On March 11, 2026, Google completed its acquisition of Wiz, a deal it announced in March 2025 at $32 billion in cash, subject to closing adjustments. Regulatory review took just under a year. If your organization runs Wiz today, a decision window just opened: your next renewal cycles will determine whether you renew with confidence, renegotiate hard, or migrate. This brief covers what actually changed, what the regulatory clearances do and do not guarantee, and how the credible alternatives (Palo Alto Networks, CrowdStrike and Microsoft) stack up while you decide.
What changed
On March 18, 2025, Google announced an agreement to acquire Wiz “for $32 billion, subject to closing adjustments, in an all-cash transaction.” That came after Wiz turned down an earlier Google offer of $23 billion in 2024, as The Register reported. The US Department of Justice did not make a public statement on its review; Wiz CEO Assaf Rappaport confirmed the DOJ clearance in November 2025, according to the same report. The European Commission cleared the deal unconditionally on February 10, 2026, and the transaction closed on March 11, 2026. Wiz now sits inside Google Cloud, where Google says it will “maintain its brand,” alongside Mandiant, which Google acquired in September 2022, and Google Security Operations.
Wiz was not a distressed asset. Google’s announcement credited it with “strong adoption, fueling rapid business growth.” Its platform is built on agentless scanning and what Wiz calls the Wiz Security Graph. Google’s closing release says Wiz “is trusted by 50% of the Fortune 100”; Wiz’s own homepage says “more than 65%.” That is why the deal matters: the independent CNAPP category just lost its flagship.
Why it matters
Consolidation shrinks your negotiating power. Not long ago, a CNAPP shortlist could be built almost entirely from independent vendors competing for the logo. Today the strongest independent is owned by a hyperscaler, Palo Alto Networks has merged Prisma Cloud with Cortex CDR to form Cortex Cloud, and the remaining independents (Orca, Sysdig, Upwind and others) are themselves plausible acquisition targets. Most of your alternatives are either a platform play or a possible future acquisition.
The same consolidation logic is playing out across the security stack; Enterprise Techie’s Zscaler and Red Canary agentic SOC analysis covers the parallel dynamic in SOC tooling. The pattern to watch: acquirers buy specialist tools, promise independence, then can gradually tilt the roadmap toward their own platform. Sometimes the integration genuinely helps customers. It is less likely to help their pricing.
The takeaway for a VP: assume your next Wiz renewal is a negotiation with Google Cloud sales, not with a hungry startup. Plan your negotiating position accordingly.
The multicloud question: a promise, not a binding remedy
Here is the detail that matters most for AWS and Azure shops. Google has committed publicly, in its 2025 announcement and again in its closing release, that “Wiz products will continue to work and be available across all major clouds, including Amazon Web Services, Google Cloud Platform, Microsoft Azure, and Oracle Cloud.” Regulators looked at the same question. The European Commission found “several credible competitors that customers could switch to if Google were to bundle Wiz’s multi-cloud security platform with its existing products, or in case Wiz’s platform no longer worked with clouds other than Google’s,” and cleared the deal without conditions. In other words, the EU’s answer to the multicloud risk was that customers can switch, not that Google must keep supporting AWS. A public commitment is not a binding remedy, and no remedy requiring Google to maintain feature parity for AWS-hosted workloads has been made public.
To be fair to Google Cloud, its commercial incentives mostly point the right way. The Commission’s decision notes that in cloud infrastructure Google competes with AWS and Microsoft Azure, “which occupy very strong positions,” so a multicloud Wiz is how Google reaches customers whose workloads sit elsewhere. Neither company’s deal announcements give a revenue split by cloud, but gutting multicloud support would undercut the asset Google just bought. Google made a similar promise with Mandiant, saying at closing that the combined business would support customers “across their cloud and on-premise environments.” The realistic risk is not a shutdown. It is drift: new capabilities landing on Google Cloud first, deeper Security Command Center integration becoming the default posture, and AWS-specific coverage moving at a slower cadence. Watch release notes, not press releases.
One related change is already on the calendar. Google has deprecated the Enterprise tier of Security Command Center, which its service tier documentation describes as “Complete multi-cloud CNAPP security” for Google Cloud, AWS and Azure. Google says the tier “will shut down on May 21, 2027,” and organizations on it will move to Premium, which covers Google Cloud only. If you rely on SCC Enterprise for AWS or Azure coverage today, that coverage needs a new home.
Where the alternatives stand
| Wiz (Google Cloud) | Palo Alto Cortex Cloud | CrowdStrike Falcon Cloud Security | Microsoft Defender for Cloud | |
|---|---|---|---|---|
| Core approach | Agentless graph-based posture, expanding runtime (Wiz Defend) | CNAPP rebuilt on the Cortex SecOps platform | Falcon sensor plus agentless posture | CNAPP covering Azure, AWS, GCP and on-premises; free Foundational CSPM, paid Defender plans |
| Strongest fit | Multicloud estates that prioritized fast visibility | Enterprises standardized on Palo Alto network + SOC stack | Runtime threat detection where the Falcon agent is already deployed | Azure-first organizations already working in the Microsoft security stack |
| Watch out for | Roadmap gravity toward Google Cloud; renewal bargaining power shifts to Google sales | Prisma Cloud to Cortex Cloud transition mechanics; platform-bundle pricing pressure | Compare posture and graph depth against Wiz in a proof of concept; value is tied to the wider Falcon platform | Per-cloud feature tables differ; advanced posture features need paid Defender CSPM, billed on specific resources |
Palo Alto Networks is the most direct beneficiary on paper. Its “platformization strategy” is the stated rationale for Cortex Cloud, which Palo Alto introduced in February 2025 as “the next version of Prisma Cloud,” rearchitected “on the AI-driven Cortex SecOps platform.” That puts CNAPP and SOC tooling on one platform. The caveat: Palo Alto describes Cortex Cloud as Prisma Cloud “merged with Cortex CDR,” so existing Prisma Cloud customers should scope the version transition before renewal, and the platform pitch favors customers who commit broadly. The same platform-versus-point-product tension shows up in Enterprise Techie’s Zscaler vs Palo Alto SASE comparison.
CrowdStrike comes at CNAPP from runtime. CrowdStrike says Falcon Cloud Security “unifies agentless visibility with the CrowdStrike Falcon® sensor”, which makes workload protection an extension of an agent many enterprises already run, and CrowdStrike says it was named a Leader in Frost & Sullivan’s 2026 Frost Radar for CNAPPs. CrowdStrike also describes graph-based context in its posture management; test that depth against Wiz on your own estate, and evaluate it alongside the Falcon modules you already license. Microsoft Defender for Cloud is the pragmatic default for Azure-first organizations. Microsoft calls it a CNAPP and supports Azure, AWS, GCP and on-premises resources. Its Foundational CSPM plan is “Available at no cost”; Defender CSPM, which adds attack path analysis and risk prioritization, is paid and billed on specific resources. Coverage is not identical across clouds: Microsoft’s own feature tables list API security posture management only for Azure, and note that GCP sensitive data discovery “only supports Cloud Storage.” Microsoft is also a hyperscaler, with the same conflict-of-interest profile people worry about with Google.
The Wiz customer renewal checklist
- Contract terms (now): at renewal, push for multi-year price protection, a cap on renewal uplift, and portability clauses: data export formats and reasonable termination assistance.
- Roadmap independence (every quarter): track whether AWS and Azure coverage gets new capabilities in the same quarter as Google Cloud. A pattern of lag is your early-warning signal.
- Account team continuity (near term): if your Wiz account team is absorbed into Google Cloud field sales and your CNAPP renewal starts arriving bundled with GCP commit conversations, treat that as a structural change in the relationship.
- Integration posture (ongoing): confirm the third-party integrations you depend on, such as your SIEM, ticketing and EDR connections, remain first-class, not merely “supported.”
- Benchmark an alternative (before your renewal window): run a scoped proof of concept with at least one of Cortex Cloud, Falcon Cloud Security, or Defender for Cloud, even if you intend to stay. A live alternative strengthens your position at the table.
What to do about it
If you are a satisfied Wiz customer on Google Cloud, or multicloud with a Google tilt, staying is the natural choice, and tighter Security Command Center integration is potential upside. If you are AWS- or Azure-dominant, staying is still defensible, but only with the contract protections above; do not sign a multi-year renewal without them. If you were mid-evaluation when the deal closed, widen the shortlist: Palo Alto Networks for consolidated SOC platforms, CrowdStrike for runtime-first estates with Falcon already deployed, Microsoft for Azure-centric estates that can start on free Foundational CSPM, and the remaining independents if credible neutrality is a hard requirement, priced with the knowledge that they may be acquired too.
The one-line version for your next steering meeting: Wiz under Google is a negotiating event more than a risk event, and negotiating power is something you rebuild deliberately, starting at the next renewal.
Frequently asked questions
Is the Google acquisition of Wiz complete?
Yes. Google completed the acquisition on March 11, 2026, after Wiz’s CEO confirmed US Department of Justice clearance in November 2025 and the European Commission cleared the deal unconditionally on February 10, 2026. Google announced the agreement in March 2025 at $32 billion in cash, subject to closing adjustments.
Will Wiz still support AWS and Azure after the Google acquisition?
Google has committed publicly that Wiz products will continue to work across all major clouds, including AWS, Azure and Oracle Cloud, and the European Commission describes AWS and Azure as holding very strong positions in cloud infrastructure, so the commercial incentive to keep that promise is strong. But the commitment is not a binding regulatory condition. Customers should secure contractual protections and monitor whether non-Google features keep pace.
What are the main alternatives to Wiz in 2026?
The enterprise alternatives covered here are Palo Alto Networks Cortex Cloud (which Palo Alto calls the next version of Prisma Cloud), CrowdStrike Falcon Cloud Security, and Microsoft Defender for Cloud. Independent options such as Orca Security and Sysdig remain viable, particularly where vendor neutrality matters.
Should Wiz customers switch vendors because of the acquisition?
Not automatically. Google has committed to keeping Wiz available across all major clouds, and the near-term risk is drift rather than disruption. The prudent move is to tighten renewal terms, track roadmap parity across clouds every quarter, and keep one benchmarked alternative ready before the next renewal.
Enterprise Techie sends vendor-honest analysis like this once a week: get the brief by email, free.
Buying? Start from RFPhub’s free CNAPP RFP template.