12OCT

Google closes $32bn Wiz deal; 38 M&A

3 min read

10:55UTC

Google-Wiz is the largest pure-cybersecurity deal of the post-CrowdStrike era. SecurityWeek counted 38 cyber M&A deals in March and 42 in February.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

The 80-deal-a-quarter M&A pace tracks where buyers expect the next defensive stack to sit.

Google completed its $32 billion acquisition of cloud security vendor Wiz in March 2026, closing the largest pure-cybersecurity deal of the post-CrowdStrike-Humio era⁠¹. Wiz is a cloud-infrastructure risk platform founded in 2020; its product scans customer estates on Amazon Web Services, Microsoft Azure and Google Cloud for misconfiguration, exposed credentials and lateral-movement paths. Inside Google Cloud, the platform becomes the native security layer fronting every workload the hyperscaler hosts.

SecurityWeek's deal tracker counted 38 cybersecurity mergers and acquisitions announced in March 2026, on top of 42 in February. Databricks, the US data and AI platform, acquired Antimatter and SiftD.ai to launch its Lakewatch Security Information and Event Management (SIEM) product. OpenAI acquired Promptfoo to fold prompt-injection defence into its Frontier platform. Prompt injection is the attack class where malicious instructions embedded in user input hijack a large-language-model application; Promptfoo's tooling is aimed at catching it in production.

The pace matters because consolidation sequences tell you what buyers think the next defensive stack looks like. Cloud security, SIEM re-platforming on AI-native data stores, and large-language-model application security are the three categories absorbing capital. Cloud security is where the Handala-style MDM and Entra ID attack surface lives; SIEM re-platforming is an answer to the 393-day BRICKSTORM dwell problem at detection speed; LLM application security is a new surface that did not exist at the scale it does now three years ago. The money is going where the offensive tradecraft in this briefing is also heading.

Deep Analysis

In plain English

Google completed its $32 billion purchase of Wiz, a cloud security company, in March 2026. This is the largest acquisition of a purely cybersecurity company in history. Wiz makes software that helps businesses find security vulnerabilities in the cloud systems they use, like AWS or Azure or Google Cloud itself. Separately, there were 38 cybersecurity company acquisitions in March alone, continuing a trend of rapid consolidation in the security industry. Databricks bought two companies to build a security monitoring product, and OpenAI bought a company that specialises in defending against attacks on AI systems. This wave of acquisitions reflects the belief that cybersecurity spending is accelerating as threats increase, and that large technology companies want to own more of the security market rather than leave it to specialised vendors.

Deep Analysis

Root Causes

The M&A acceleration in cybersecurity reflects two converging structural pressures. Enterprise buyers are consolidating security vendors to reduce the integration overhead of operating 30-50 point products across their stack; they are purchasing platforms from vendors they already trust with their cloud infrastructure, which channels deal flow toward the hyperscalers.

For Google, the Wiz acquisition addresses a specific competitive gap: Google Cloud holds roughly 11% of the cloud infrastructure market against AWS at 33% and Azure at 22%, and lacks a native cloud security posture management offering comparable to Microsoft Defender for Cloud. The $32bn price is partly for Wiz's technology and partly for Wiz's multi-cloud customer relationships, which give Google a security wedge into AWS and Azure environments.

What could happen next?

Consequence
Google Cloud's bundling of Wiz's cloud-native application protection platform into Google Cloud Security will put competitive pressure on multi-cloud CNAPP vendors and accelerate enterprise consolidation of cloud security tooling with their primary cloud provider.
Risk
The concentration of cloud security monitoring within the same vendors that operate cloud infrastructure creates a conflict-of-interest dynamic that independent security advisers and regulators are beginning to scrutinise as a systemic risk.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2011-2014 wave of endpoint security consolidation, when Intel acquired McAfee, Symantec acquired Websense, and IBM acquired Trusteer.

That wave produced integrated security stacks that were later criticised for creating defensive monocultures: when CrowdStrike's flawed update caused 8.5 million Windows outages in July 2024, the concentration of EDR vendors was cited as an amplifying factor. The current cloud security consolidation wave risks creating a parallel concentration at the cloud control plane layer.

Counter-parallel: The 2022 Broadcom acquisition of VMware, which also concentrated critical infrastructure software into a large platform vendor, produced immediate pricing increases and customer migration pressure rather than improved security outcomes. The Google-Wiz and similar deals are happening at a moment when enterprise buyers have less leverage over platform vendors than in the pre-hyperscaler era.

At $32 billion, Google's Wiz acquisition is the largest pure-cybersecurity acquisition ever, exceeding Broadcom's $10.7bn Symantec purchase (2019) and IBM's $34bn Red Hat acquisition (which included significant non-security elements). It values Wiz at approximately 40x annual recurring revenue, reflecting the growth premium attached to cloud-native security platforms.

The 38 M&A deals in March 2026 (42 in February) represent an annualised rate of roughly 480 cybersecurity transactions, the highest on record. The SIEM consolidation story (Databricks acquiring Antimatter and SiftD.ai for Lakewatch) and the prompt-injection defence acquisition (OpenAI-Promptfoo) both reflect the AI-security market taking shape: AI vendors are acquiring both offensive-detection and defensive tooling to address risks in their own platforms.

For enterprise buyers, the consolidation creates budget pressure in both directions: bundled platform deals may reduce per-tool costs but increase dependency lock-in; specialised independent vendors face acquisition or margin compression as hyperscalers bundle their equivalent functionality.

Consensus view: Gartner's cloud security research team assesses the Google-Wiz acquisition as the most consequential cloud security market consolidation since Microsoft acquired RiskIQ in 2021: it gives Google Cloud a native cloud-native application protection platform that competes directly with Microsoft Defender for Cloud and AWS Security Hub, shifting the cloud security tools market from independent best-of-breed to cloud-vendor-bundled competition.

Counter-view: Cato Networks CEO Shlomo Kramer (also a Wiz co-founder investor) argued publicly that cloud security consolidation into the big three hyperscalers creates a structural conflict of interest, because the same vendor that hosts your workloads now also sells your security monitoring, and the provider has a commercial incentive to minimise breach disclosure that affects its own cloud platform reputation.

Key tension: Whether the cloud security consolidation wave (Google-Wiz, CrowdStrike-SGNL, Databricks-Lakewatch) improves enterprise security outcomes by reducing integration complexity, or whether it reduces the independent oversight function that specialised security vendors provided and concentrates risk into a smaller number of critical dependencies.

First Reported In

Update #1 · Stryker MDM wipe exposes identity perimeter

SecurityWeek· 17 Apr 2026

Read original →

Causes and effects

Caused by

Microsoft patches domain controller reboot loops

Portkey's $130m acquisition by Palo Alto Networks and April's 33 M&A deals continue the consolidation trend documented in March's 38 deals.

Occurred 19 Apr 2026

Read story →

UNC6780 takes Cisco AI Defense source code

UNC6780's theft of Cisco AI Defense source code validates the AI-security market risk that the Google-Wiz $32bn close was pricing, shifting diligence from hypothetical to named incident.

Occurred 11 May 2026

Read story →

This Event

Google closes $32bn Wiz deal; 38 M&A

The commercial signal on cloud and identity security is running ahead of the defensive one at an 80-deal-a-quarter pace.

Led to

Beazley shareholders clear Zurich's £8.1bn bid

Beazley/Zurich is the largest single cyber-insurance M&A of 2026, contextually following the Google/Wiz $32bn close that led the cyber-sector consolidation wave in ID:2557.

Occurred 22 Apr 2026

Read story →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.