How Wiz grew to $500M ARR in 4 years—& could exit to Google for $23B (largest VC-backed exit in history)

00:00:00 · Pablo SrugoPlay from here

[00:00:00] S0: Google is in talks to acquire Wiz in what would be, not just Google's biggest acquisition ever, but the biggest acquisition ever of a VC-backed startup. We're talking about a $23 billion acquisition. And the thing that I had to ask myself was, first of all, why Wiz ? And second of all, like how do they do it so fast? These guys started Wiz in 2020 <laugh> , it's been four years and now they're gonna get bought for $23 billion in a market that is not hot, not full of fomo. What do they do? Especially because they're getting acquired for like 40 x revenue multiple. They're doing like half a billion dollars in a RR , they're getting bought out for 23 billion. You know, for comparison, Microsoft is sitting sitting at like 15 X revenue multiple. Some of those other companies like Google or Meta, they're sitting at like 10 x five x, like this is the world that we're in right now and here's a company that's four years old, I'm gonna get acquired for like 40 x revenue multiple. So what did they get right? And the way I break it down is like really there's three things that they did insanely well. Insane growth, insane team and insane discipline. If you think about the growth piece, like their kind of massive moment was in 2021 where they announced that they hit a hundred million dollars in a RR in 18 months, which is just mind blowing at the time. It was the fastest ever. I think it got outdone by ChatGPT recently. But like a hundred billion dollars in 18 months is mind blowing . Like I actually have a hard time understanding how a company can get there so quickly. Especially a company that's signed to Enterprise. Because as much as the contracts I'm sure are million dollar contracts, how would you get in front of and then close so many of these contracts So quickly, like just for context, if a startup gets, and you know this like it's really hard to get a million in a R 10 million, nevermind a hundred million in a RR and like if a company, if a startup goes from zero to a million in a RR in a year, that's considered like top decile . These guys did zero to a hundred million in a RR in 18 months and it hasn't stopped, right ? So when they hit a hundred million a RR , this was mid 21. By the end of 23 they were doing 300 a RR .

00:01:58 · Pablo SrugoPlay from here

By May of this year they're doing three 50 a RR and somehow now like three months later they're at half a billion dollars of a RR . So this is like an incredibly fast growing company and that's the reason that they're getting insane multiples. So the question is like how did they get that crazy growth? And one of the things like I am no cybersecurity experts with this cybersecurity company, but I was digging in trying to make sense of this at least to some level. And the best kind of framework that I could come up that applies here is is Christensen's jobs to be done framework. You'll know Christensen because of the innovator's dilemma, like he talks about disruptive innovations and all this sort of stuff. He also has this other thing called Jobs to be Done framework. The simplest way to put it is he has this story about he was helping this company sell milkshakes and they were trying a bunch of different things to sell more milkshakes. One of the things that they realized was that many people were buying a milkshake in the morning and they were buying it through like they were driving like through the drive-through

00:02:58 · S1Play from here

[00:02:58] S1: And buying a milkshake. What they realized was people didn't just want the milkshake. What was happening was people were going to work, they're getting stuck in traffic and they just wanted something they could sip on. And so the job to be done for a milkshake wasn't just, you know, something that needed to taste good or whatever. It was actually a drink that would en be enjoyable for a really long time and help them kind of sit through traffic and enjoy it a bit more. That was really the job to be done for a framework. So they changed very different things about the milkshake, like the viscosity and the marketing around it. And that helped them sell more milkshakes. And it really applies here because when you listen to the founders of Wiz talking , the way that this cybersecurity world worked before Wiz is there's, by the way, this is highly competitive market. There are hundreds of cybersecurity vendors out there, but the problem was they all attack different silos. And if you think about the job to be done, if you think about the problem to be solved, the real problem is I don't wanna get hacked, like effectively cybersecurity team is I need to keep my cloud infrastructure safe from any sort of threats. And what the tools doing was they were solving little pieces of that puzzle. So you had a tool, for example, for misconfigurations, another one might find vulnerabilities. You also needed to install like agents in a bunch of different places, which you know, short way of putting is was really hard to make these other tools work. And even when they did work, they only uncovered a little piece of the problem, which meant for the engineers, the cybersecurity experts that are in these companies. It was really hard to actually do the job, which is minimize the number of attack , the number of threats and the exposure that you actually have. That's the end-to-end promise , end-to-end risk . That's what you're trying to solve for. And a good analogy for this for me is like Shopify. So Shopify's a company I know a lot better than Wiz. And if you think about it, before Shopify you needed a solution for payments, you needed a solution for a website builder, you needed a solution for inventory management and then you could call below these up and you can finally sell online. But what you wanted to do, the job to be done was to sell things online.

00:04:52 · S1Play from here

And what the solutions solved was different pieces of that puzzle. Taking payments online, building a website, managing inventory. What Shopify did is it brought all of these things together and gave you somewhere where literally like in a click of a button you could sell things online and then the platform would grow with you and scale with you. That's wiz in a nutshell. But for cyber security, you onboard very quickly. You don't need to install ways in a bunch of different places. It works with whatever cloud architecture that you already have and it does the job. It actually helps you manage end-to-end risks and prioritize which ones you should solve and then it grows with you. And that's one of the key reasons why they had the sort of pull that they had was that they were the only ones to address the entire job to be done. And the value prop resonated above and beyond what all the other vendors were able to offer. The second thing, and frankly this is tied to the first, they're all really tied together. They had an insane team. So these guys, their four co-founders, they meet in 2001 in in Israel in the army when they're 17 and they serve together for nine years. People talk about, you know, they wanna have a team with people that they could go to war together. Like these guys effectively went to war together, right? They were in the army for nine years. So they knew themselves in a way that most founding teams don't. Then in 2012 they come , they started a company called Adallom , which is also in the security space. They raised $50 million and three years later they are acquired by Microsoft for $320 million. So that already puts 'em in an entirely new category because if you look at the statistics, super founders, which are founders that have built a company to 10 million in revenue or more, or built a company that was acquired for $10 million or more are six times more likely to create a unicorn than first time founders. And one of the big reasons for that is that super founders having been through it, know how to not make avoidable mistakes. Everybody's gonna make mistakes. Every single startup founder has to make mistakes because what they're doing is so hard. The difference is are you making avoidable mistakes or are you making only the unavoidable mistakes?

00:06:42 · S1Play from here

And super founders tend to, because they've been through it, not make the avoidable mistakes, which drastically increases they're odd success. Now in their case , it's not just that they're also complete subject matter experts when it comes to cybersecurity because even after they get acquired by Microsoft, they work there for five years and they work on the cloud team. And so they're looking at things that are related to cloud, things that are related to security. And now at this point, by the time that they go out and they start whiz in 2020, they've been doing that for eight years and they've seen both sides. They've seen the startup side, they've sold into several different companies, then they saw the Microsoft side and they sold to enterprises, spoke with CISOs and CTOs of many different enterprise companies. So they understood the space, they understood the problem , they understood the customers. It's honestly impossible to overestimate just how important a team is. And what comes to mind to me is this quote I heard literally just the other day by this guy, David Ogilvy, which says , if each of us hires people who are smaller than we are, we shall become a company of dwarfs. But if each of us hires people who are bigger than we are, we shall become a company of giants. And if you start with a founding team that is so strong already and then you just keep the bar there or try and move it up with each hire, you end up with a team that can execute flawlessly. And that's what they did. 'cause the last thing is insane discipline. Even though these guys had been in the cybersecurity space for eight years, even though they knew things inside and out when they started working on Wiz, they didn't just go into it and start building, they still did customer discovery and the best type of customer discovery. They went in, they did assessment with customers, they used the existing tools in existing environments and they found actual issues. And the CTO in an interview talks about how he found like this virtual machine that was running a server that had access to an external ID and how that presented an end to end risk. And what he realized was that there was no solution because they were all siloed that actually understood that end-to-end risk and that could prioritize so that teams could address that entire end-to-end risk.

00:08:35 · S1Play from here

And that was almost like the aha moment. But that to me is part of insane discipline because it takes discipline to have been in an industry for eight years and still go to first principles and still try to identify core problems instead of just assuming that you know what a solution might look like. The other thing, they started by solving these things manually and presented a pitch deck to customers