The RSA Conference (RSAC) in San Francisco has run since 1991 and has become a tradition in the cybersecurity industry, highlighting the market’s most interesting trends, companies, and deals. This year, it seemed that Wiz’s gigantic funding round stole the show.
Of course, there was plenty of other news. Palo Alto Networks had the intention of grabbing your attention by launching its Precision AI product with a flashy advertisement starring Keanu Reeves. But more people were talking about Wiz.
Wiz, the Israeli cloud security company headquartered in New York, announced a staggering $1 billion round of funding with a $12 billion valuation. It was audacious news in an industry that has recently been predominated by layoffs and failed deals, mounting cyber risk, and the prospect of “spending fatigue,” highlighted by Palo Alto Networks CEO Nikesh Arora himself.
The Wiz funding also happens in the shadow of the potential sale of another cloud security company, Lacework, which several years ago raised a similarly large amount of funding and appears to have failed to live up to expectations.
All-Star Team and Top Tier Backing
Wiz may be the industry’s most precocious startup. It’s only four years old. The company focuses on cloud security, including collecting data from as many technology layers as possible and putting together a comprehensive picture of cloud security.
There are reasons for the large round and valuation. The company has reported more than $350 million in annual revenue. Wiz has an All-Star team. The company was co-founded in 2020 by CEO Assaf Rappaport, Yinon Costica, Ami Luttwak and Roy Reznik. The same team founded Adallom, which was sold to Microsoft for $320 million in 2015. The same team also led Microsoft Azure’s Cloud Security Group. Lately it has been rolling up other cybersecurity companies such as Gem Security and Rafft. The funding was led by top VCs Andreessen Horowitz, Lightspeed Venture Partners, and Thrive Capital.
But there are also reasons why it struck folks as odd. Given the backdrop of the struggles of cybersecurity practitioners to keep up with mounting threats with limited budgets, the celebratory news rubbed some folks the wrong way.
“It’s very strange,” said somebody who didn’t want to be mentioned, about the deal. This was a common refrain. As I worked my way through the cubes, everybody wanted to talk about it. Nobody wanted to be named.
There are several reasons why you might question the deal and the timing. First, it runs counter to macro trends in venture capital of lower funding and lower valuations (we’ll dive into the data below). Secondly, it seemed a bit tone-deaf. Many startups have been laying off workers or at least retrenching, and Wiz’s announcement seemed out of place. Fourth, the comparison with Lacework is fresh in people’s minds. Fifth, Wiz has an ongoing lawsuit with rival Orca Security, which has sued it for intellectual property theft. Although this likely won’t be resolved for some time, it is a risk hanging over the company.
Add all this up and you get the puzzlement: Why is Wiz so confident?
Large Valuation Adds Pressure in Down Market
In the long term, Wiz has put a lot of pressure on itself in a venture market that’s trending lower. When a startup raises this much money at such a high valuation, it raises the bar for a successful exit. Wiz must now be sold or go public at a valuation of $12 billion or higher to prove this deal a success. This is exactly the challenge that has plagued Lacework, which in 2021 raised $1.3 billion at a $8.3 billion valuations—numbers that sound eerily similar.
It also runs against trend. The venture-capital industry has been scaling back after an epic run of money and high valuations spurred by more than a decade of low interest rates. Interest rates have now returned to their long-term mean, which has a direct effect on private equity investment. The relationship between interest rates and venture funding is well understood. As the cost of capital gets higher, the funding of risky, long-term ventures becomes less attractive and investment declines.
VC funding fell 15% in the fourth quarter of 2023, compared to the same period in 2022, according to Bain and Company. That was the lowest level since 2020. Data from PitchBook shows that median valuations for early-stage VC-backed companies have been dropping. A recent report said that the down rounds, or capital raises that give a company a lower valuation than the previous round, recently climbed to a 10-year high.
Some prominent venture capitalists have highlighted this trend in the industry. Benchmark’s Bill Gurley, Altimeter’s Brad Gerstner, and Lux Capital’s Josh Wolfe have been highlighting the slowing pace of VC investments in public podcasts as well as on Twitter.
Elsewhere at RSAC: AI and Cyber Threats in Full Swing
Setting aside the glamour of Wiz, the nuts of bolts of RSAC grappled with the recurring theme: How do we stop all those bad guys? Despite billions in capital being plowed into cybersecurity startups, the threats continue to grow.
Security practitioners aren’t getting rich from venture capital, and they are still fighting losing battles. McKinsey and Company recently reported that global organizations are spending upwards of $20 billion on cybersecurity, with little success. Breaches continue to increase, and McKinsey estimates the damages reaching $20 trillion by 2025. Yes, that’s trillion with a “T”!
Why do threats keep rising? One key driver is the logarithmic increase in connected devices and cloud services. New research from runZero, the Cyber Asset Attack Surface Management (CAASM) report, looked at the expanding attack service due to the convergence of information technology (IT) and operational technology (OT), driving an expansion of high-value technology asset targets.
“Our research reveals alarming gaps and unexpected trends in enterprise infrastructure, including the decay of network segmentation, persistent challenges in attack surface management, and the increasing volume of dark matter on modern networks,” said HD Moore, founder and CEO of runZero.
Indeed, more connectivity, networks, and clouds equates to more complexity. Shailesh Shukla, a long-time Silicon Valley executive who most recently built a fast-growing multi-billion-dollar business in Cloud Networking, Security and Telecom as a VP/GM at Google, told me that increasing complexity of connected things will require more convergence of networking and security.
“It’s all about the convergence of networking and security,” Aryaka Networks CEO Shailesh Shukla told me in an interview. We’ve done the hard part, which is the global infrastructure. So now we have built and will continue to offer more integrated security services as part of it.”
Palo Alto Introduces Precision AI
RSAC highlighted other key trends, such as—of course—AI. In another marquee announcement, Palo Alto Networks announced Precision AI, a proprietary AI system that combines machine learning, deep learning and generative AI. More importantly, Palo Alto launched an advertisement featuring Keanu Reeves, in an unlikely marriage of a Hollywood star and next-generation firewalls.
In February, as mentioned, Palo Alto shocked the industry by taking down its annual financial guidance after it announced its move to “platformization,” or an integration of its product portfolio. The stock plunged on the news, which Wall Street took tpo mean more product bundling and discounts.
As global organizations struggle to keep up with the growing complexity of technology assets and how to protect them, it makes senses that they are demanding more consolidated platforms and integration. They’re losing many battles, and they are confused by the plethora of cybersecurity tools and acronyms. They need a more economical way to combat threats—maybe not more VC funding.
This somber challenge is what made Wiz’s announcement so shocking. In a world of falling expectations and increasing frustration with cybersecurity risk, it was odd to have a company celebrating a $12 billion valuation at the center of the discussion.
