours to prioritize real-world risk over theoretical flaws.