5SEP

Google closes $32bn Wiz deal; 38 M&A

3 min read

12:09UTC

Google-Wiz is the largest pure-cybersecurity deal of the post-CrowdStrike era. SecurityWeek counted 38 cyber M&A deals in March and 42 in February.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyAssessed

Key takeaway

The 80-deal-a-quarter M&A pace tracks where buyers expect the next defensive stack to sit.

Google completed its $32 billion acquisition of cloud security vendor Wiz in March 2026, closing the largest pure-cybersecurity deal of the post-CrowdStrike-Humio era ¹. Wiz is a cloud-infrastructure risk platform founded in 2020; its product scans customer estates on Amazon Web Services, Microsoft Azure and Google Cloud for misconfiguration, exposed credentials and lateral-movement paths. Inside Google Cloud, the platform becomes the native security layer fronting every workload the hyperscaler hosts.

SecurityWeek's deal tracker counted 38 cybersecurity mergers and acquisitions announced in March 2026, on top of 42 in February. Databricks, the US data and AI platform, acquired Antimatter and SiftD.ai to launch its Lakewatch Security Information and Event Management (SIEM) product. OpenAI acquired Promptfoo to fold prompt-injection defence into its Frontier platform. Prompt injection is the attack class where malicious instructions embedded in user input hijack a large-language-model application; Promptfoo's tooling is aimed at catching it in production.

The pace matters because consolidation sequences tell you what buyers think the next defensive stack looks like. Cloud security, SIEM re-platforming on AI-native data stores, and large-language-model application security are the three categories absorbing capital. Cloud security is where the Handala-style MDM and Entra ID attack surface lives; SIEM re-platforming is an answer to the 393-day BRICKSTORM dwell problem at detection speed; LLM application security is a new surface that did not exist at the scale it does now three years ago. The money is going where the offensive tradecraft in this briefing is also heading.

Deep Analysis

In plain English

Google completed its $32 billion purchase of Wiz, a cloud security company, in March 2026. This is the largest acquisition of a purely cybersecurity company in history. Wiz makes software that helps businesses find security vulnerabilities in the cloud systems they use, like AWS or Azure or Google Cloud itself. Separately, there were 38 cybersecurity company acquisitions in March alone, continuing a trend of rapid consolidation in the security industry. Databricks bought two companies to build a security monitoring product, and OpenAI bought a company that specialises in defending against attacks on AI systems. This wave of acquisitions reflects the belief that cybersecurity spending is accelerating as threats increase, and that large technology companies want to own more of the security market rather than leave it to specialised vendors.

Deep Analysis

Root Causes

The M&A acceleration in cybersecurity reflects two converging structural pressures. Enterprise buyers are consolidating security vendors to reduce the integration overhead of operating 30-50 point products across their stack; they are purchasing platforms from vendors they already trust with their cloud infrastructure, which channels deal flow toward the hyperscalers.

For Google, the Wiz acquisition addresses a specific competitive gap: Google Cloud holds roughly 11% of the cloud infrastructure market against AWS at 33% and Azure at 22%, and lacks a native cloud security posture management offering comparable to Microsoft Defender for Cloud. The $32bn price is partly for Wiz's technology and partly for Wiz's multi-cloud customer relationships, which give Google a security wedge into AWS and Azure environments.

What could happen next?

Consequence
Google Cloud's bundling of Wiz's cloud-native application protection platform into Google Cloud Security will put competitive pressure on multi-cloud CNAPP vendors and accelerate enterprise consolidation of cloud security tooling with their primary cloud provider.
Risk
The concentration of cloud security monitoring within the same vendors that operate cloud infrastructure creates a conflict-of-interest dynamic that independent security advisers and regulators are beginning to scrutinise as a systemic risk.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2011-2014 wave of endpoint security consolidation, when Intel acquired McAfee, Symantec acquired Websense, and IBM acquired Trusteer.

That wave produced integrated security stacks that were later criticised for creating defensive monocultures: when CrowdStrike's flawed update caused 8.5 million Windows outages in July 2024, the concentration of EDR vendors was cited as an amplifying factor. The current cloud security consolidation wave risks creating a parallel concentration at the cloud control plane layer.

Counter-parallel: The 2022 Broadcom acquisition of VMware, which also concentrated critical infrastructure software into a large platform vendor, produced immediate pricing increases and customer migration pressure rather than improved security outcomes. The Google-Wiz and similar deals are happening at a moment when enterprise buyers have less leverage over platform vendors than in the pre-hyperscaler era.

At $32 billion, Google's Wiz acquisition is the largest pure-cybersecurity acquisition ever, exceeding Broadcom's $10.7bn Symantec purchase (2019) and IBM's $34bn Red Hat acquisition (which included significant non-security elements). It values Wiz at approximately 40x annual recurring revenue, reflecting the growth premium attached to cloud-native security platforms.

The 38 M&A deals in March 2026 (42 in February) represent an annualised rate of roughly 480 cybersecurity transactions, the highest on record. The SIEM consolidation story (Databricks acquiring Antimatter and SiftD.ai for Lakewatch) and the prompt-injection defence acquisition (OpenAI-Promptfoo) both reflect the AI-security market taking shape: AI vendors are acquiring both offensive-detection and defensive tooling to address risks in their own platforms.

For enterprise buyers, the consolidation creates budget pressure in both directions: bundled platform deals may reduce per-tool costs but increase dependency lock-in; specialised independent vendors face acquisition or margin compression as hyperscalers bundle their equivalent functionality.

Consensus view: Gartner's cloud security research team assesses the Google-Wiz acquisition as the most consequential cloud security market consolidation since Microsoft acquired RiskIQ in 2021: it gives Google Cloud a native cloud-native application protection platform that competes directly with Microsoft Defender for Cloud and AWS Security Hub, shifting the cloud security tools market from independent best-of-breed to cloud-vendor-bundled competition.

Counter-view: Cato Networks CEO Shlomo Kramer (also a Wiz co-founder investor) argued publicly that cloud security consolidation into the big three hyperscalers creates a structural conflict of interest, because the same vendor that hosts your workloads now also sells your security monitoring, and the provider has a commercial incentive to minimise breach disclosure that affects its own cloud platform reputation.

Key tension: Whether the cloud security consolidation wave (Google-Wiz, CrowdStrike-SGNL, Databricks-Lakewatch) improves enterprise security outcomes by reducing integration complexity, or whether it reduces the independent oversight function that specialised security vendors provided and concentrates risk into a smaller number of critical dependencies.

First Reported In

Update #1 · Stryker MDM wipe exposes identity perimeter

Google Cloud / Mandiant· 17 Apr 2026

Read original →

Causes and effects

Caused by

KB5091157, Gentlemen C2 intel, ENISA CNAs: in brief

Portkey's $130m acquisition by Palo Alto Networks and April's 33 M&A deals continue the consolidation trend documented in March's 38 deals.

Occurred 19 Apr 2026

Read story →

UNC6780 takes Cisco AI Defense source code

UNC6780's theft of Cisco AI Defense source code validates the AI-security market risk that the Google-Wiz $32bn close was pricing, shifting diligence from hypothetical to named incident.

Occurred 11 May 2026

Read story →

This Event

Google closes $32bn Wiz deal; 38 M&A

The commercial signal on cloud and identity security is running ahead of the defensive one at an 80-deal-a-quarter pace.

Led to

Beazley shareholders clear Zurich's £8.1bn bid

Beazley/Zurich is the largest single cyber-insurance M&A of 2026, contextually following the Google/Wiz $32bn close that led the cyber-sector consolidation wave in ID:2557.

Occurred 22 Apr 2026

Read story →

Different Perspectives

ENISA

ENISA published an SME cyber-resilience maturity model on 6 August and updated the Cyber Resilience Act reporting-platform FAQ on 31 August. The agency supplies common implementation tools for smaller operators, but it cannot fine organisations that do not use them.

UAE Cyber Security Council

On 10 August, the UAE Cyber Security Council said national teams contained attacks on aviation, energy and education before objectives were reached. Its second monthly statement, after a 3 July financial-sector disclosure, makes public reporting of stopped attacks part of its operating posture.

South African authorities

INTERPOL said on 25 August that South African authorities made 39 arrests, seized US$2.67 million and blocked 257 accounts during Operation Jackal IV. Their share of the 23-country operation shows the material enforcement burden in a cross-border fraud case.

Europol

On 2 September, Europol announced the sinkholing of Sality after a 31 August operation involving US, Bulgarian, Hungarian and Romanian authorities. Its more than 11 million linked IP addresses measure infrastructure contact, not confirmed victims, and show why technical partners joined the action.

CISA

From 3 August to 2 September, CISA recorded three-day deadlines for 24 of 37 KEV additions, compared with 34 of 39 from 10 June to 29 July. The falling share changes the urgency signal that US federal agencies and private-sector tooling draw from the catalogue.

Beacon

On 3 September, Beacon said its final report found that an intruder likely exported its customer database during roughly one hour and 27 minutes on 27 July. Charities using the CRM now have a named exposure route, a compromised AWS access key in public build artefacts.