14JUN

Google closes $32bn Wiz deal; 38 M&A

3 min read

11:51UTC

Google-Wiz is the largest pure-cybersecurity deal of the post-CrowdStrike era. SecurityWeek counted 38 cyber M&A deals in March and 42 in February.

← Back to VPN zero-day, no-patch KEV, late Exchange Jump to analysis ↓

TechnologyAssessed

Key takeaway

The 80-deal-a-quarter M&A pace tracks where buyers expect the next defensive stack to sit.

Google completed its $32 billion acquisition of cloud security vendor Wiz in March 2026, closing the largest pure-cybersecurity deal of the post-CrowdStrike-Humio era ¹. Wiz is a cloud-infrastructure risk platform founded in 2020; its product scans customer estates on Amazon Web Services, Microsoft Azure and Google Cloud for misconfiguration, exposed credentials and lateral-movement paths. Inside Google Cloud, the platform becomes the native security layer fronting every workload the hyperscaler hosts.

SecurityWeek's deal tracker counted 38 cybersecurity mergers and acquisitions announced in March 2026, on top of 42 in February. Databricks, the US data and AI platform, acquired Antimatter and SiftD.ai to launch its Lakewatch Security Information and Event Management (SIEM) product. OpenAI acquired Promptfoo to fold prompt-injection defence into its Frontier platform. Prompt injection is the attack class where malicious instructions embedded in user input hijack a large-language-model application; Promptfoo's tooling is aimed at catching it in production.

The pace matters because consolidation sequences tell you what buyers think the next defensive stack looks like. Cloud security, SIEM re-platforming on AI-native data stores, and large-language-model application security are the three categories absorbing capital. Cloud security is where the Handala-style MDM and Entra ID attack surface lives; SIEM re-platforming is an answer to the 393-day BRICKSTORM dwell problem at detection speed; LLM application security is a new surface that did not exist at the scale it does now three years ago. The money is going where the offensive tradecraft in this briefing is also heading.

Deep Analysis

In plain English

Google completed its $32 billion purchase of Wiz, a cloud security company, in March 2026. This is the largest acquisition of a purely cybersecurity company in history. Wiz makes software that helps businesses find security vulnerabilities in the cloud systems they use, like AWS or Azure or Google Cloud itself. Separately, there were 38 cybersecurity company acquisitions in March alone, continuing a trend of rapid consolidation in the security industry. Databricks bought two companies to build a security monitoring product, and OpenAI bought a company that specialises in defending against attacks on AI systems. This wave of acquisitions reflects the belief that cybersecurity spending is accelerating as threats increase, and that large technology companies want to own more of the security market rather than leave it to specialised vendors.

Deep Analysis

Root Causes

The M&A acceleration in cybersecurity reflects two converging structural pressures. Enterprise buyers are consolidating security vendors to reduce the integration overhead of operating 30-50 point products across their stack; they are purchasing platforms from vendors they already trust with their cloud infrastructure, which channels deal flow toward the hyperscalers.

For Google, the Wiz acquisition addresses a specific competitive gap: Google Cloud holds roughly 11% of the cloud infrastructure market against AWS at 33% and Azure at 22%, and lacks a native cloud security posture management offering comparable to Microsoft Defender for Cloud. The $32bn price is partly for Wiz's technology and partly for Wiz's multi-cloud customer relationships, which give Google a security wedge into AWS and Azure environments.

What could happen next?

Consequence
Google Cloud's bundling of Wiz's cloud-native application protection platform into Google Cloud Security will put competitive pressure on multi-cloud CNAPP vendors and accelerate enterprise consolidation of cloud security tooling with their primary cloud provider.
Risk
The concentration of cloud security monitoring within the same vendors that operate cloud infrastructure creates a conflict-of-interest dynamic that independent security advisers and regulators are beginning to scrutinise as a systemic risk.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2011-2014 wave of endpoint security consolidation, when Intel acquired McAfee, Symantec acquired Websense, and IBM acquired Trusteer.

That wave produced integrated security stacks that were later criticised for creating defensive monocultures: when CrowdStrike's flawed update caused 8.5 million Windows outages in July 2024, the concentration of EDR vendors was cited as an amplifying factor. The current cloud security consolidation wave risks creating a parallel concentration at the cloud control plane layer.

Counter-parallel: The 2022 Broadcom acquisition of VMware, which also concentrated critical infrastructure software into a large platform vendor, produced immediate pricing increases and customer migration pressure rather than improved security outcomes. The Google-Wiz and similar deals are happening at a moment when enterprise buyers have less leverage over platform vendors than in the pre-hyperscaler era.

At $32 billion, Google's Wiz acquisition is the largest pure-cybersecurity acquisition ever, exceeding Broadcom's $10.7bn Symantec purchase (2019) and IBM's $34bn Red Hat acquisition (which included significant non-security elements). It values Wiz at approximately 40x annual recurring revenue, reflecting the growth premium attached to cloud-native security platforms.

The 38 M&A deals in March 2026 (42 in February) represent an annualised rate of roughly 480 cybersecurity transactions, the highest on record. The SIEM consolidation story (Databricks acquiring Antimatter and SiftD.ai for Lakewatch) and the prompt-injection defence acquisition (OpenAI-Promptfoo) both reflect the AI-security market taking shape: AI vendors are acquiring both offensive-detection and defensive tooling to address risks in their own platforms.

For enterprise buyers, the consolidation creates budget pressure in both directions: bundled platform deals may reduce per-tool costs but increase dependency lock-in; specialised independent vendors face acquisition or margin compression as hyperscalers bundle their equivalent functionality.

Consensus view: Gartner's cloud security research team assesses the Google-Wiz acquisition as the most consequential cloud security market consolidation since Microsoft acquired RiskIQ in 2021: it gives Google Cloud a native cloud-native application protection platform that competes directly with Microsoft Defender for Cloud and AWS Security Hub, shifting the cloud security tools market from independent best-of-breed to cloud-vendor-bundled competition.

Counter-view: Cato Networks CEO Shlomo Kramer (also a Wiz co-founder investor) argued publicly that cloud security consolidation into the big three hyperscalers creates a structural conflict of interest, because the same vendor that hosts your workloads now also sells your security monitoring, and the provider has a commercial incentive to minimise breach disclosure that affects its own cloud platform reputation.

Key tension: Whether the cloud security consolidation wave (Google-Wiz, CrowdStrike-SGNL, Databricks-Lakewatch) improves enterprise security outcomes by reducing integration complexity, or whether it reduces the independent oversight function that specialised security vendors provided and concentrates risk into a smaller number of critical dependencies.

First Reported In

Update #1 · Stryker MDM wipe exposes identity perimeter

Google Cloud / Mandiant· 17 Apr 2026

Read original →

Causes and effects

Caused by

KB5091157, Gentlemen C2 intel, ENISA CNAs: in brief

Portkey's $130m acquisition by Palo Alto Networks and April's 33 M&A deals continue the consolidation trend documented in March's 38 deals.

Occurred 19 Apr 2026

Read story →

UNC6780 takes Cisco AI Defense source code

UNC6780's theft of Cisco AI Defense source code validates the AI-security market risk that the Google-Wiz $32bn close was pricing, shifting diligence from hypothetical to named incident.

Occurred 11 May 2026

Read story →

This Event

Google closes $32bn Wiz deal; 38 M&A

The commercial signal on cloud and identity security is running ahead of the defensive one at an 80-deal-a-quarter pace.

Led to

Beazley shareholders clear Zurich's £8.1bn bid

Beazley/Zurich is the largest single cyber-insurance M&A of 2026, contextually following the Google/Wiz $32bn close that led the cyber-sector consolidation wave in ID:2557.

Occurred 22 Apr 2026

Read story →

Different Perspectives

Beijing-aligned attribution sceptics

CNCERT has noted that Western KEV ransomware-risk flags on DoS-only flaws such as Serv-U CVE-2026-28318 conflate disruption capability with breach capability, and that CJEU referrals for NIS2 non-transposition create compliance obligations that presuppose software-patchable architectures the Arista case shows are not universal.

Enterprise security buyers

Three successive KEV cycles in which federal deadlines precede, exceed or are refused by vendor patches require buyers to re-weight patch-SLA contractual terms: the KEV deadline is now the planning constraint, not the vendor advisory, and procurement due diligence must cover whether a hardware platform is even patchable in principle.

Check Point

Check Point disclosed CVE-2026-50751 and shipped a hotfix on 8 June, roughly 30 days after exploitation had begun, with a Qilin affiliate already inside at least one victim. Its delayed disclosure on a CVSS 9.3 perimeter bypass leaves customers to absorb a month-long pre-patch exposure window under CISA's three-day federal deadline.

European Commission and ENISA

NIS2 full personal-liability enforcement from 1 June and CJEU referrals against laggard member states represent the sharpest regulatory escalation in EU cyber history, backed by ENISA NIS360 sector-maturity evidence naming water, rail and waste water as the priority enforcement targets. NCAF 2.0 and NIS360 function as audit instruments rather than political signals.

UK NCSC

The NCSC issued the Dutch NCSC's imminent-abuse warning on the Check Point flaw in the same fortnight its sponsoring legislation cleared the Commons, widening incident-reporting duties to cover attacker pre-positioning. The payment-reporting gap left by the CS&R Bill means the NCSC continues to rely on voluntary Early Warning submissions for ransomware economics data.

US Federal CISO community

Federal CISOs face three active compliance obligations without a clean resolution: a three-day Check Point deadline met with a hotfix, a 23 June Arista deadline partially met with ACLs only, and a 16-day Exchange overrun still being fully remediated. BOD 22-01 is operating as an urgency signal but not as a vendor-cooperation mechanism.