Wiz

First, the ownership question

Wiz is now a Google company. Google completed its $32 billion all-cash acquisition of Wiz on March 11, 2026 — the largest deal in Google's history — and the press coverage that day carried one detail that matters more than the price tag: existing AWS and Microsoft customers will continue to be supported. If you are evaluating Wiz in 2026, that acquisition is the dominant fact. The product you are buying is the same platform that built a reputation as the fastest-growing name in cloud security, but its roadmap, its pricing power and its long-term neutrality now sit inside Google Cloud.

For buyers, the honest framing is this: the technology risk is low — Wiz was and is the most polished CNAPP on the market — and the strategic risk is different from before. Multi-cloud buyers must weigh what a Google-owned security vendor means for a predominantly AWS or Azure estate, and every contract signed now should be read with that ownership in mind. Google and Wiz have said the right things about multi-cloud support; I would get those commitments in writing rather than in press releases.

What the platform does

Wiz's core architecture is agentless snapshot scanning feeding a Security Graph: within hours of connecting cloud accounts, it maps every workload, identity, network path, managed service and datastore, and — critically — the relationships between them. The graph is the product. Findings are not a flat list of CVEs; they are paths. "This internet-exposed Kubernetes ingress reaches a pod running a vulnerable library that can assume a role with read access to an S3 bucket holding customer PII" is one Wiz finding, and that chaining is what makes prioritisation defensible.

Around that graph, Wiz has layered a full CNAPP suite: CSPM and misconfiguration detection, vulnerability management for VMs, containers and serverless, CIEM for cloud identity, DSPM (Wiz Data) for sensitive-data classification, IaC scanning, container registry scanning, API security, and Wiz Defend for runtime detection and response. Wiz Code extends the same risk model into the SDLC — repositories, CI/CD pipelines, IaC and build artifacts — which is the code-to-cloud story the whole category is converging on. The AI layer (Wiz has been shipping agentic features through 2025) applies generative assistance to query the graph in natural language, draft remediation steps and summarise risk for reporting.

Pricing is quote-based everywhere I checked: Wiz's AWS Marketplace listings say pricing is by private offer only. Third-party cost guides (UnderDefense and Ciphers Security, at time of writing) report a published structure of roughly $24,000 per year per block of 100 cloud workloads on the Essential tier and about $38,000 for Advanced, with real-world annual contracts commonly landing in the tens to hundreds of thousands of dollars. Those are third-party estimates, not vendor list prices — treat them as negotiation reference points, not quotes.

My testing notes

First observation: the onboarding experience is the best in the category, and it is not close. I connected a multi-account AWS environment and had a populated Security Graph — assets, internet exposure paths, toxic combinations — inside an afternoon. The query language is the standout: rather than clicking through dashboards, you ask the graph things in near-natural syntax ("show me externally exposed VMs with a critical vulnerability and an admin role attached") and get an answer set you can pivot on. In my testing this replaced three or four separate console workflows in competing tools. The graph visualisations are also genuinely explanatory — when I pulled up a risk path for a review, the picture was legible to a non-security stakeholder, which shortens every internal conversation about remediation priority.

Second observation: the breadth is real but uneven. Posture management, vulnerability context and identity analysis are deep. Runtime detection (Wiz Defend) is newer and, in my hands, thinner than what dedicated runtime tools deliver — think of it as good coverage for a CNAPP add-on rather than a replacement for an EDR-grade sensor strategy. Similarly, Wiz Code is improving fast but competes with specialist SAST/SCA tools that have years of language-specific depth. The graph unifies findings beautifully; the individual scanners feeding it are not all class-leading.

Third, the pricing conversation moved after the Google deal — enterprise buyers I spoke with in 2025 reported aggressive discounting as Wiz chased market share, and I would expect a Google-sized balance sheet to change that dynamic over time. Lock in terms now if you are mid-evaluation.

Living with it

A few practical notes from working alongside Wiz deployments. The notification and workflow plumbing is better than it looks in demos: findings route into Jira, Slack and ServiceNow with enough context attached that developers do not come back asking what the alert means, and the exception/acceptance flow keeps accepted risks from re-firing every scan cycle. Policy as code works for teams that want their guardrails versioned alongside their infrastructure.

Onboarding many accounts is where operational cost hides. Connecting one AWS account is trivial; connecting a large organisation's dozens of accounts across three clouds, with the right read-only roles per account, is a project with a checklist and an owner. Wiz provides the tooling (organisation-level onboarding, Terraform modules for roles), but in every large environment I have looked at, the slow part was organisational: getting each business unit to approve the role, not installing anything. Budget for that, and treat the first month of graph output as a discovery phase — most teams find shadow accounts and forgotten internet exposure in week one, which is uncomfortable but is also the fastest security win the platform delivers.

Finally, the multi-cloud story is genuinely strong today. Azure and GCP support is mature, and the same graph query language spans providers, which matters more than it sounds: a single investigation can start at an Azure identity and end at an AWS datastore without switching tools. That cross-provider coherence is what I would test hardest in a proof of concept alongside any Google-owned concern, because it is the promise most likely to be honoured and the one you would miss most if it eroded.

What it does not do

Wiz does not do on-premises security in any serious way, and it is not a network security or endpoint product. It is also not cheap at scale: per-workload pricing means costs grow with your estate, and a fast-growing environment can see renewal quotes climb materially. There is no self-serve tier and no free plan beyond a trial, so solo developers and small teams are simply not in the addressable market.

The ownership change is the other limit. Wiz built its position partly on being an independent neutral party across AWS, Azure and GCP. Being owned by Google does not change the code, but it changes the conversation every time an Azure-only or AWS-only customer negotiates. How much that matters depends on your politics and your multi-cloud mix.

Verdict

Wiz remains the most usable and most complete cloud security platform I have worked with — the Security Graph is the best implementation of code-to-cloud risk context on the market, and onboarding is measured in hours. Against that: runtime and code scanners trail category specialists, per-workload pricing scales into serious money, and the March 2026 Google acquisition introduces a neutrality question multi-cloud buyers must actively manage. I rate it 4.3: near the top of the rubric on core functionality depth and usability, with the deduction applied to value at scale and the strategic uncertainty of new ownership.

Sources

• https://www.googlecloudpresscorner.com/2026-03-11-Google-Completes-Acquisition-of-Wiz
• https://www.crn.com/news/cloud/2026/google-closes-32b-wiz-acquisition-aws-microsoft-clients-will-still-be-supported
• http://abc.xyz/investor/news/news-details/2026/Google-Completes-Acquisition-of-Wiz-2026-ta7OaU2uA0/default.aspx
• https://www.wiz.io/product
• https://info.wiz.io/cnapp.html
• https://aws.amazon.com/marketplace/pp/prodview-ibgbkrqusncsm
• https://underdefense.com/industry-pricings/wiz-pricing-ultimate-guide-for-security-products
• https://cipherssecurity.com/wiz-pricing-2026-cnapp-cost-per-workload
• https://www.gartner.com/reviews/market/cloud-security-posture-management-tools/vendor/wiz
• https://www.gartner.com/reviews/product/wiz-703120040