Google Pays $32 Billion for Wiz, and Cloud Security Becomes the Main Event
The largest acquisition in Google's history is also the biggest cybersecurity deal ever signed.
On 18 March 2025 Google announced that it had signed a definitive agreement to acquire Wiz, Inc. for $32 billion, subject to adjustments, in an all-cash transaction. Wiz is a cloud security company, headquartered in New York, and when the deal closes it will join Google Cloud. The agreement still has to clear customary closing conditions, including regulatory approvals, so nothing changes for anybody's systems in the meantime.
Wiz sells what the industry calls a CNAPP — a cloud native application protection platform. Stripped of the acronym, it is software that connects to a company's cloud accounts and to its code, then looks for the things that later become incidents: a storage bucket left open to the internet, an account with far more permission than it needs, a known vulnerability sitting in a running container. Google's announcement lists customers including Salesforce, Slack, DocuSign, BMW, Mars and Priceline.
The framing Google chose is as telling as the number. The company presented the purchase as a bet on two directions it expects to grow as AI spreads: security for cloud systems, and the ability to run on more than one cloud at a time. Thomas Kurian, chief executive of Google Cloud, said the two companies share a vision to make cybersecurity "more accessible and simpler to use for organizations of any size".
Why the price is the interesting part
Google did not buy a product it intends to keep for itself. According to the announcement, Wiz will stay available on the other major clouds — Amazon Web Services, Microsoft Azure and Oracle Cloud are named — and will keep reaching customers through partner security offerings. A company that sells cloud capacity paid $32 billion for a tool whose usefulness depends on watching its competitors' clouds as carefully as its own.
That is a concession about how software actually gets built. Almost nobody runs on a single provider. Files sit in one place, mail in another, the database somewhere else, the payment processor somewhere else again, and each of those has its own permissions model and its own console that nobody opens. The gap is not between good providers and bad ones. It is between the whole picture and the six partial pictures that are all anyone usually has.
Among the reasons Google gave for the deal were a cheaper way for customers to put security controls in place and keep them running, and quicker recovery when a breach does happen. Read alongside the price, that is a statement about where this work now sits: not a product you add after launch, but part of the platform itself.
What this means if you are building something
Ask who checks the configuration. Every project has a person who writes the code and a person who pays for it. Far fewer have a named person who, three months after launch, opens the hosting account and confirms that the backups still run, that the storage is still private, and that the four people who left the project no longer have access. If you cannot name that person, that is already the finding.
Budget for it before, not after. Security work is cheap while a system is being designed and expensive once something has happened. Moving it into the build budget is not a moral position, it is the same argument as paying for foundations. In our experience the incidents that hurt small and mid-sized companies are almost never sophisticated — a default password, an old administrator account nobody closed, a key committed to a repository.
Count your clouds honestly. Write down every service that holds your data or can send mail in your name, and next to each one write who has administrative access today. Most companies we work with find at least one entry they cannot explain. That exercise costs an afternoon and usually finds more than a tool would.
Our reading: $32 billion is not a number that concerns a company with a website and a few internal systems, and no small business needs an enterprise security platform. What the deal does tell you is that the largest buyers in the industry have stopped treating cloud configuration as something you tidy up later. Deciding to treat it the same way, at your own scale, costs very little — and it is a far better conversation to have during the build than on the day a client asks what happened.
Sources
