14 ms·
I never heard of them until they were purchased for $32 billion.
by detourdog 2y ago
I never heard of them until they were purchased for $32 billion.
- debarshri 2y agoThats the kind of a company everyone wants to build in enterprise security. Incognito unicorns. There are many companies like these in security space. Another company I can think of is Rubrik. All these large security companies under the radar success.
- 1oooqooq 2y agomost people here are also in security and still haven't heard. It's more likely backroom kickbacks (and/or mossad) than invisible unicorn.
- debarshri 2y agokickbacks, may be. I have seen the product. It is not so mossad-y. It fairly straight forward cloud, VM, kubernetes scans. Does it protect stuff? Somewhat. Is it the best product out there - no. Are CISOs happy? CSPM is mostly a checklist item in their bucket to things to do. It depends on what kind of security you are working in. Most of the people in CSPM, CNAPP world have heard their name. It is product built for cloud security/devsecops folks.
- manquer 2y ago> It is not so mossad-y. Would we (i.e. anyone not in the intelligence space) know how intelligence service-y software would look like ? . Aren't all such organizations trained and designed to be inconspicuous and in places we are unlikely to expect.
- alephnerd 2y agoMossad aren't the guys doing cyber ops in Israel. They're suave arsim (how else can you blend in Beirut or Tehran). Also, if you've worked with Israeli government cybersecurity teams, they aren't much different in caliber from the kind you'd find at the NSA, GCHQ, or Netherlands.
- manquer 2y ago> they aren't much different .. NSA, GCHQ, or Netherlands I (and most here) wouldn't really know what that caliber is in these other organizations either to compare What we do hear is of how the Hubble's tech stack is hand me down previous gen(i.e. 70s) spy satellites or exploits like Stuxnet, Pegasus or the recent pager supply chain attacks. On pure technical level those are all pretty impressive things well beyond what I or even anyone I may personally know do. There of course is definitely certain amount of propaganda that would project much higher capability than reality, being mindful of that misdirection and the visible evidence, we civilians can only reasonably conclude that we will never have a clue what these organizations can or cannot actually do.
- someperson 2y ago> They're suave arsim (how else can you blend in Beirut or Tehran). To save others looking up what 'suave arsim' meant: 1. suave -- a normal English the word for charming/confident 2. "arsim" [1] -- apparently a former ethnic slur for Mizrahi Jews [2] now repurposed to mean crude, loud and brash (which sound to me like the equivalent of the British slang term 'chav'). [1] https://en.wikipedia.org/wiki/Ars_(slang) https://en.wikipedia.org/wiki/Ars_(slang) [2] https://en.wikipedia.org/wiki/Mizrahi_Jews https://en.wikipedia.org/wiki/Mizrahi_Jews
- alephnerd 2y agoIt was a bad attempt at humor, but pretty much my point is there are a couple other cybersecurity/sigint specific units unrelated to Mossad. And "arsim" isn't as loaded a term anymore - everyone is mixed in Israel now because it's a melting pot. And saying "Mossad"-this/"Mossad"-that just feels like it's increasingly being used as a dogwhistle.
- posterguy 2y agoI mean, it is used as a substitution for 'Israel', but I don't see how that's a dogwhistle. Or do you mean antisemitic?
- 2y ago
- debarshri 2y agoWe would actually. Lot of the intelligence orgs. use COTS these days.
- jamesfinlayson 2y agoGhidra from the NSA at a glance looks and feels like normal software. AquaSec is built by an Isreali company and looks and feels much like any other SaaS product.
- valianteffort 2y ago100% the case
- heraldgeezer 2y ago[flagged]
- coliveira 2y agoBingo, a huge kickback to some "invisible" hands. They're probably already creating the new "unicorn" to sell to another FAANG company.
- kristopolous 2y agoIf a security firm could blackmail Google, what would that look like?
- genewitch 2y agoWhat could possibly be worth 36 billion? That we don't already know?
- kristopolous 2y agoThis is google. They've got everything. I use google password manager, wallet, biometrics to log into my google smartphone and google authenticator for my 2FA. I use google voice and maps, photos, youtube, search, docs, gmail and gemini for AI. Imagine if you found an authentication backdoor - a way to impersonate any account and you could start sucking down data. You do it for 5 billion people and charged google $6.40 per person not to put it on Tor. $32 billion would be a steal.
- saagarjha 2y agoDo you think you could get away with doing that?
- no-reply 2y agoIf you have alumni at senior positions internally, it shouldn't be that hard to strike a deal. Old but relevant - https://scheerpost.com/2022/11/01/revealed-the-former-israeli-spies-working-in-top-jobs-at-google-facebook-and-microsoft/ https://scheerpost.com/2022/11/01/revealed-the-former-israel...
- saagarjha 2y agoFor $32 billion?
- selcuka 2y agoIt's cheaper to, well, you know.
- alephnerd 2y ago> most people here are also in security No they aren't. I've been a cybersecurity SWE, PM, and VC for a decade at this point and I've almost never found any relevant security or enterprise SaaS related content on HN. For a hot second (around 2018-2019) there was solid conversations around eBPF, io_uring, or cloud posture management, but that doesn't happen on here anymore. Same with MLOps and ML Infra as well - almost no one on here understands Infiniband, RDMA, or BLAS The tech industry is MASSIVE - and most people are only clued into their own little niche. And according to HN, the only tech companies that exist are FAANG, Nvidia, Tesla, TSMC, and BYD.
- powvans 2y agoI vaguely remember this hot second you refer to. What is the HN equivalent where those conversations are happening today?
- alephnerd 2y agoLobste.rs for technical stuff. But most security related conversations by security SMEs aren't happening online anymore. We have specific user conferences and regional user groups now.
- genewitch 2y agoCool, any in central Louisiana? Poland? That'll teach the AI!
- alephnerd 2y agoThe cybersecurity industry is almost entirely located in the Bay, Seattle, Tel Aviv, and Blr/Hyd, so the really active user groups are mostly in those cities. Cybersecurity goes hand-in-hand with IT, DBA, Networking, DevOps, and OS/Systems Programming - all functions that were previously looked down upon over the last 15-20 years. Furthermore, most American CS programs made OS internals, Computer Architecture, or Distributed Systems optional, so the junior portion of the ecosystem doesn't exist in the US anymore.
- heraldgeezer 2y ago[flagged]
- alephnerd 2y agoIt's for any country or heritage that isn't American or Northern European. A lot of really racist or xenophobic takes on HN.
- heraldgeezer 2y agoDon't try and "both sides" this.
- alephnerd 2y agoI'm not trying to "both sides" jack. And it's not like you could tell the difference between Zohar Argov or Amitabh Bachchan.
- heraldgeezer 2y agoOkay you edited. I feel like the majority of anti-jew sentiment is from pro-palestine arab people and adjacent. At least In my country. They really believe "jews run the world" once you debate them enough they admit it and there is no changing of their minds.
- alephnerd 2y ago> Okay you edited. Yep. Realized the confusion! > I feel like the majority of anti-jew sentiment is from pro-palestine arab people and adjacent Most people haven't met an Israeli or traveled to Israel. Also, most users on HN are Americans or Northern European who overwhelmingly use Reddit, so everyone has some weird fringe mentality about one side or the other. Honestly, most Israelis and Arabs act the same - I mean most Israelis are Mizrahi and normal/collquial Hebrew is heavily Arabic based (where else will you here people say "Yalla" in every other sentence)
- 2y ago
- jdgoesmarching 2y agoSecurity is a big field. I’m in the CSPM space and Wiz is a major player here, I actually had a bit of an existential crisis about what we were building when I first saw a demo of their platform. Most of their competitors, like Palo Alto, have a very convoluted offering from gluing together several acquisitions. Wiz is very cohesive with a much nicer API and great UX, which is very underrated in the security space imo. I have zero trust in Google’s promise to keep supporting the tool for multiple clouds or maintain the high quality of product design that makes Wiz great. It’s great for my job security, but I’d call it a net loss for the industry.
- debarshri 2y agoCSPM is very crowded space. There are quite some new and emerging providers. Wiz out of the scene opens up new opportunities.
- rockskon 2y agoOpportunity for opportunity sake isn't a virtue if it gets rid of one of the few providers that was any good.
- deleted 2y ago[deleted]
- Sohcahtoa82 2y ago> Wiz is very cohesive with a much nicer API and great UX I actually don't care for Wiz's UX. If you're a manager and just want to get an idea of what your security posture looks like, it's great. They have a million dashboards for you. But if you're an AppSec Engineer that just wants to see which EC2 instances have which CVEs, it's kind of a pain in the pass and takes way too many clicks.
- vvram 2y agoHow would you like to consume that information?
- ryanSrich 2y agoIf you're in security and you haven't at least heard of Wiz, I have doubts about what you actually do. I'm not saying you have to be a CSPM expert, but not even hearing about Wiz, when they are the largest CSPM, is somewhat concerning.
- aleph_minus_one 2y ago> If you're in security and you haven't at least heard of Wiz, I have doubts about what you actually do. IT security a very wide field. For example, a lot of positions in IT security are actually about compliance (i.e. lots of documentation), and ensuring the rollout of all necessary application patches in the whole company.
- marcus0x62 2y agoCompliance and patch/vulnerability management teams are a major constituency for CSPM tools.
- ramraj07 2y agoI know diabetologists in India who didn't hear about Ozempic till late 2024. Sometimes the simpler explanation is the correct one.
- assanineass 2y ago[dead]
- msm_ 2y agoI am in security for many years now, my main focus is reverse engineering (but I did many diverse things, including cryptography, some exploit development and the opposite, AV work, I did R&D in security automation and some development of security tools and engines). I never even looked at a CSPM, and from my point of view[1] CSPMs are a tool only relevant for a small part of security teams focused on enterprise cloud security. Today is the first time I heard of Wiz. edit Actually my partner works in policy/compliance/legal side of security, and I'm pretty sure she never heard of Wiz too. [1] I wrote this only to stress how different people in the same field can see things differently.
- casey2 2y ago[flagged]
- hluska 2y agoTwo things: 1.) Most people here are likely not in security. 2.) I’m only adjacent to security but have heard of Wiz. If you work in security and haven’t, are you sure you’re good enough to subject us to your opinion?
- msm_ 2y ago>2.) I’m only adjacent to security but have heard of Wiz. If you work in security and haven’t, are you sure you’re good enough to subject us to your opinion? For some reason I picked this hill to die on in this thread. I work in IT security for a long time, and I have never heard of Wiz. My focus is malware reverse engineering and adjacent subfields. I have no interest in anything Cloud. "are you sure you’re good enough to subject us to your opinion" feels a bit dismissive.
- myth_drannon 2y agoYa, Mossad's primary task is enterprise sales for Israeli tech.
- kobayashi 2y agoThat is totally unfounded. Their book of business is huge. You think Google is paying 32B of shareholder dollars because of a foreign intelligence agency? Keep your conspiracism to yourself.
- rabidonrails 2y agoWiz is a private company but the street's assumption is $1B/ARR over the next year or so.
- api 2y agoHN is not the entire industry. Not even close. It’s a small subset.
- startupsfail 2y agoThe article talks about Trump inserting himself into larger deals, there is no reason to think this one is an exception. I’d also bet on this being more of a kickback, rather than an invisible unicorn. Between a visible elephant (Trump/Israel) and an invisible unicorn, betting on an elephant is more reasonable.
- udev4096 2y agoRubrik had pretty bad breaches in the past: https://www.bleepingcomputer.com/news/security/rubrik-rotates-authentication-keys-after-log-server-breach/ https://www.bleepingcomputer.com/news/security/rubrik-rotate... https://www.bleepingcomputer.com/news/security/rubrik-confirms-data-theft-in-goanywhere-zero-day-attack/ https://www.bleepingcomputer.com/news/security/rubrik-confir... This one is straight up embarrassing: https://techcrunch.com/2019/01/29/rubrik-data-leak/ https://techcrunch.com/2019/01/29/rubrik-data-leak/ > The exposed server wasn’t protected with a password, allowing access to anyone who knew where to find the server. So much about "zero trust", at this point it's nothing but a marketing term and has lost it's true meaning
- tzury 2y ago$350M ARR in less than 5 years. Aiming towards $1B by the end of 2025. You never heard of them since perhaps your decisions were not in the cycles of their product. Those who are , heard indeed (type of folks who look at Gartner magic quadrants).
- deleted 2y ago[deleted]
- kyawzazaw 2y agoYou didn't hear about them last time on HN, when it was $23 billion?
- x3n0ph3n3 2y agoMy company just started using them and I was part of the due dilligence evaluation of their product. I had never been so impressed with a cloud security provider before I started using their product. Absolutely phenomenal product offering l.
- ryanSrich 2y agoThis is wild to me. As someone in security, Wiz is definitely one of the whales.
- almosthere 2y agoSame here, I guess it's the circles you run. I just went to their homepage and I have no idea what they do. I already have CI/CD, code, etc.. "securing" it seems like, use aws secret stores? In other words, their webpage is not telling me anything. Companies like these, always feel like instead of having a useful product, they hired useful networks of people to "spread the word" and sell sell sell to your network. Apparently I wasn't in the network. Sorry old and salty.
- hluska 2y agoAs a meaningful tangent, how many layers of obscurity do you use to keep sales people from contacting you? If you do interesting work, you’ll get cold emails unless you take steps to avoid them.
- deleted 2y ago[deleted]
- ryanSrich 2y agoCompanies have problems securing their workloads. Not just storing secrets. Off the top of my head, I've personally been able to centralize the following with a single tool (instead of gluing together a dozen different providers) - scan cloud configurations for policy violations - detect and remediate infrastructure misconfigurations - real-time visibility into cloud resource inventories - early detection of issues - container vuln. scanning - runtime anomalous behavior - alerts and correlate security events - compliance mappings - id risky permissions in IAM policies - track changes and configuration drift over time - implement zero-trust policies across microservices - eforce network seg in containerized environments - run security checks during build and deploy stages - vulnerability assessments on running VMs and containers - policy-as-code for consistent security standards
- alberth 2y ago
- belter 2y agoIt does not make sense. In 2024 Wiz had 10.7% market share. Revenue in the 1,5 to 1,7 Billion but they were not profitable in 2023. Become profitable in 2024 meaning costs are very high. Also looks like Google is desperate for growth in Cloud and they need to do something. They are paying as much money as their whole Google Cloud revenue in 2023. Revenue multiple is like 40x times revenue for Wiz. Exceptionally high, even for a high-growth company. Clearly overpaying. Wiz had nine rounds so massive dilution, and VCs need to recover the money...
- marcus0x62 2y ago10% market share in security is huge. It is an extremely fragmented market, across almost all product segments.
- p1necone 2y ago10% market share in any industry with an even slightly healthy level of competition is huge. The fact that people think it's not for tech feels like an indictment of the overall health of the industry to me.
- marcus0x62 2y agoPerhaps I should have been clearer, but especially compared to the rest of the enterprise tech market, security is unusually fragmented. There is no Microsoft or Cisco of the security market in the way those companies dominate the desktop operating system and core networking markets, respectively. Analysts sometimes refer to the enterprise networking market as "Cisco and the Seven Dwarves". Nobody has ever said that about Symantec (prior to the Broadcom acquisition) or Palo Alto Networks. It is often the case that in a new security product category, the products are so different, it is hard to collect them together in a single category with a straight face. Example: next generation AV circa 2015-2016. AV was a well-worn product category. All of the legacy products did basically the same thing. More or less at the same time, a bunch of new products came to market that all claimed the mantle of "next generation AV:" * Bit9 did process whitelisting, later adding Carbon Black for endpoint forensics * Fire Eye had a proto-EDR solution * Cylance did ML-based malware detection * Palo Alto Networks had an exploit-mitigation focused agent that they bolted ML-based malware detection onto. The industry slowly converged on EDR as the sort-of successor to endpoint AV budgets. A few years later, the cloud security space was the same fragmented mess. Some were what we now know as CSPM, some were glorified DLP solutions, some container security solutions, etc.
- username135 2y agoIn cash!
- zifpanachr23 2y agoI read their website and there must be something secret they've got cooking behind the scenes cause the valuation makes zero sense to me. The whole thing reads like all the dozen or so "cloud security" plays out there. Either I'm missing something big, or their products are outrageously far ahead of all the other similar sounding products out there. I've been known to roll my eyes at a lot of these sorts of product catalogues in the past though and so I'm definitely biased and not the target audience for their marketing. Some CIO out there probably really does think that their security problems will finally be over once they purchase another half dozen dashboards click through and look at.
- Barrin92 2y ago>Either I'm missing something big, I mean, their revenue? They're apparently on track to do a billion this year, growing pretty fast, so 30 billion seems fair enough.
- ExoticPearTree 2y agoYeah, the website is not very helpful. The product though is easy to set up, no friction - like 5 minutes per tenant; and in a few hours you have a really good picture of your security posture with very detailed explanations for every finding. And the graph… very useful to understand why a finding is marked as high ir critical even though at first glance it does not look like it.
- amitport 2y agoIMHO you are missing something big... For Google they are worth 32B, they ARE the Google Security business from now on. They don't even have to be profitable themselves, having this aspect working means google get access to additional enterprise clients and in place they weren't previously present.
- ExoticPearTree 2y agoWe use them and the product is very very nice and very lightweight to set up. Like for a cloud environment it takes about 5 minutes to get it up and running for a tenant. They add features weekly or faster.
- OriginalMrPink 2y agoJust curious, what problem do I need to have that they'll solve for me?
- ExoticPearTree 2y agoNo problem in particular. What we use it for: - vulnerability assessments for containers and VMs (they give a list of vulnerable or outdated packages) - initial access vulnerabilities: what happens if an internet facing component is compromised because you have a vulnerable package and to what kind of data it has access to (it has some regexes and what not to figure out if in your database you have PII data, HIPAA etc.), what lateral movement is possible etc. - provides information on what you can do to fix a finding - IAM checks for overly broad permissions - Service account age and overdue key rotations Take your pick.