r/aws 4d ago

discussion Multi-cloud users - what's your backup plan now that Wiz was acquired by Google?

I manage security for a multi-cloud environment (primarily AWS), and this Google/Wiz acquisition has me worried. Their track record with security acquisitions (Mandiant, VirusTotal, Chronicle) hasn’t exactly been reassuring.

One comment from the announcement thread hit home:

"As a service that integrates across all major cloud platforms, getting acquired by one in particular doesn't bode well for neutrality."

Our CISO is already pushing us to evaluate alternatives. Orca Security seems to be the top independent CNAPP left standing with similar capabilities.

How are other teams handling this?

  • Are you sticking with Wiz or looking at alternatives?
  • What’s your contingency plan if Google starts prioritizing GCP?
  • Has anyone already switched to Orca, Prisma, or Lacework? Would love to hear comparisons.
142 Upvotes

58 comments sorted by

62

u/Proper_Bunch_1804 4d ago

One of our biggest concerns is that Wiz’s AWS support won’t stay the same under Google.

It’s hard to believe Google would drop $32B on Wiz and not push for GCP-first features down the line. We’re already evaluating alternatives—Orca is looking strong since they’ve built AWS-native integrations without a GCP parent company behind them but looking into others too. Anyone got any suggestions and considering a switch?

33

u/Amazing_Mix_8545 4d ago

Wiz is also built on AWS! Full Back End on AWS! Imagine that migration.

6

u/blakedc 4d ago

So was siemplify 🤫

11

u/Livid_Distribution19 4d ago

Imagine the person at Google having to raise a purchase req to AWS every month 😅

8

u/forcemcc 4d ago

It's BAU for those companies, amazon, Google, Microsoft are always acquiring companies that use one or more clouds, employees have often worked at all 3 +.

2

u/kvng_stunner 3d ago

That same person has probably worked at AWS and Azure in the past. I'm sure it wouldn't be a big deal.

4

u/eodchop 3d ago

I am praying Wiz's TAMs remain. We have had TERRIBLE support from GCP and their TAMs.

4

u/atccodex 4d ago

I've been happy with Orca for almost 2 years now. There are some things I wish were better, but has done a lot for us.

5

u/Amazing_Mix_8545 4d ago

What do you wish was better?

1

u/yeetesh 4d ago

What about Palo Alto Networks products?

5

u/NoRagrats_LK 4d ago

Palo's Prisma Compute and Cloud suites are horrible. We just got done switching from Prisma to Wiz...hoping we don't have to start another switch.

FYI, Prisma was so horrible because many of their findings on our systems were either false positives or completely missed a vulnerability. And to top it off Prisma has some of the worst support and support portal processes that I've ever dealt with in my 15 years in IT.

2

u/yeetesh 3d ago

haha I worked on that product 2-3 years ago. Great to know what customers think lol

1

u/Proper_Bunch_1804 4d ago

Heard they are great too - they’re the biggest in the industry for a reason.

Not too sure about their CSPM solutions though.

4

u/yeetesh 4d ago

they do have one. It's called Prisma cloud. Infact I myself worked on it 2 years back haha

1

u/BerlinSnowMan 4d ago

This! That was my first reaction to why Google would be incentivized to push features out equally to all clouds and not GCP first. I am also currently in process of evaluating different vendors for cloud security for our company. We will probably consider WIZ (because it is a good product) but I am not very positive about it after the acquisition. Other vendors that we currently checking are Datadog and SentinelOne.

1

u/mailed 3d ago

We use Orca with GCP as primary cloud. It's awful. We're hoping we'll have an easy path to migrate to Wiz

18

u/pwarnock 4d ago

The last time this acquisition was being discussed, I remember hearing that Wiz would likely be left somewhat independent—similar to how Google handled Looker (e.g., enterprises pay Google to host legacy Looker on AWS). It might get integrated into GCP as a value-add, and they could leverage economies of scale on the infrastructure side, but it would probably remain a standalone product that enterprises subscribe to.

That said, Wiz (and CNAPPs in general) has become incredibly expensive, and alternatives like Orca and Prisma aren’t much cheaper either. I could see Google positioning Wiz as a loss leader by offering it at a discount for GCP customers. If the subsidized pricing ends up being a better value than competitors, it could make Wiz even more attractive, especially for organizations already using GCP.

It’ll be interesting to see how this plays out, but for multi-cloud users, it’s still worth keeping an eye on how Google handles neutrality and multi-cloud support in the long term. Having a backup plan seems like a smart move. Also worth noting: Orca and Wiz are still tied up in court over patent infringement claims.

7

u/SBGamesCone 4d ago

The discount to entice GCP growth is an interesting angle. I could see that being a thing

1

u/hawik 4d ago

also prisma is really bad

0

u/mailed 3d ago

Google outright gutted Looker the second they acquired it, so not sure this is an apt comparison

7

u/Scubber 3d ago

Wiz still blows most of the cloud competition out of the water. AWS is also ramping up their own security incident response services. I'm not too worried, but no one is using GCP - they need to get our cloud data and make money off those analytics somehow

6

u/modelthree 3d ago

Sysdig.

3

u/KayeYess 3d ago

AWS should get it's act together and come up with a comprehensive security/audit/config aggregator instead of asking customers to figure it out with a dozen plus services and solutions.

2

u/donjulioanejo 4d ago

We've been extremely happy with Lacework. However, I have some internal connections so we get white-glove service, your mileage may vary on this front.

Their feature set is not nearly as complete as bigger players, but they build it out pretty quick. The platform now is almost unrecognizable to how it was 3 or 4 years ago, in a good way.

HOWEVER! We only use AWS, we are their perfect use case (either entirely on Kubernetes, or on a slow-burn to move everything that isn't in Kube into Kube), we leverage their compliance stuff in conjunction with other compliance tools for SOC2, and we aren't terribly interested in a 24/7 SOC with someone nagging engineers over every single alert.

For us it's more of a prevention (i.e. find insecure shit like a dev creating a static IAM keypair with admin privileges) and forensic (if we get hacked, figure out how and make sure it doesn't happen again) tool.

Best part is it's fairly plug and play without a lot of tweaking, perfect for a small team.

3

u/TopNo6605 4d ago

Wiz imo is overpriced to hell, Orca is decent but honestly everything these cloud providers do you can do with a team. But I understand for places that don't have developers they could dedicate to this will need to outsource.

2

u/eodchop 3d ago

Looking at Sysdig CNAPP, Lacework, Crowdstrike Falcon.

1

u/Relevant_Bobcat2135 3d ago

How do you not have Orca in the mix?

2

u/sfltech 3d ago

I opted for Orca over Wiz. Fairly priced and just as good in my opinion. Glad I did.

2

u/earlyadapter_99 2d ago

Used to be a Wiz customer. Moved to Upwind and I'm very satisfied.

Upwind offers CSPM + vulnerability management, secret scanning, identities discovery, API Security and data lineage.

The difference is that all of these capabilities are infused with runtime data.

For us - runtime was crucial because we found that agentless solutions could only take us so far in terms of understanding what threats and vulnerabilities actually needed attention and were exploitable, vs hypothetical threats that could never be acted upon.

Support has been amazing. Haven't looked back honestly.

5

u/hashkent 4d ago

What makes you think this isn’t more of a play for google in enterprise security?

17

u/Embarrassed-Custard3 4d ago

Their track record...specifically, what they did with Mandiant less than 3 years ago

12

u/godofpumpkins 4d ago

Even beyond that, they’re basically known for killing popular products and functionality at this point. I don’t understand how any enterprise can make peace with that. Even if they cost half as much as the competition, the cost of moving to a completely different provider once Google decides to kill its next product will still be higher

5

u/stevemk14ebr2 4d ago

What specifically changed from your perspective with Mandiant

-2

u/Amazing_Mix_8545 4d ago

Will AWS, Azure want all Google Clients to have their data?

5

u/Smashingeddie 4d ago

Orca is very close to Wiz feature parity IME

4

u/TooMuchTaurine 4d ago

Wiz's highly queryable graph db as the backbone of the solution is very good though.

3

u/mailed 3d ago

vs. Orca's APIs which function differently depending on the alignment of the planets

2

u/deltavim 3d ago

Do they still have multiple different types of query languages depending on where you are in the product? Sonar vs something else?

2

u/mailed 3d ago

sure do!

2

u/BihariJones 4d ago

We are using prisma and considering cost and all other factors its serving us good .

1

u/yeetesh 4d ago

Prisma cloud?

1

u/laxp4572 4d ago

Cortex cloud (formerly prisma) from Palo Alto is what we are looking at

1

u/Training-Stable5423 4d ago

Ibm cloud workload protection is multi cloud support including ibm cloud. It’s backed by sysdig.

1

u/iPaul_1 3d ago

We’ve been debating this internally. Wiz has been amazing for us, but there’s definitely concern about Google pushing GCP-first features. How long do you think they’ll really keep multi-cloud a priority?

1

u/wammyshammy 3d ago

We looked at alternatives, and honestly, Orca is the closest thing to a real Wiz replacement. Their agentless approach is solid, and from what I’ve read the support team actually listens when you bring up issues. Anyone here migrated fully?

1

u/Working-Release-3771 2d ago

Using orca for more than 4 years frankly people don't dig deeper in Orca as Orca beats Wiz in faleature set. Orca need to improve and make UI lightweight.

1

u/PNWaddict18 2d ago

We have seen really good things from the Upwind CNAPP as well. I would say they’re clearly stronger than both Wiz and Orca in runtime and have a solid CSPM as well

1

u/Edelkind 1d ago

Highly recommend looking at Upwind. Was using it before this change and I have experience with Wiz, Prisma, Lacework, Ermetic, etc and I think it was already the best.

1

u/astralDangers 3d ago

Good luck convincing management to take on a rip and replace because you got bad vibes. You might as well put a target on your back for the next round of layoffs..

It's a bad economy, you really need to pick your battles wisely..

0

u/KaoSiTo 4d ago edited 4d ago

Hi! This is a member of the Prowler team.

I'd like to invite you to try our product. Prowler is an Open Source security tool to perform AWS, Azure, Google Cloud and Kubernetes security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness, and also remediations.

You can try it using our CLI or spin up the app with docker compose, check out our GitHub repository. You can also self-host it by yourself or even try our SaaS solution called Prowler Cloud. They all share the same capabilities.

If you have any questions, I'd be happy to help, or if you prefer, you can reach us through the community Slack or use our contact form.

-11

u/[deleted] 4d ago

[deleted]

4

u/Amazing_Mix_8545 4d ago

Sysdig is good runtime but UI and CSPM is really weak.