SC

Strategy Canon

Lacework

Lacework learned how each cloud workload behaved and cut alert noise for security and DevOps teams, then lost the market to Wiz, which mapped a company's whole cloud from read-only credentials in minutes, sold that view to the largest companies first and sold to Google for $32 billion.

Why Lacework lost to Wiz

  1. 1 · 2017–22Behavior baselines collected by agentsPolygraph (2017) learned each workload's normal behavior with no rules to write; agentless scanning reached alpha only in June 2022.

    LA6LWX-4

  2. 2 · 2022–23Fewer alerts for security and DevOps teamsRapidSOS cut alert fatigue by 41% across its AWS environment; Verifone chose Lacework in 2023 to reduce alerting.

    LA3LA2

  3. 3 · 2021–23$1.3 billion raised, then a growth stallAn $8.3 billion valuation on about $50 million of ARR in 2021, layoffs and two top executives out in 2022, 18.8% growth in 2023.

    LA8LWX-13LWX-9

    Blitzscaling
  4. 4 · 2024Sold to Fortinet for $152.3 millionAbout $100 million of ARR; a Wiz letter of intent failed in diligence; Fortinet paid $152.3 million in cash in August 2024.

    LWX-7LWX-8LA5

Versus Wiz: Wiz needed only read access to a customer's cloud accounts to show every exposure in minutes, sold that view to the largest companies first, and reached $100 million of ARR in 18 months LWX-1 LWX-2. Lacework, on the market three years before Wiz was founded, relied on agents for runtime detection, added agentless workload scanning in 2022, raised $1.3 billion while its growth slowed, and sold to Fortinet for $152.3 million in 2024 LA6 LWX-4 LA8 LWX-9 LA5.

Arena: Market Conditions Before Lacework

Security and DevOps teams running cloud workloads · 2017 · United States

Changing technical requirementsHigh setup and upkeep costs

By 2017 companies were moving workloads into public, private and hybrid clouds, where thousands of similar machines, containers, applications and processes appeared and changed constantly LA6. The security tools on offer depended on writing policies and rules and correlating logs, labor-intensive work that had to be redone as the environment shifted, and separate products covered breach detection, insider threats and investigation LA6. An Ovum analyst expected buyers to judge new tools on how quickly they deployed, produced useful findings and shortened the time to detect a breach LA6.

How each step happened

Step 1 of 4 · 2017–22

Behavior baselines collected by agents

Wiz's innovation was a scanner that needed nothing installed. Its four founders had sold Adallom to Microsoft and spent about five years building Azure security before starting Wiz in 2020, and their first investor, Doug Leone, says they saw that cloud security needed a simpler, agentless architecture LWX-3 LWX-12. A customer granted read permissions to its AWS or Azure accounts and within minutes saw a graph of its whole cloud LWX-3 LWX-1. Costco's security chief tried it in the summer of 2020 and had it running across the company's internal applications and databases within a day LWX-1.

Lacework had reached the market three years before Wiz was founded, with a different source of data. Polygraph, launched in April 2017, learned how each workload normally behaved and flagged departures, with no policies, rules or logs for analysts to maintain LA6. Chief executive Jack Kudale said: "We realized that every datacenter, workload, user, container, application and process has its own truth" LA6. It sold for $250 per instance a year, and within a month it protected more than 50,000 instance-hours of workloads a day LA6 LA7. Its continuous monitoring and runtime threat detection depended on agents installed on the hosts, and its earlier agentless features covered code, container images and cloud audit logs LWX-4. Agentless scanning of running workloads reached alpha only in June 2022, for Linux on AWS LWX-4.

Rivals Wiz asked only for cloud credentials and showed connections and paths to the outside world across a customer's accounts within minutes LWX-1 LWX-3.

Novel ArchitectureDrop-In Adoption

Step 2 of 4 · 2022–23

Fewer alerts for security and DevOps teams

Wiz turned that complete view into a ranked list of fixes. Its security graph correlated network exposure, identities, secrets and workloads, and chief technology officer Ami Luttwak compares it to checking every door and window of an office building and flagging the unlocked ones nearest the ground or a fire escape LWX-2 LWX-1. Use spread beyond the security team. At FOX more than 150 employees used Wiz, about ten times the size of the company's security team LWX-3.

Lacework's product also reached beyond the security team, through fewer and better alerts. RapidSOS's rules-based tools had produced alerts that were 80 percent false positives for its security and DevOps teams; with Polygraph it cut alert fatigue across its AWS environment by 41 percent and reduced compliance evidence gathering from two days to less than an hour LA3. Security engineer Russell Kingley said: "Rules won't necessarily scale" LA3. He credited Polygraph with reducing alert fatigue for the company's developers as well as its security and network operations teams LA3. Verifone chose Lacework in February 2023 to fold security checks into its DevOps and CI/CD pipelines, and Luke Clinch, its global director of infrastructure, expected it to "dramatically reduce security alerting" LA2. What Lacework lacked until late 2022 was Wiz's ranked map of exposures across the whole cloud. It added attack path analysis, linking vulnerabilities, misconfigurations, reachability and identity roles on each host, in November 2022 LWX-5. By then Wiz had passed $100 million of ARR on that prioritized view LWX-2.

Rivals Wiz put its graph in front of developers as well as security staff, and by 2024 counted more than 40% of the Fortune 100 as customers LWX-3 LWX-8.

Democratize the Expert Task

Step 3 of 4 · 2021–23

$1.3 billion raised, then a growth stall

Wiz sold to the top of the market first and raised money to hire ahead of demand. Chief executive Assaf Rappaport says it focused from the start on high-value customers whose security leaders others watched LWX-2. Morgan Stanley, Salesforce, Costco and BMW signed on LWX-1 LWX-2. Annual recurring revenue (ARR) went from $1 million in February 2021 to $100 million around July 2022, the fastest of any software company, and reached $200 million nine months later LWX-2 LWX-1. Headcount grew from under 200 in December 2021 to nearly 500 by August 2022 LWX-2.

Lacework raised more, hired faster and then stalled. In November 2021 it raised $1.3 billion at an $8.3 billion private valuation, about 166 times its annual recurring revenue LA8 LWX-7 LWX-9. ARR had passed $50 million at the end of 2021, while headcount went from about 200 in January 2021 to more than 1,000 in March 2022 LWX-13. Its average deal had grown from $100,000 in 2019 to $150,000 at the end of 2021 LWX-9. In May 2022, six months after the round, co-CEOs David Hatfield and Jay Parikh announced layoffs of 20 percent of staff, heaviest in sales and marketing LWX-6 LWX-13. They blamed a seismic shift in public and private markets LWX-6. President and chief revenue officer Andy Byron left in late August, and in October Hatfield gave up the co-CEO role, leaving Parikh as sole chief executive with a goal of more than $1 billion of ARR, about 20 times the level then LWX-13. Revenue reached $95 million in 2023, up 18.8 percent, and ARR was about $100 million in April 2024 LWX-9 LWX-7. Wiz went from $100 million to $350 million over a similar stretch LWX-2 LWX-3.

Rivals Wiz reached $100 million of ARR in 18 months by selling to the largest companies first; Orca Security and Palo Alto Networks' Prisma Cloud competed for the same buyers LWX-2 LWX-1.

BlitzscalingLighthouse Customers

Step 4 of 4 · 2024

Sold to Fortinet for $152.3 million

Wiz used its lead to widen the product across the cloud estate. In 2023 it added a runtime sensor for live attacks, an installed component of the kind it had displaced; by early 2024 it also offered security posture management for AI services, and in April 2024 it bought Gem Security for $350 million LWX-3 LWX-1 LWX-7. ARR reached $350 million in 2023 LWX-3. In March 2025 Google agreed to pay $32 billion in cash; it completed the purchase in March 2026 LWX-10 LWX-11.

Lacework had about $100 million of ARR by April 2024, when its investors were looking for a buyer LWX-7. Wiz signed a letter of intent to buy it for $150 million to $200 million, with Lacework's roughly $800 million of cash to be distributed among its investors, and the deal fell through in due diligence LWX-7 LWX-8. Fortinet completed the acquisition on August 1, 2024, paying $152.3 million in cash LA4 LA5. In the post-acquisition part of 2024 Lacework contributed $31.1 million of revenue and $45.8 million of net loss LA5. The company sold for less than 2 percent of its 2021 valuation of $8.3 billion LWX-7 LA5.

Rivals Wiz agreed in March 2025 to sell to Google for $32 billion in cash, with its products still sold across AWS, Microsoft Azure and Oracle Cloud LWX-10.

Multi-ProductM&A Strategy

Key dates

  1. 2017-04Polygraph launches at $250 per instance a year LA6
  2. 2017-0650,000 instance-hours a day protected after one month LA7
  3. 2018$1M ARR Annual recurring revenue, Sacra figure LWX-9
  4. 2019$5M ARR Average deal $100,000 LWX-9
  5. 2020$20M ARR Annual recurring revenue, Sacra figure LWX-9
  6. 2020-02Wiz founded after Rappaport leaves Microsoft LWX-1
  7. 2021-11$1.3B raised at an $8.3B private valuation LA8 LWX-7
  8. 2022-02Google Cloud partnership and GV investment LA1
  9. 2022-05Layoffs and restructuring LWX-6
  10. 2022-06Agentless workload scanning in alpha, AWS Linux only LWX-4
  11. 2022-07Wiz reaches $100M ARR LWX-2
  12. 2022-10Hatfield leaves; Parikh becomes sole CEO LWX-13
  13. 2022-11Attack path analysis and agentless scanning generally available LWX-5
  14. 2023Lacework revenue $95M, up 18.8%; Wiz at $350M ARR LWX-9 LWX-3
  15. 2023-02Verifone selects Lacework LA2
  16. 2024-04About $100M ARR Wiz letter of intent at $150M to $200M LWX-7
  17. 2024-05Wiz deal falls through in due diligence LWX-8
  18. 2024-08Fortinet completes acquisition for $152.3M in cash LA4 LA5
  19. 2025-03Google agrees to buy Wiz for $32B in cash LWX-10
  20. 2026-03Google completes the Wiz acquisition LWX-11

Sources

Oldest first.

  1. LA6 Lacework launches cloud workload security. Lacework · 2017-04-24 Primary disclosure
  2. LA7 Lacework first-month adoption. Lacework · 2017-06-01 Primary disclosure
  3. LA8 Lacework raises $1.3 billion at an $8.3 billion valuation. Lacework · 2021-11-18 Primary disclosure
  4. LA1 Lacework partners with Google Cloud. Lacework · 2022-02-02 Primary disclosure
  5. LWX-6 Lacework Announces Layoffs, Restructuring. Dark Reading · 2022-05-26 Trade press with co-CEO statement
  6. LWX-4 More flexibility and visibility with agentless coverage for workloads. Lacework blog (Aditi Mukherjee) · 2022-06-02 Company blog (primary)
  7. LWX-2 Cloud security startup Wiz reaches $100M ARR in just 18 months. TechCrunch (Ron Miller) · 2022-08-10 Trade press with CEO and investor quotes
  8. LWX-13 Lacework Co-CEO David Hatfield Out 4 Months After Layoffs. BankInfoSecurity (ISMG, Michael Novinson) · 2022-10-05 Trade press with CEO interview
  9. LWX-5 Lacework enhances CNAPP capabilities with attack path analysis and agentless vulnerability scanning. Help Net Security · 2022-11-10 Trade press with Lacework executive quote
  10. LA2 Verifone selects Lacework. Lacework / Verifone · 2023-02-23 Customer account
  11. LWX-1 The Wizard of Wiz (Forbes Cloud 100 cover profile). Forbes (Alex Konrad) · 2023-08 Business press with founder, executive and customer quotes
  12. LWX-3 Cloud Captains: How Assaf Rappaport and His Extraordinary Co-Founders Built the World's Fastest-Growing Company. Index Ventures · 2024-03-01 Investor profile with founder quotes
  13. LWX-7 Lacework, last valued at $8.3B, is in talks to sell for just $150M to $200M, say sources. TechCrunch (Ingrid Lunden) · 2024-04-18 Trade press
  14. LWX-8 Wiz will not acquire Lacework. CTech by Calcalist (Meir Orbach) · 2024-05-02 Trade press
  15. LA4 Fortinet completes Lacework acquisition. Fortinet · 2024-08-02 Primary disclosure
  16. LWX-9 Lacework revenue, valuation and funding. Sacra · 2025 Research estimates
  17. LWX-10 Google to acquire Wiz (Alphabet Form 8-K Exhibit 99.1). Alphabet / SEC · 2025-03-18 Primary disclosure with CEO quotes
  18. LWX-12 Wiz and Google: Securing the Cloud. Sequoia Capital (Doug Leone) · 2025-03-18 Board member and first investor's account
  19. LA5 Fortinet 2025 annual report: Lacework purchase accounting. Fortinet / SEC · 2026-02-25 Primary filing
  20. LWX-11 Google completes $32 billion acquisition of Wiz. ITdaily · 2026-03-11 Trade press
  21. LA3 RapidSOS replaces disparate tools with Lacework. AWS / RapidSOS · Undated; observed 2026-10-09 Customer account