Cloud Security

Cloud security is the most contested category in the industry and the one where the buying question has changed most in the past year. For a decade the answer to securing a cloud estate was to buy a specialist, because the cloud providers’ own tools were thin and the specialists moved faster. In March 2026 Google closed a $32 billion purchase of Wiz, the fastest-growing vendor the category has produced, and the question a buyer now faces is different: whether to keep buying cloud security from an independent at all, or from the provider running the cloud.

The category is usually sold as CNAPP, a cloud native application protection platform, which is an analyst term for the consolidation of five or six older products. Posture management, entitlement management, workload protection, container and Kubernetes security, and increasingly the security of the code that produces all of it, arrive as one platform because buyers refused to keep integrating them.

Why this market exists

The first reason is that cloud misconfiguration is not a vulnerability in the traditional sense. There is no patch for a storage bucket left readable, an over-permissive role, or a workload reachable from the internet because a security group was widened during an incident and never narrowed. These are configuration states, they are created continuously by people doing legitimate work, and the only way to manage them is to keep looking.

The second is that the estate changes faster than anyone can inventory it. A container that ran for ninety seconds still had permissions, still reached data, and is gone before a weekly scan arrives. Anything that depends on a schedule is describing a cloud that no longer exists.

The third is that the interesting risk is a path, not a finding. A public workload is not urgent on its own, an unpatched library is not urgent on its own, and a role with database access is not urgent on its own. The three of them on the same machine is an incident waiting to be written up. Every serious platform in this category is, underneath, a graph built to find that combination, and the quality of the graph is most of what separates them.

What changed this year

Google completed its acquisition of Wiz on 11 March 2026, twelve months after announcing it, following unconditional clearance in the United States, the European Union, Australia, Israel, Saudi Arabia, South Africa and Türkiye. It is the largest acquisition in Google’s history. Wiz had passed $1 billion in annual recurring revenue during 2025 and counted half the Fortune 100 as customers, so this was not a company bought for its technology alone.

The effect on everyone else is straightforward. The category’s benchmark product now belongs to one of the three hyperscalers, and a buyer running workloads on AWS or Azure has to decide how comfortable they are with that. Google says Wiz will stay multi-cloud. Competitors will spend the next two years saying it will not, and the honest position is that nobody yet knows.

Underneath the headline the market has been harsh. Fortinet bought Lacework in 2024 for a figure reported at $200 million to $230 million, against the $8.3 billion valuation Lacework carried in November 2021. It now ships as FortiCNAPP. Only fifteen cloud security vendors raised funding during 2025, placing the category eleventh of the twelve sectors Momentum Cyber tracks, ahead of endpoint security alone.

That sits oddly beside demand. Eighty-five per cent of organisations say they will increase cloud security spending this year, ahead of every other security category including data protection at seventy-seven per cent. Buyers are spending more while investors have stopped funding new entrants, which is what the late stage of a category looks like: the winners are known, and the money goes to consolidation rather than to challengers.

How to evaluate one

The demonstrations are close to identical. Every vendor will show a graph, an attack path, and a number that went down. The questions that separate them are duller.

Agentless, agent, or both, and what each actually sees. Agentless scanning reads discs and configuration through the cloud’s own APIs, deploys in an afternoon, and cannot see what a process is doing right now. A runtime agent sees the process and costs deployment effort in every account. Most platforms now claim both. Ask which findings come from which, because a platform that is agentless in practice and agented in the brochure will not detect a live intrusion.

How stale the picture is. Ask the scan interval, then ask what happens to a workload that lives and dies between scans. The answer separates a posture tool from a security tool.

Whether it works on the clouds you actually run. Coverage claims are rarely equal across AWS, Azure and Google Cloud, and are almost never equal for the second and third one you adopted after an acquisition.

What it does with the finding. A platform that produces ten thousand issues and no owner has moved work rather than reduced risk. Ask how a finding reaches the team that can fix it, and whether that route exists without a services engagement.

Who owns it internally. This category is bought by security and operated, in practice, by platform engineering. A tool that platform teams will not use is shelfware however good the graph is.

Where this ends up

Consolidation is the direction of travel. Gartner expects eighty per cent of enterprises to reduce cloud native protection to three vendors or fewer by the end of this year, and the platform vendors are pricing to make that easy. The pure independents that remain are competing on depth in a market whose buyers say they want fewer suppliers, which is a difficult argument to win twice.

The open question is whether cloud security ends up as a feature of the cloud, the way identity and key management largely did, or stays a market with independent vendors in it. The Wiz deal is the strongest evidence so far for the first outcome. The runtime specialists, whose value is inside the workload rather than in the provider’s control plane, are the strongest argument for the second.