Wiz CEO Assaf Rappaport and Alphabet CEO Sundar Pichai.
When the cost of winning is this high, does winning still count as victory?
The Context
Wiz was founded in 2020 by Assaf Rappaport and a team of former Microsoft executives, the same unit that built Adallom, a cloud security company Microsoft acquired for a reported $320 million in 2015. Wiz grew fast. According to press reports, the company reached $350 million in annual recurring revenue (ARR) by February 2024 and $500 million by mid-2024, with analysts forecasting $640 to $800 million for the following year.
Two things drove that growth.
The first was the product itself. Wiz built what it calls "agentless scanning," a technology that maps a customer's entire cloud environment, across AWS, Azure, and Google Cloud, without requiring the customer to install any software. In an industry where security tools often create as much friction as they remove, that mattered.
The second, and more consequential, was Wiz's architectural neutrality. Because the platform sat between all three major cloud providers without favoring any of them, enterprises trusted it in a way they would not trust a tool owned by one of those providers. According to the company, 40% of the Fortune 100 were Wiz customers. That neutrality was not incidental. It was the commercial foundation.
Alphabet first approached Wiz in May 2024. By July, the two sides had reached a tentative agreement at $23 billion, but Wiz walked away. The regulatory climate under the Biden administration's FTC made a deal of that scale with a company of Alphabet's market power too uncertain, and Wiz's leadership chose to pursue an IPO instead.
The window reopened in early 2025. The Trump administration signaled a more permissive approach to large-scale M&A, and with that signal, Wiz re-entered deal discussions. Google returned to the table, but Wiz's position had strengthened. The company had a credible IPO path and a $1 billion funding round behind it. Google also faced a strategic reality: if it failed to close, competitors like Microsoft or Amazon, or private equity firms, could eventually pursue Wiz themselves. Wiz could walk away again, and Google knew it.
Alphabet won, but the price reflected that imbalance. The cost of winning was $9 billion more than the price Wiz had rejected eight months earlier. The $32 billion price implies a 64x multiple on Wiz's trailing ARR of $500 million and between 40x and 50x on analyst estimates of $640 to $800 million in forward revenue.
Strategic Rationale vs. Day-to-Day Reality
On paper, the strategic logic is coherent. Google Cloud Platform (GCP) has trailed AWS and Azure in security perception for years. Google already owns Mandiant, the incident response firm it acquired for $5.4 billion in 2022, but Mandiant is a response capability, not a prevention engine. Wiz fills that gap. With Wiz, Google can position itself as the security dashboard for any enterprise running workloads across multiple cloud providers, the kind of horizontal play that Thomas Kurian, Google Cloud's CEO, needs to close the market share gap.
Google is also acquiring a team of cybersecurity architects who built and scaled a product from zero to $500 million ARR in under five years. That speed of execution is something Google's own organizational structure has struggled to produce, a point contacts in the industry have confirmed independently.
But the strategic logic on paper and the operational reality after close are different things, and the history of large-scale technology acquisitions is full of deals where the logic was sound and the execution destroyed the value.
The most immediate risk is what you might call the Switzerland Paradox. Wiz's commercial strength was its neutrality. AWS and Azure customers trusted Wiz precisely because it was independent. The moment Wiz becomes a Google subsidiary, that neutrality disappears as a matter of corporate structure, regardless of whatever operational firewalls Alphabet puts in place. If enterprise customers begin to view Wiz as a vector for Google Cloud's competitive interests, the revenue base that justified the $32 billion price is at risk. Days after the announcement, Shai Morag, Chief Product Officer at Tenable, a competing cloud security firm, put it bluntly: when a cloud giant acquires a security vendor, neutrality becomes impossible, and product decisions inevitably start favoring one platform over another.
The second risk is organizational. Wiz operates as a flat, fast-moving startup. Alphabet is a layered corporate hierarchy. The pattern of what happens when a high-velocity acquisition target is absorbed into a large acquirer's structure is well-documented. Mandiant, acquired by Google just three years earlier, offers a relevant comparison. Despite initial retention incentives, early signs suggest a gradual loss of the speed and autonomy that defined the company pre-acquisition, a pattern consistent with what typically happens once lock-up periods expire and the original mission gets absorbed into the acquirer's broader agenda.
On the announcement date, Alphabet CEO Sundar Pichai publicly committed to preserving Wiz's independence and multicloud neutrality. Google stated that Wiz would maintain its brand and continue to secure customers across all cloud environments, with its products remaining available on AWS, Azure, and other major clouds. These statements show awareness of the integration risks. However, awareness and successful execution in a large bureaucratic organization are not the same thing.
The Danger of the High Multiple
The risks above are strategic and organizational. The danger that receives less attention, and that may matter more, lies in the financial structure of the deal itself.
In auction theory, the Winner's Curse describes a pattern where competitive pressure pushes a buyer to pay more than an asset's fundamental value. The concept originates in formal auctions, but the dynamic applies whenever a buyer faces pressure that drives the price beyond what the asset's economics can support. That pressure can come from an alternative the seller can credibly pursue (in this case, an IPO), from strategic urgency, or from the fear that a competitor will acquire the target if the buyer fails to close. Google faced all of these. The $9 billion price increase in eight months is the Winner's Curse at work.
The $32 billion price cannot be justified by the asset's current cash flows. When a buyer pays 40 to 50x forward revenue, they eliminate their own margin for error. At that multiple, the acquirer cannot afford to let the target operate independently and grow at its own pace. The financial weight of the price tag creates gravitational pressure to extract value quickly, to cross-sell into the acquirer's customer base, to merge back-end systems, to find synergies that justify the number on the page. Each of those integration moves, however rational in isolation, chips away at the independence, the neutrality, and the culture that made the asset worth $32 billion in the first place.
This is the mechanism by which the standard M&A playbook produces its most counterintuitive outcome. The playbook is designed to maximize the seller's exit price, and in this case it did exactly what it was designed to do. And now the price, by being so high, forces an integration strategy that risks destroying the value the price was supposed to reflect. Google won the company. The integration may cost them the organization.
Further Reflections for Business Leaders
This deal sits at the intersection of several live tensions in the 2025-2026 M&A landscape, and the lessons extend well beyond cloud security.
For buyers, winning is not the same as winning the outcome. If the M&A process does not measure culture to be able to identify what you might call the "Muscle" of the organization with the same rigor it applies to costs, you might confuse it with what you might call the "Fat," and the post-close integration will cut the wrong things. The 40 to 50x multiple Alphabet paid is a price that only makes sense if Wiz remains Wiz. If the integration turns Wiz into a division of Google, the multiple becomes indefensible.
For sellers, an extreme valuation can function as what amounts to a poisoned check. It looks like victory on signing day, but it frequently sets in motion a chain of integration decisions that dismantle the business the founder built. Sellers who prioritize buyers that demonstrate cultural understanding, not just financial capacity, give their legacy a better chance of surviving the close.
For everyone watching this deal unfold, the lesson is about stewardship. The highest price is not always the best outcome. A process designed solely to maximize the exit price also maximizes the risk of post-close destruction. Responsible M&A requires resisting the pressure to optimize for price alone. It demands a process that values what a company is, not just what it earns, because if you buy the asset but kill the organization, you have bought nothing of value.
Time will tell whether Alphabet can defy the pattern. The structural forces of the standard M&A playbook are already working against them.
—
Amine Laouedj Managing Director, Glenshore
I advise responsible business leaders who wish to ensure their company ends up in the right hands and continues to flourish after their exit. If these perspectives resonate with your thoughts, I welcome a conversation. Please connect or message me on LinkedIn.
Glenshore is a boutique investment bank with the Succession M&A Playbook, a disciplined approach to align financial outcomes with long-term mission and legacy preservation.
Disclaimer: The analysis contained in this material reflects publicly available information as of the date of publication, sourced from official filings, academic literature, and verified secondary sources. No proprietary or non-public data has been used. The views expressed are those of Glenshore and are provided solely for informational and educational purposes. They do not constitute investment or financial advice and should not be interpreted as a recommendation to take any particular action. This material may contain forward-looking statements. Past performance is not indicative of future results. Glenshore makes no representations or warranties regarding the accuracy or completeness of this information and disclaims any liability arising from reliance upon it for any purpose. Any third-party names, trademarks, or logos referenced in this material are the property of their respective owners and are used strictly for identification purposes. This material may not be copied, distributed, published, or reproduced in whole or in part without the express written consent of Glenshore.