Wiz ascent to $10 billion valuation shows cloud security ‘still huge’

Over the past year, the tech landscape has been dominated by stories of downsizing due to rising interest rates, inflation, and concerns about economic turmoil. Even in growth areas like the cloud, companies are reeling from spending.

Don’t tell that to Wiz.

The cybersecurity software company said in August that it had reached $100 million in annual recurring revenue after selling its product for just a year and a half. After nine months, the revenue figure reached $200 million.

Wiz technology discovers vulnerabilities hiding in public clouds used by many companies as they offload their data storage and computing requirements to clouds. AmazonAnd Microsoft And Google. The rapid shift to cloud computing has fueled the adoption of security software that can identify locations where hackers can launch attacks.

Far from layoffs, the 700-person startup announce In February, a $300 million financing round at a $10 billion valuation. Their client list now includes ChipotleAnd Colgate-PalmoliveAnd Morgan Stanley And snowflake.

“For us, the market is still unlimited,” Wiz co-founder and CEO Assaf Rappaport told CNBC in an interview. “The opportunity is still huge, so we can still grow into triple digits annually, even in an economic downturn and potential recession.”

Wiz’s defiant growth propelled the three-year-old company onto CNBC’s 2023 Disruptor 50 list, where it was ranked fifth, the highest of the five cybersecurity names that came out on this year’s list. The others are Fanta at No. 17, Arctic Wolf at No. 22, Orca Security at No. 24 and Snake at No. 40.

Wiz, which has offices in Israel, New York, and Denver, is playing into a long-term trend in the tech space. Over the past decade, giant companies such as Goldman Sachs And Walmart They are more willing to push critical data and workloads into the cloud. So are large government entities such as the CIA and the Food and Drug Administration.

What started as a playground for startups has become the status quo for IT departments. The transition accelerated during the pandemic as companies had to quickly adapt to remote working.

Older security companies like Palo Alto Networks And Rapid7 They expanded their portfolios to specialize in securing the cloud.

But it’s not just a matter of being in the right place at the right time. Even Wiz’s competitors have to rely on a more profligate customer base. In February, Rapid7 CEO Corey Thomas told analysts on a conference call that corporate executives were finding it difficult to free up money for security projects and deals were taking longer to close.

Elsewhere in security software, the market is more challenging. Cybereason, one of the top players in endpoint protection, has made its Disruptor 50 list for each of the past two years. However, after cutting hundreds of jobs last year and abandoning talks to go public, the company cut its valuation by 90% in April (from a peak of $2.7 billion) in a new financing round, According to Axios. Other security services vendors, including Sophos and Snyk, have also announced layoffs.

General investors are not in a buying mood either. The Global X Cybersecurity ETF is down 16% over the past 12 months, an underperformance than the S&P 500, which has been roughly flat over that stretch.

Rapid7’s Thomas said in an interview that Wiz, as a high-value startup, is experiencing a phase of project-fueled growth most notably excessive spending on sales and marketing. This period, he says, does not generally last more than three to four years.

“You can’t do that indefinitely,” said Thomas. “You must have a stable business model.”

A Wiz spokesperson told CNBC that the company emphasizes “smart growth” over profitability, and said sales and marketing spending is low in relation to revenue. Rappaport said Wiz’s growth has been driven by word of mouth, as users tell other users about the program.

Whichever way Thomas Weisz sees it, in February his company added the startup to its list of competitors, placing it alongside Palo Alto Networks. Thomas said the market is young and evolving.

“Now people are starting to secure the cloud,” he said. “We win some, we lose some.”

Rappaport called Palo Alto Networks, which has a offering called Prisma Cloud, the best place for his company to disrupt business.

“The product we trade in the most is probably the Prisma Cloud,” Rappaport said, adding that it’s not a price battle because Wiz “is usually priced higher than any other product.”

Much of Palo Alto’s expansion into the cloud has come via acquisition, with CEO Nikesh Arora setting aside more than $3 billion in recent years for the purchases to bolster his company’s presence in the space. While he respects the strategy, Rappaport said, the result was a “Frankenstein mix”.

“They’re still figuring out how to make it one platform,” Rappaport said.

Ankur Shah, senior vice president at Palo Alto Networks, defended his company’s technology and said Wiz is not the right choice for clients who want to protect their assets.

“Waze is all about vision,” said Shah. “Visibility is good and safety is better.”

A Wiz spokesperson disputed this idea, and said that the company’s technology “helps organizations detect, prioritize, prevent, and remediate problems.”

While Wiz is gaining momentum against industry powerhouses, it still has a long way to go. KeyBanc’s Q1 survey of technology vendors and channel partners showed that 28% of respondents saw Palo Alto Networks as their best cloud security vendor, while 24% chose Microsoft and 4% chose Wiz.

One big way Wiz has gained name recognition pretty quickly is by spotting potential problems with mass-market software. In March, Wiz exposed a vulnerability in Microsoft’s Azure Active Directory sign-in service that would have enabled attackers to change the results people see in Microsoft’s Bing search engine. Microsoft fixed the issue and said that “no accidental access occurred”.

Wiz has it too is found several vulnerabilities in the Microsoft Azure cloud infrastructure, a product the company knows well because many of its customers use it. Rappaport also knows a lot about Microsoft, having sold his previous security startup, Adlumto the company for $320 million in 2015.

Microsoft’s advantage, Rappaport says, is the experience in quickly assessing threat risks and hiring the right teams to deal with them.

“They have the most scars on their hands,” he said.