Wiz (company)

For Akihiro Yokoi's WiZ, see Tamagotchi.

Wiz

Company type	Private
Industry	Cybersecurity
Founded	January 2020;4 years ago (January 2020)
Founders	Assaf Rappaport, Yinon Costica, Roy Reznik, Ami Luttwak
Headquarters	New York City , US
Key people	Assaf Rappaport (CEO) Dali Rajic (COO) [1]
Number of employees	c. 950 (2024) [1]
Website	wiz.io

Wiz is a cloud security startup headquartered in New York City. ^{[2] [1]} The company was founded in January 2020 by Assaf Rappaport, Yinon Costica, Roy Reznik, and Ami Luttwak, all of whom previously founded Adallom. ^{[3] [4]} Rappaport is CEO, Costica is VP of Product, Reznik is VP of Engineering, and Luttwak is CTO. The company's platform analyzes computing infrastructure hosted in AWS, Azure, GCP, OCI, and Kubernetes for combinations of risk factors that could allow malicious actors to gain control of cloud resources and/or exfiltrate valuable data.

As of February 2024, Wiz employed about 900 people, with most sales and marketing personnel scattered across North America and Europe while most engineering personnel are based in Tel Aviv, Israel. ^{[5] [6] [7]} In August 2022, Wiz claimed to be the fastest startup ever to scale from $1 million to $100 million in annual recurring revenue (ARR), from February 2021 to approximately July 2022. ^[8] In February 2023, following its series D round of funding, Wiz claimed to be the largest cyber unicorn in the world and the fastest Software-as-a-Service company to reach a $10 billion valuation. ^[9] In February 2024, the company claimed to have reached $350M in ARR, with a 40% market share of Fortune 100 companies. ^{[1] [10]}

Funding

Wiz has raised a total of $1.9 billion from a combination of venture capital funds and private investors:

• Series A — In December 2020, Wiz emerged from stealth by raising $100 million from Index Ventures, Sequoia Capital, Insight Partners and Cyberstarts. ^[11]
• Series B — In April and May 2021, Wiz raised $130 million and $120 million (respectively) on a $1.7 valuation from Index Ventures, Sequoia Capital, Insight Partners, and Cyberstarts. ^[12]
• Series C — In October 2021, Wiz raised $250 million on a $6 billion valuation ^{[13] [14]} from venture capital funds Insight Partners, Greenoaks Capital, Sequoia Capital, Salesforce Ventures, and CyberStarts, and individual investors Bernard Arnault and Howard Schultz. ^[15]
• Series D — In February 2023, Wiz raised $300 million on a $10 billion valuation ^[16] from venture capital funds Lightspeed Venture Partners and Greenoaks Capital, along with individual investors including Bernard Arnault and Howard Schultz.
• Series E — In May 2024, Wiz raised $1 billion on a $12 billion valuation ^[17] from Andreessen Horowitz, Lightspeed Venture Partners, Thrive Capital, Greylock Partners, Wellington Management, Cyberstarts, Greenoaks, Index Ventures, Salesforce Ventures, Sequoia Capital and Howard Schultz.

Acquisitions

Wiz has acquired two companies:

• Raftt — A cloud-based developer collaboration platform, purchased in December 2023
• Gem — A real-time Cloud Detection and Response (CDR) solution that shortens the time to investigate and contain cloud-native threats, purchased in April 2024

In April 2024, reports indicated that Wiz intended to purchase Lacework, but in May the deal fell through during the due diligence process. ^[18]

Research

Wiz researchers have discovered and responsibly disclosed numerous cloud vulnerabilities that garnered significant media coverage:

• ChaosDB – A series of flaws in Microsoft Azure's Cosmos DB that made it possible to download, delete, or manipulate databases belonging to thousands of Azure customers. ^{[19] [20]}
• OMIGOD – Bugs in Open Management Infrastructure (OMI), a ubiquitous but poorly documented agent embedded in many popular Azure services, that allowed for unauthenticated remote code execution and privilege escalation. ^[21]
• NotLegit – Insecure default behavior in the Azure App Service that exposed the source code of some customer applications. ^[22]
• ExtraReplica – A chain of critical vulnerabilities found in the Azure Database for PostgreSQL Flexible Server that could let malicious users escalate privileges and gain access to other customers' databases after bypassing authentication. ^{[23] [24]}
• AttachMe – A cloud isolation vulnerability that, before it was patched by OCI, could have allowed attackers to access and modify other users' OCI storage volumes without authorization. ^[25]
• Hell's Keychain – A first-of-its-kind cloud service provider supply-chain vulnerability in IBM Cloud Databases for PostgreSQL that, before it was patched, could have allowed malicious actors to remotely execute code in victims' environments. ^[26]
• BingBang – A misconfiguration in Azure Active Directory (AAD) that allowed Wiz researchers to modify Bing.com search results in a way that malicious actors could use to steal Office 365 credentials granting access to countless users' private emails and documents. ^[27]

These findings (and others) have been presented at several conferences, including BlackHat, ^{[28] [29] [30]} RSAC, ^{[31] [32]} and DEF CON. ^[33]

References

1. Levingston, Ivan; Hammond, George (2024-03-08). "Israeli cyber start-up in talks to raise funds valuing it at over $10bn". Financial Times.
2. Konrad, Alex (2023-08-08). "Nobody Beats Wiz: Meet The Hyper-Aggressive, $10 Billion Startup Shaking Up Cloud Security". Forbes.
3. Novet, Jordan (2021-03-22). "A tiny security start-up founded by engineers who sold their last company to Microsoft is already worth $1.7 billion". CNBC. Retrieved 2021-12-26.
4. Roof, Katie; Benmeleh, Yaacov (2021-10-11). "Cyber Startup Wiz Raises Funds at $6 Billion Valuation". Bloomberg News.
5. "Wiz goes (even more) global". Wiz Blog. 2021-09-14. Retrieved 2021-12-26.
6. Ben-David, Ricky. "Israeli cybersecurity firm Wiz raises $250m, soaring to $6b valuation". www.timesofisrael.com. Retrieved 2021-12-27.
7. "Cybersecurity has 53 unicorns. Here are 10 to watch". VentureBeat. 2022-03-17. Retrieved 2022-05-22.
8. "Cloud security startup Wiz reaches $100M ARR in just 18 months". TechCrunch. 2022-08-10. Retrieved 2022-08-14.
9. "Wiz becomes the world's largest cybersecurity unicorn | Wiz Blog". wiz.io. Retrieved 2023-04-16.
10. "Wiz reports $350m revenue in 2023, hiring 400 in 2024". Globes. 2024-05-02. Retrieved 2024-02-11.
11. "Israeli cloud security co Wiz raises $100m". Globes. 2020-09-12. Retrieved 2021-12-26.
12. "Cloud security co Wiz raises $250m at $6b valuation". Globes. 2021-11-10. Retrieved 2021-12-26.
13. Shulman, Sophie (2021-10-13). "Six reasons for Wiz's $6 billion valuation". CTECH - www.calcalistech.com. Retrieved 2021-12-26.
14. "Wiz unveils new security tool to protect code in development pipeline". TechCrunch. 8 December 2021. Retrieved 2021-12-27.
15. "Wiz raises $250 mln, values Israeli cyber firm at $6 bln". Reuters. 2021-10-11. Retrieved 2021-12-26.
16. Wiggers, Kyle (2023-02-27). "Cloud security startup Wiz, now valued at $10B, raises $300M". TechCrunch. Retrieved 2023-04-16.
17. Rosenbush, Steven (2024-05-07). "Cyber Startup Wiz Raises $1 Billion on Path to IPO". Wall Street Journal. Retrieved 2024-05-16.
18. Orbach, Meir (2024-05-02). "Wiz deal to acquire Lacework collapses". Calcalist. Retrieved 2024-05-16.
19. "ChaosDB Vulnerability Exposes Thousands of Microsoft Azure Databases". PCMAG. Retrieved 2021-12-26.
20. "ChaosDB vulns saw Wiz researchers utterly pwn Azure Cosmos". www.theregister.com. Retrieved 2021-12-26.
21. "OMIGOD: Microsoft Azure VMs exploited to drop Mirai, miners". BleepingComputer. Retrieved 2021-12-26.
22. "Microsoft notifies customers of Azure bug that exposed their source code". The Record by Recorded Future. 2021-12-22. Retrieved 2021-12-26.
23. "Microsoft fixes ExtraReplica Azure bugs that exposed user databases". BleepingComputer. Retrieved 2022-05-20.
24. msrc. "Azure Database for PostgreSQL Flexible Server Privilege Escalation and Remote Code Execution – Microsoft Security Response Center" . Retrieved 2022-05-20.
25. "Oracle Cloud at one point would let you access any other customer's data". The Register. Retrieved 2022-11-02.
26. Montalbano, Elizabeth (2022-12-01). "IBM Cloud Supply Chain Vulnerability Showcases New Threat Class". Dark Reading. Retrieved 2023-04-16.
27. Weatherbed, Jess (2023-03-30). "Microsoft exploit allowed access to private Office 365 data". The Verge. Retrieved 2023-04-16.
28. "Black Hat". www.blackhat.com.
29. "A New Class of DNS Vulnerabilities Affecting Many DNS-as-Service Platforms". Black Hat. Retrieved 2021-12-26.
30. "Breaking the Isolation: Cross-Account AWS Vulnerabilities". Black Hat. Retrieved 2021-12-26.
31. Conference, R. S. A. "RSA Conference Announces Finalists for RSAC Innovation Sandbox Contest 2021". www.prnewswire.com (Press release). Retrieved 2022-05-25.
32. "All Conference Speakers". RSAConference.com. May 25, 2022.
33. "DEF CON 29 Speakers". DEF CON. Retrieved 2021-12-26.