The real story: Speed and Security at DevOps scale

The real story behind Google acquiring Wiz is how badly the need for speed dominates every enterprise’s DevOps cycles building apps, models and platforms without sacrificing security.

By acquiring Wiz, Google gets an AI-infused Cloud Native Application Protection Platform (CNAPP) designed to eliminate DevSecOps bottlenecks, prevent attacks by and on models in development, prevent cloud breaches and scale multi-cloud security in real time. The Wiz CNAPP platform has earned a global reputation by using AI to enhance its threat detection, predictive analytics, automated remediation, and reduction of false positives.  

Wiz will integrate Google’s risk detection, threat intelligence and automated remediation, which all are table stakes for protecting every stage of cloud-based app and model development. That’s a solid contribution to Wiz’s graph-based security engine designed to find and contain attack paths instantly, prioritize actual risks and help security teams identify and fix vulnerabilities before they’re exploited.

Google paying $32 billion in cash signals just how urgent the need for speed is across DevOps cycles that have been asking for an AI-driven CNAPP platform that can flex and scale to keep up with more complex DevOps cycles.

“While Google Cloud Platform (GCP) has been investing in built-in CNAPP capabilities for their own platform’s native security with success, these tools have predominantly focused only on protecting GCP endpoints/assets,” says Andras Cser, VP and Principal Analyst at Forrester.

Cser added, “after Microsoft’s 2021 early acquisition of CloudKnox and development of Defender for Cloud, Google is feeling the pressure to offer a true, multicloud-capable CNAPP tool given that so many organizations are multi-cloud today. Forrester expects that, post-acquisition, most current CNAPP capabilities in GCP (CSPM, CIEM, agentless CWP) will be replaced by Wiz’s offering and remain with multi-cloud support.”

Google just made CNAPP the Formula 1 of Cloud Security  

In professional racing, as in DevOps, teams obsess over squeezing the last ounce of speed gains out of their engines or code. Knowing that just a few milliseconds gained by reducing the drag on a Formula 1 car or making slight engine improvements mean the difference between a winning season or not.

CNAPP is one of the engines DevOps and DevSecOps teams rely on to reduce risks, block intrusions and breaches, and provide a 360 view of CI/CD pipelines to make sure they are secure. Having a CNAPP that’s AI-driven delivers more accurate remediation and guidance, contextual threat intelligence and blocks intrusion attempts on CI/CD pipelines protecting code.

“While Wiz is most focused on CNAPP, the firm’s product offerings bleed into the traditional application security space, with container and Kubernetes security pieces. Recently Wiz expanded into security in the software development phases with software composition analysis (SCA), IAC scanning, and secrets scanning, as well as diving into the software supply chain use case with software bill of materials (SBOM) and CI/CD security posture. These are moves that put Wiz in a position to compete with application security testing vendors and other CNAPP vendors who have ‘shifted left,” explained Forrester Senior Analyst Janet Worthington.

DevOps teams are under constant, growing pressure to deliver. With bonuses often riding on if a delivery date for code is met, security is tacked on to the end of a CI/CD cycle or product schedule. VentureBeat learned that the typical Fortune 1,000 IT department has over 175 active, concurrent DevOps projects running at once, with many having no consistent cloud application security. In other words, those 175 projects are running in a variety of unprotected cloud environments without a common CNAPP platform to protect them. That’s jeopardizing the entire DevOps pipeline which is a move made to reduce time-to-market that leaves dozens of projects at risk.

Why Google doubled down on Wiz

Google’s ambitions to grow Google Cloud Platform (GCP) needed a cybersecurity platform that could go end-to-end, protect DevOps and strengthen DevSecOps while leveraging AI to deliver real-time threat detection, automated remediation and full-stack cloud security.

The real goal of this acquisition is to have a unified CNAPP solution capable of securing everything from code to cloud to runtime, ensuring that security no longer slows down development but accelerates it. Wiz’s AI-driven risk analysis, attack path visualization and multi-cloud security give GCP a competitive edge, making it a viable competitor in an increasingly crowded market driven by enterprises needing speed, scale and resilience in cloud security.

“Google has invested heavily in application security tooling that protects apps deployed not only in GCP but in other clouds (and on-premises). Google’s investment in its Cloud Armor platform has added web application firewall functionality that is competitive not just with Microsoft and AWS but with other WAF providers. reCaptcha Enterprise has expanded from a Captcha provider into a fuller bot management platform that addresses a range of business logic attacks,” says Forrester Principal Analyst Sandy Carielli.

“In recent months, Google has begun extending its API management product, Apigee, into broader API security use cases. While there are still gaps to fill, adding Wiz to the combined Cloud Armor, reCaptcha, and Apigee offerings moves Google closer to a holistic defense story for cloud applications,” Carielli continued.  

Google needed a unified AI-driven CNAPP to turbocharge its cybersecurity business. One that brings together security posture management, workload protection, advanced threat detection into a high performance security engine. Challenged by having a siloed approach to security in the past, Google is looking to now have a adaptive, flexible platform that can provide security at the speed of cloud app development.

Prior to this deal, GCP’s security toolkit was strong, yet siloed as evidenced by its Chronicle SIEM, Mandiant threat intel and a wide variety of partner solutions that created roadblocks across customers’ CI/CD pipeline. Acquiring Wiz closes a major gap in their cybersecurity strategy by providing an integrated AI-driven platform that scans cloud environments in minutes and identify risks in real time.

CNAPP has a fast track with AI savvy competitors

​The global CNAPP market was valued at approximately $9.79 billion in 2023 and is projected to reach $38.01 billion by 2030, growing at a compound annual growth rate (CAGR) of about 21.8% during the forecast period. Gartner notes that end-user calls on CNAPPs rose 29% from 2023 to 2024, with an emphasis on Cloud Security Posture Management (CSPM) driven by compliance and easy API deployment, with expectations of runtime visibility and control.

“Wiz’s key detection and response offering Wiz Defend takes a different approach to cloud detection and response. Instead of relying on built-in detection capabilities in its own cloud protection tools, it offers a unified tool solely for detection and response that takes in alerts and data from other tools and does detection engineering on them,” says Forrester Principal Analyst Allie Mellen.

“This reduces alert volumes from the cloud at a critical time. With this acquisition, it will put pressure on other vendors to consolidate in a similar way — a big win for security operations teams,” Mellen continued.

The CNAPP market is increasingly becoming the Formula 1 of cloud security, with Google, Microsoft, Palo Alto Networks, CrowdStrike and Check Point leading the charge.

• Check Point CloudGuard: A CNAPP solution designed for multi-cloud security, runtime protection and automated compliance enforcement. CloudGuard’s agent-based and agentless security helps protect workloads, Kubernetes environments, and serverless applications.
• CrowdStrike Falcon Cloud Security: Expanding from endpoint security to cloud, CrowdStrike brings its threat intelligence leadership into CNAPP. Falcon Cloud Security provides code-to-cloud visibility, IaC scanning, and runtime threat detection, reinforcing proactive breach prevention​.
• Microsoft Defender for Cloud: A deeply integrated CNAPP that extends across Azure, AWS, and GCP, offering runtime protection, identity security, and AI-driven threat intelligence. With Security Copilot, Microsoft is leveraging generative AI to automate threat detection and remediation​.

Other CNAPP vendors in the market include Aqua Security, Lacework, Orca Security, Palo Alto Networks, SentinelOne, Sysdig and Trend Micro all offering solutions for cloud security, workload protection and posture management.

The AI-enabled CNAPP race is just beginning

Google’s decision to make their single largest acquisition in its history says they see the pain of siloed slow processes in enterprises they can quickly turn into a profitable new part of their cybersecurity business. CNAPP is the racing engine their prosects and current customers are looking for.  

For CISOs and security leaders, the key takeaway is clear: the future of cloud security belongs to platforms that integrate AI, automate risk detection, and provide full-stack visibility across multi-cloud environments. Whether Google’s Wiz-powered CNAPP takes the lead will depend on how well it integrates with Google’s AI-driven threat intelligence and security operations suite.

Bottom line: Enterprises need AI-powered CNAPP solutions to streamline CI/CD security and reduce the cloud security burden on DevOps teams. The competition among vendors—led by Google’s Wiz-powered push—will be won by those who best integrate AI, automate risk detection, and provide full-stack visibility across multi-cloud environments.