news

한어Русский языкEnglishFrançaisIndonesianSanskrit日本語DeutschPortuguêsΕλληνικάespañolItalianoSuomalainenLatina

Author: Barry

Edited by Guan Ju

Image source: Wiz official website

Earlier this month, it was revealed that Google's parent company Alphabet planned to bid $23 billion to acquire cybersecurity unicorn Wiz, a deal that would have been Alphabet's largest acquisition ever.

Now, according to foreign media reports, Wiz co-founder and CEO Assaf Rappaport announced in an internal email that he has rejected Google's acquisition offer and the company will insist on an independent IPO.

"While we are flattered by the offers we received, we have chosen to continue on our own path and develop Wiz in our own way," Assaf Rappaport wrote.

He further expressed ambitious goals for the company to reach $1 billion in annual recurring revenue and eventually achieve an initial public offering.

It should be noted that Wiz completed a $1 billion E round of financing in May this year with a valuation of $12 billion, and Alphabet's acquisition offer is about double the premium. It is not easy to refuse such an attractive acquisition price.

So, what is the origin of this Israeli cybersecurity unicorn, which was founded only four years ago, and what is its confidence?

Four retired comrades' first startups were acquired by Microsoft

In Israel, there is a mysterious intelligence organization - "Unit 8200".

This agency is equivalent to the US NSA (National Security Agency) and is considered by intelligence experts to be the world's most formidable cyber espionage force.

Ten years ago, the NSA used the world's first "Stuxnet" virus that directly destroyed the real-world industrial infrastructure to destroy the centrifuges at Iran's nuclear plant. Little did people know that the reason why the NSA was able to successfully complete the mission was inseparable from the full participation of the 8200 troops.

After the members of Unit 8200 retire, many of these cybersecurity technology experts will start their own businesses, and they have also become the targets of acquisition by major technology giants.

According to rough statistics, there are about 50 listed cybersecurity companies in Israel, which has firmly established itself as the world's second largest exporter of cybersecurity technology after the United States. According to Forbes, more than 1,000 companies were founded by graduates of the 8200 Unit, and they have made great achievements in cloud computing, big data, cybersecurity and other fields.

The book "Startup Nation" once described it this way:

In Israel, to some extent, a person's academic experience is not as important as his military experience. During the job search process, one of the questions asked in every interview is: In which branch of the military did you serve?

The four founders of Wiz. Image source: Tenable

Assaf Rappaport was once the captain of this "Unit 8200".

He also holds an MSc in Computer Science from the Technion - Israel Institute of Technology and a BS in Computer Science, Physics, and Mathematics from the Hebrew University.

Assaf Rappaport, Yinon Costica, Roy Reznik and Ami Luttwak met during their compulsory military service in Israel, and the four were enlisted in the "Unit 8200" because of their outstanding performance.

Assaf Rappaport, who had outstanding attainments in mathematics and physics, was initially selected for the Israeli Ministry of Defense's Talpiot program (selecting 2% of top talents to specialize in basic scientific research). He then joined Unit 81, a more mysterious military intelligence department. After retiring, he worked at McKinsey Consulting for two years.

In 2012, Assaf Rappaport co-founded cloud security startup Adallom with Roy Reznik and Ami Luttwak, initially focusing on protecting Microsoft SharePoint files. In 2014, Yinon Costica also joined.

Only three years after its founding, the company was spotted by Microsoft, which acquired it for $320 million, and its products were integrated into Microsoft’s security tools. Each co-founder received $25 million of the $320 million in proceeds.

The four also became members of Microsoft's cloud security team: Assaf Rappaport became the general manager of Microsoft Israel, Yinon Costica became the chief program manager of cloud security, Roy Reznik became the chief research and development group manager, and Ami Luttwak became the chief technology officer of Microsoft's cloud security team.

It was also from this year that Assaf Rappaport led the Microsoft Azure cloud security team and Microsoft Israel R&D department to achieve $1.5 billion in operating revenue and serve more than 40,000 companies and developers.

However, Assaf Rappaport gradually discovered that although the existing cloud security and scanning tools are very advanced, they are isolated and complex to operate, which makes it impossible for the company's security team to handle problems in a timely and efficient manner.

Therefore, a completely new approach is urgently needed to protect data security in the cloud.

McKinsey reports that global organizations spend $200 billion on cybersecurity, and as data breaches continue to increase, McKinsey estimates that losses will reach $20 trillion by 2025.

Seeing the huge market demand, Assaf Rappaport once again founded Wiz with three old partners in January 2020. Assaf Rappaport serves as the company's CEO.

What is the confidence of super unicorns?

As more and more organizations adopt cloud computing, existing security solutions are mostly built for local networks and can no longer meet the growing cloud security needs. Security teams urgently need a unified tool to manage and supervise all cloud servers.

Wiz's success lies in providing enterprises with a one-stop cloud security solution, from cloud workload protection (CWPP) to cloud security posture management (CSPM) to cloud infrastructure rights management (CIEM).

In cloud security posture management (CSPM), the system prioritizes the most critical issues and tells developers where to invest their time.

To use a popular analogy: suppose that in order to prevent bad guys from breaking into your home, it will constantly scan your windows and doors, and tell you where there is damage, doors and windows that are not closed, or where you need to add anti-theft nets or change locks. If there are too many hidden dangers, CSPM will also tell you which vulnerability to patch first.

For enterprises, once they go to the cloud and become customers of AWS, Microsoft Azure, Google GCP and Alibaba Cloud, they will receive hundreds of security alerts every day, and naturally become potential customer groups for CSPM.

Wiz's core product, the Cloud Native Application Protection Platform (CNAPP), can help enterprises protect their cloud infrastructure, providing a 360-degree view of security risks across clouds, containers, and workloads, making it the first full-stack multi-cloud security platform.

According to Assaf Rappaport, the biggest advantage of his product is its speed. It only takes a few minutes to join the customer network and complete the scan of the entire cloud network within a day, without the need for an agent.

In traditional cloud security, it is usually necessary to deploy agent software on each server or virtual machine to monitor and protect the system, which is not only complicated to manage, but also may introduce new vulnerabilities. Wiz directly adopts an agentless approach, which fundamentally solves this problem and provides a security view that any developer can understand.

In addition, Wiz can integrate alarm information into a highly visible chart, perform correlation analysis, and then identify high-risk attack vectors to help security teams perform efficient and reasonable repairs based on risk levels.

Compared with its competitors, Wiz first targeted large enterprises as its customers. With its product advantages, Wiz won its first order worth millions of dollars just six months after writing the first line of code.

After trying out Wiz in the summer of 2020, Costco Chief Information Security Officer Jon Raper decided within a day to deploy it on all of Costco's internal systems and databases. Bridgewater Chief Technology Officer Igor Tsyganskiy signed what was then Wiz's largest contract in the fall of 2021.

"There are a lot of security tools on the market, but if you want an immediate return on investment, there are almost no other tools that can do it." Tsyganskiy said that Wiz helped Bridgewater Fund discover multiple risks exposed to a zero-day vulnerability called Log4j within a week. This threat may have exposed more than $100 billion in assets to hackers.

a16z, a well-known Silicon Valley investment institution, also pointed out that in the field of cloud security, nothing can directly compete with Wiz, and it can meet the needs of customers.

Today, Wiz has served 40% of the Fortune 100 companies, including Oracle, Morgan Stanley, Bridgewater, BMW, Colgate, Blackstone, Salesforce, Slack, Louis Vuitton, etc.

In terms of business model, Wiz adopts the SaaS subscription charging model and is sold in software service stores such as Amazon Cloud. Its price will fluctuate depending on customer needs.

It is reported that in August 2022, Wiz announced that its ARR exceeded US$100 million, making it the fastest startup to reach this milestone in history, breaking the fastest record previously set by human resources unicorn Deel. In 2023, Wiz generated approximately US$350 million in revenue.

ARR is considered a key indicator in the enterprise service field and refers to the annual subscription revenue of SaaS companies. For software companies, the higher the proportion of ARR in total revenue, the higher the stability and future potential of revenue.

For comparison, according to Bessemer Venture Partners, a venture capital firm, the top 25% of the listed SaaS companies in the world take an average of 5.3 years to reach $100 million in ARR, including well-known To B companies such as Slack, Shopify, and Twilio. In China, Bytedance's Feishu took three years to reach this figure.

The number of employees can also reflect the development of a company from the side. Wiz's number of employees has soared from 65 in March 2021 to a total of approximately 900 employees in the United States, Europe, Asia and Israel, and plans to add 400 employees worldwide in 2024.

Ruishou analysis shows that Wiz has raised more than $1.9 billion in financing in the four years since its founding. Investors include Sequoia Capital, Blackstone Group, Index Ventures, Lightspeed Venture Partners, Starbucks Chairman Howard Schultz, and Louis Vuitton head Bernard Arnault, among others. The investment lineup is extremely luxurious.

In the latest round of financing announced in May this year, Wiz received $1 billion in financing, and its valuation rose to $12 billion. According to Pitchbook data, Wiz is the fastest technology company to reach a valuation of $10 billion so far, faster than Uber and Facebook.

Companies that have been established for less than 10 years but have a market value of more than $10 billion are also called decacorns and are rarer than unicorns.

Arsham Memarzadeh, partner of Lightspeed Venture Partners, once said that the reason for investing in Wiz is simple. "As global cloud usage is expected to reach $1 trillion, it provides a growing opportunity for cloud security companies, with a potential market share of 5%."

According to MRA's forecast, the cloud security market size will grow at a compound annual growth rate of 24.4%, from US$13.9 billion in 2022 to US$123.3 billion in 2032. Specifically for the CSPM track, Markets and Markets predicts that its market size will grow from US$4.2 billion in 2022 to US$8.6 billion in 2027, with a compound annual growth rate of 15.3%.

Faced with such a fast-growing market, Wiz itself is also constantly making acquisitions.

Just this March, Wiz acquired New York-based cloud detection and response startup Gem Security for $350 million. This is Wiz’s second acquisition, having previously acquired Tel Aviv-based cloud platform Raftt for $50 million.

Over the past period of time, financing in the cybersecurity field has rebounded significantly.

Data from Crunchbase shows that in the first quarter of 2024, cybersecurity startups completed 154 financing transactions and raised nearly US$2.7 billion, the best quarterly performance since 2023.

Google wants to acquire more cloud services to compete with Microsoft

Today, cloud security has become one of the key capabilities for major cloud computing giants to compete for market share.

Google's largest recent acquisition, and second-largest ever, was the purchase of another security company, Mandiant, for nearly $5.4 billion two years ago, which discovered the SolarWinds hack in 2020.

At the time, approximately 18,000 customers downloaded malware-infected software, but Mandiant detected the attack in a timely manner, so fewer than 100 customers were ultimately harmed.

After the acquisition, Mandiant was also incorporated into Google's cloud computing team to provide enterprise customers with an "end-to-end security operations suite", which further strengthened its cloud security capabilities.

At a conference in Las Vegas this year, Google demonstrated how its Gemini AI model can help customers analyze threats and address potential security vulnerabilities.

Currently, Google Cloud's security services include BeyondCorp Enterprise for zero-trust solutions and VirusTotal for detecting malicious content and software vulnerabilities, as well as Chronicle's global security analysis and automation and security command center services.

Almost without exception, the security companies acquired by Google have been incorporated into the Google Cloud portfolio.

This includes Siemplify, an Israeli cloud security startup acquired by Google in January 2022. Google also invested in Cybereason, an extended detection and response (XDR) software company, in October 2021.

At the time, Google and rival Microsoft both publicly pledged to spend more than $10 billion on network solutions over the next five years.

Microsoft has also been active in acquisitions in the security field, acquiring two security companies in 2021, including cloud security expert CloudKnox and ReFirm labs, which focuses on IoT security.

In fact, an important reason why Google is stepping up its cloud security acquisitions is that its share in the cloud computing market is not satisfactory.

According to the latest financial report data, Google Cloud's revenue exceeded US$10 billion for the first time in the second quarter of 2024, a year-on-year increase of more than 28%, and operating profit exceeded US$1 billion.

Although Google Cloud has achieved impressive revenue and has been profitable since last year, its market share still lags behind Amazon and Microsoft.

According to international research firm Synergy, in the first quarter of 2024, Google Cloud only accounted for 11% of the global cloud market, far behind Microsoft Azure's 25% and Amazon AWS's 31%.

This time, industry insiders pointed out that the reason why Wiz rejected Google's acquisition was also due to concerns about antitrust lawsuits and the pessimism of some investors.

It is unusual for a giant like Google to acquire a super unicorn like Wiz, and such acquisitions are often subject to strict scrutiny by antitrust regulators. In addition, the acquirer may also have to deal with a lawsuit between Wiz and its competitor Orca Security.

Currently, European and American regulators are taking a tough stance on acquisitions and mergers of large companies. Last September, the U.S. Department of Justice launched an antitrust lawsuit against Google in the field of Internet search.

The U.S. Department of Justice said that Google pays more than $10 billion each year to mobile phone manufacturers such as Apple and Samsung, telecom operators such as AT&T, and companies such as Firefox to maintain its position as the default search engine on web browsers and mobile devices, stifling market competition.

A person familiar with the matter also confirmed that Wiz's investors fully support the company's decision to remain independent. They believe that Wiz is big enough to aim for an IPO, which remains the company's ultimate goal.