How Wiz Built the Fastest GTM Machine in Software History

Wiz went from $1M to $100M ARR in 18 months. That's the fastest any software company has ever done it. Then it kept going — $500M ARR by August 2024, a $32B all-cash acquisition by Google, the largest ever for a venture-backed startup.

Everyone credits the agentless product. The product was necessary. It wasn't sufficient. What actually happened was one of the most deliberate go-to-market builds you'll ever study. Let's pull it apart.

By the numbers

• ▮$1M → $100M ARR in 18 months (by August 2022) — fastest software company ever to $100M. First year they forecast $8M and booked $42M.
• ▮$100M → $200M nine months later. $350M by early 2024. $500M by August 2024. Past $1B ARR by the time the deal closed.
• ▮Series A: $100M at a $500M valuation in December 2020 — before most SaaS companies have a repeatable pitch. By Feb 2023, a $10B valuation. May 2024, a $1B round at $12B.
• ▮$32B all-cash Google acquisition — announced March 2025, closed March 2026. A 39% premium over the $23B offer Wiz walked away from, and roughly 32x projected ARR.
• ▮~1,800 employees and over 50% of the Fortune 100 as customers at close. It was 40% back in 2023.
• ▮Founded January 2020. So the whole arc — zero to $32B — took about six years.

Hold that last one in your head. Six years.

The wedge: they named the category, then owned it

Cloud security in 2020 was alphabet soup — CSPM, CWPP, CIEM, IaC scanning. Five tools, five dashboards, five vendors. Wiz collapsed the whole mess into one platform and gave it a name: CNAPP (Cloud-Native Application Protection Platform). They coined the term, championed it, and got Gartner and IDC to adopt it. When analysts write the category using your word, every buyer's shortlist starts with you.

The product wedge underneath it was agentless. Competitors made you deploy and babysit agents on every workload. Wiz connected via API and scanned your whole cloud in under a day — no agents, no rollout project. Then the Security Graph showed "toxic combinations": the handful of misconfigs that actually chain into a breach, instead of 10,000 undifferentiated alerts. A Bridgewater exec put it plainly: others had tools, but "to deliver ROI almost instantaneously, no one else was there."

That's the wedge. Fast time-to-value became the entire sales motion, not just a feature.

Engine 1: sell top-down, to the biggest logos, immediately

Most startups sell down-market first because it's easier. Wiz did the opposite on purpose — they went for the market's highest-value customers from day one. Early logos: Fox, Morgan Stanley, LVMH. Bernard Arnault was reportedly so taken with Rappaport's ambition he wrote a personal check.

Here's the move most people miss: the founders closed a couple million in ARR themselves before hiring a single rep. They proved the enterprise motion was repeatable, then poured fuel on it. When they hired, they hired aggressively and expensively — poaching top sellers from across security — and ran a hard, some said ruthless, playbook. Reps openly told prospects to question competitors' viability. Rivals cried FUD; Wiz kept booking.

The founder pedigree made the top-down motion possible. All four met in IDF Unit 8200. They'd already built and sold Adallom to Microsoft for ~$320M in 2015, then run cloud security inside Microsoft. So when Wiz cold-called a Fortune 100 CISO, it wasn't four kids with a demo — it was the team that built the last thing that CISO bought, with a warm network of relationships to match.

Engine 2: the POC is the pitch

Agentless wasn't just architecture — it was the sales weapon. A rep could get a prospect scanning their real production cloud in the room, in under a day, with zero deployment project. The "aha" — here are the three toxic paths into your crown jewels — landed before procurement ever got involved.

Why it worked: enterprise security sales usually die in the 90-day POC. Wiz compressed proof-of-value to hours and made the finding undeniable and specific to your environment. Short POC → short sales cycle → land fast, then expand. Net revenue retention ran north of 120% in recent cohorts as land-and-expand kicked in — a $200K CSPM deal grows into a seven-figure platform contract as you bolt on the next module.

Engine 3: brand dominance — they made security fun

Security marketing is a wall of fear: red alerts, hooded hackers, breach countdown clocks. Wiz went the other way. The name is short for wizard; the whole brand is built on magic — turning the impossible possible, optimism instead of panic.

The expression of it was the trade-show booth. Early on, nobody knew Wiz and nobody stopped. So they went weird. A Wizard of Oz booth — yellow brick road, a hot-air balloon you could see across the hall, a magician doing a 15-minute show every hour, actors as Dorothy and the Tin Man. It was the only booth at RSAC that didn't say what the company did. Later came "Wiz Mart," a full fake supermarket for cloud security, which won RSAC's 2024 Beautiful Booth Award.

The mechanism, and the number that matters: themed booths pulled 3.5x more leads than plain ones. Standing out at a 40,000-person conference where every booth is navy-blue and terrifying is nearly free ROI. The booth was the top of a very real funnel.

Engine 4: research as marketing — earn the trust, then sell into it

Wiz Research is the quietest, most underrated engine. It's a team of elite researchers who hunt vulnerabilities in the cloud platforms themselves and publish loudly. In August 2021 they dropped ChaosDB — a flaw in Microsoft Azure's Cosmos DB giving any user admin access to thousands of other customers' databases. Microsoft killed the feature within 48 hours. Then OMIGOD, then AWS cross-account bugs.

Every disclosure earned days of press in The Register, TechCrunch, every security outlet — for free — and stamped Wiz as the team that understands cloud risk better than the hyperscalers running the cloud. They productized the credibility: a public Cloud Threat Landscape database and an open call for an industry cloud-vulnerability database. When the researchers your CISO reads on Twitter all work at one vendor, that vendor doesn't need to explain why it's credible.

Engine 5: distribute through the cloud marketplaces

This is the boring one that prints money. From day one, Wiz sold through the AWS, Azure, and GCP marketplaces — and made it a core pillar, not an afterthought. The stat: 99% of Wiz's sellers closed at least one deal through a cloud marketplace (they ran it on Tackle).

Why it's a cheat code for enterprise: buyers can spend against committed cloud spend (that pre-negotiated AWS/Azure budget they must burn), procurement is already approved, and the paperwork collapses from months to minutes. Co-selling with the hyperscalers' own field reps turned Wiz into the default cloud-security buy the moment a company migrated. You meet the buyer where the budget already lives.

Steal this

1. Compress your time-to-value until the POC sells itself. This is the most copyable play at any stage. Wiz's edge wasn't the demo — it was showing a prospect a specific, undeniable finding in their own environment in hours, not a 90-day trial. Whatever you sell, ask: can a prospect feel the value before they talk to procurement? If your POC takes a month, that's your real GTM bug — fix it before you hire more reps.

2. Publish research your buyers can't ignore. You don't need a ChaosDB. You need one genuinely useful thing your ideal buyer will share with their peers — original data, a teardown, a free tool that exposes a problem they have. Earned credibility scales to a Seed-stage team; a $500K booth does not. This is the highest-leverage move for anyone under Series B.

3. Sell where the budget already is. If you touch cloud, get on the marketplaces early — approved procurement and committed-spend budget shorten enterprise cycles dramatically, and you don't need Wiz's funding to list. The partner co-sell motion, though, is honest table stakes only once you have logos worth co-selling; don't fake it at ten customers.

Be clear-eyed about what doesn't transfer. The $100M Series A, the poach-the-best-reps war chest, the second-time founders with a Microsoft exit and a live CISO Rolodex — those bought Wiz permission to go top-down from hour one. You probably have to earn the first ten enterprise logos the slow way. But time-to-value, earned-media research, and marketplace distribution? Those are engineering and discipline, not capital. Start there.