Wiz Series D

Andreessen Horowitz just paid $10 billion—let me spell that out: ten thousand millions of actual dollars—for a four-year-old cloud security company that essentially wraps APIs around AWS/Azure/GCP permission settings, and I'm supposed to pretend this makes sense because "cybersecurity is hot right now."[1] The valuation represents roughly 100x ARR (assuming they're at $100M, which is generous), in a market where established players like CrowdStrike and Palo Alto trade at 15-20x revenue on public markets.[2] This deal closed in February 2024, which means Marc Andreessen—the same guy who spent 2023 tweeting about AI extinction risks and monetary policy—decided the optimal moment to deploy $300M was *checks notes* right as interest rates hit 5.5% and every CFO on Earth started asking "wait, what are we paying for again?" The comparable here is obvious and damning: this is Lacework ($8.3B valuation, 2021) meets Snyk ($8.5B, also 2021), except those deals happened when money was free and now money costs something.

The timing is what kills me here, honestly. February 2024 sits in this uncanny valley between the 2021 mega-rounds (when you could fund a cybersecurity PowerPoint to a unicorn valuation) and the 2024 correction (when reality reasserted itself with the subtlety of a margin call).[3] Lightspeed and a16z are phenomenal firms—I'm not going to pretend otherwise, they've minted more exits than I've had panic attacks about my 401(k)—but their presence here signals less "this is inevitable" and more "we have $500M cybersecurity-tagged funds that deploy by Q1 or we look stupid to our LPs."[4] The competitive landscape is absolutely brutalized: you're fighting Orca Security (similar cloud security posture management, raised at $1.8B in 2022), Wiz's own former employer Microsoft (Defender for Cloud is literally built into Azure), and approximately 47 other startups that all claim to "provide unified visibility across multi-cloud environments." The market isn't blue ocean; it's a fish market at closing time, everyone screaming about their catch while the ice melts.

Let's talk fundamentals, which everyone involved in this deal apparently decided were optional. Wiz's growth trajectory is admittedly impressive—they hit $100M ARR faster than almost anyone in enterprise software history, founded by the Adallom team (Microsoft acquired that for $320M in 2015, so there's legitimate operator pedigree here).[5] But growth rate doesn't justify valuation multiples when the TAM story requires you to believe that: (a) every enterprise will consolidate their seventeen security tools into platforms, (b) Wiz will be that platform despite having ~4 years of product development versus incumbents with 15+ year headstarts, and (c) hyperscalers won't simply bundle equivalent functionality for free/cheap to keep customers sticky. The product is genuinely good—I've talked to CISOs who swear by it—but "genuinely good enterprise security tool" describes roughly 40% of the companies that raised at stupid valuations in 2021-2022 and are now doing down-rounds or getting acqui-hired. The exit math is genuinely bleak: you need a $30B+ outcome to make the late-stage investors whole, which means either (1) IPO into a market that currently values cybersecurity companies at 10-15x revenue, requiring $2B+ in ARR, or (2) strategic acquisition by Microsoft/Google/AWS, who would rather just build competing features than pay $30B.

The red flags here aren't subtle—they're semaphore signals spelling out "THIS VALUATION ASSUMES 2021 NEVER ENDED." Cloud security is real, the product solves actual problems, and the team is exceptional, but pricing this at $10B in February 2024 required everyone involved to ignore: (1) the public market comparables, (2) the fact that Wiz's primary distribution advantage (fast deployment, cloud-native architecture) becomes table stakes within 18-24 months as competitors rebuild, (3) the increasing likelihood that hyperscalers will view security posture management as strategic infrastructure they can't outsource.[6] I keep coming back to the investors here—a16z and Lightspeed aren't dumb, they're dealing with the structural problem of having raised increasingly large funds that require increasingly large outcomes, which means paying increasingly stupid prices for companies with genuine traction because "where else are we going to deploy $300M in cybersecurity this quarter?" This deal is what happens when exceptional founders meet exceptional VCs in a market structure that rewards momentum over margins, and everyone agrees to pretend the music won't stop.