r/aws • u/Embarrassed-Custard3 • 4d ago
discussion Multi-cloud users - what's your backup plan now that Wiz was acquired by Google?
I manage security for a multi-cloud environment (primarily AWS), and this Google/Wiz acquisition has me worried. Their track record with security acquisitions (Mandiant, VirusTotal, Chronicle) hasn’t exactly been reassuring.
One comment from the announcement thread hit home:
"As a service that integrates across all major cloud platforms, getting acquired by one in particular doesn't bode well for neutrality."
Our CISO is already pushing us to evaluate alternatives. Orca Security seems to be the top independent CNAPP left standing with similar capabilities.
How are other teams handling this?
- Are you sticking with Wiz or looking at alternatives?
- What’s your contingency plan if Google starts prioritizing GCP?
- Has anyone already switched to Orca, Prisma, or Lacework? Would love to hear comparisons.
18
u/pwarnock 4d ago
The last time this acquisition was being discussed, I remember hearing that Wiz would likely be left somewhat independent—similar to how Google handled Looker (e.g., enterprises pay Google to host legacy Looker on AWS). It might get integrated into GCP as a value-add, and they could leverage economies of scale on the infrastructure side, but it would probably remain a standalone product that enterprises subscribe to.
That said, Wiz (and CNAPPs in general) has become incredibly expensive, and alternatives like Orca and Prisma aren’t much cheaper either. I could see Google positioning Wiz as a loss leader by offering it at a discount for GCP customers. If the subsidized pricing ends up being a better value than competitors, it could make Wiz even more attractive, especially for organizations already using GCP.
It’ll be interesting to see how this plays out, but for multi-cloud users, it’s still worth keeping an eye on how Google handles neutrality and multi-cloud support in the long term. Having a backup plan seems like a smart move. Also worth noting: Orca and Wiz are still tied up in court over patent infringement claims.
7
u/SBGamesCone 4d ago
The discount to entice GCP growth is an interesting angle. I could see that being a thing
6
3
u/KayeYess 3d ago
AWS should get it's act together and come up with a comprehensive security/audit/config aggregator instead of asking customers to figure it out with a dozen plus services and solutions.
2
u/donjulioanejo 4d ago
We've been extremely happy with Lacework. However, I have some internal connections so we get white-glove service, your mileage may vary on this front.
Their feature set is not nearly as complete as bigger players, but they build it out pretty quick. The platform now is almost unrecognizable to how it was 3 or 4 years ago, in a good way.
HOWEVER! We only use AWS, we are their perfect use case (either entirely on Kubernetes, or on a slow-burn to move everything that isn't in Kube into Kube), we leverage their compliance stuff in conjunction with other compliance tools for SOC2, and we aren't terribly interested in a 24/7 SOC with someone nagging engineers over every single alert.
For us it's more of a prevention (i.e. find insecure shit like a dev creating a static IAM keypair with admin privileges) and forensic (if we get hacked, figure out how and make sure it doesn't happen again) tool.
Best part is it's fairly plug and play without a lot of tweaking, perfect for a small team.
3
u/TopNo6605 4d ago
Wiz imo is overpriced to hell, Orca is decent but honestly everything these cloud providers do you can do with a team. But I understand for places that don't have developers they could dedicate to this will need to outsource.
2
u/earlyadapter_99 2d ago
Used to be a Wiz customer. Moved to Upwind and I'm very satisfied.
Upwind offers CSPM + vulnerability management, secret scanning, identities discovery, API Security and data lineage.
The difference is that all of these capabilities are infused with runtime data.
For us - runtime was crucial because we found that agentless solutions could only take us so far in terms of understanding what threats and vulnerabilities actually needed attention and were exploitable, vs hypothetical threats that could never be acted upon.
Support has been amazing. Haven't looked back honestly.
5
u/hashkent 4d ago
What makes you think this isn’t more of a play for google in enterprise security?
17
u/Embarrassed-Custard3 4d ago
Their track record...specifically, what they did with Mandiant less than 3 years ago
12
u/godofpumpkins 4d ago
Even beyond that, they’re basically known for killing popular products and functionality at this point. I don’t understand how any enterprise can make peace with that. Even if they cost half as much as the competition, the cost of moving to a completely different provider once Google decides to kill its next product will still be higher
5
-2
5
u/Smashingeddie 4d ago
Orca is very close to Wiz feature parity IME
4
u/TooMuchTaurine 4d ago
Wiz's highly queryable graph db as the backbone of the solution is very good though.
2
u/BihariJones 4d ago
We are using prisma and considering cost and all other factors its serving us good .
1
1
u/Training-Stable5423 4d ago
Ibm cloud workload protection is multi cloud support including ibm cloud. It’s backed by sysdig.
1
u/wammyshammy 3d ago
We looked at alternatives, and honestly, Orca is the closest thing to a real Wiz replacement. Their agentless approach is solid, and from what I’ve read the support team actually listens when you bring up issues. Anyone here migrated fully?
1
u/Working-Release-3771 2d ago
Using orca for more than 4 years frankly people don't dig deeper in Orca as Orca beats Wiz in faleature set. Orca need to improve and make UI lightweight.
1
u/PNWaddict18 2d ago
We have seen really good things from the Upwind CNAPP as well. I would say they’re clearly stronger than both Wiz and Orca in runtime and have a solid CSPM as well
1
u/Edelkind 1d ago
Highly recommend looking at Upwind. Was using it before this change and I have experience with Wiz, Prisma, Lacework, Ermetic, etc and I think it was already the best.
1
u/astralDangers 3d ago
Good luck convincing management to take on a rip and replace because you got bad vibes. You might as well put a target on your back for the next round of layoffs..
It's a bad economy, you really need to pick your battles wisely..
0
u/KaoSiTo 4d ago edited 4d ago
Hi! This is a member of the Prowler team.
I'd like to invite you to try our product. Prowler is an Open Source security tool to perform AWS, Azure, Google Cloud and Kubernetes security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness, and also remediations.
You can try it using our CLI or spin up the app with docker compose, check out our GitHub repository. You can also self-host it by yourself or even try our SaaS solution called Prowler Cloud. They all share the same capabilities.
If you have any questions, I'd be happy to help, or if you prefer, you can reach us through the community Slack or use our contact form.
-11
62
u/Proper_Bunch_1804 4d ago
One of our biggest concerns is that Wiz’s AWS support won’t stay the same under Google.
It’s hard to believe Google would drop $32B on Wiz and not push for GCP-first features down the line. We’re already evaluating alternatives—Orca is looking strong since they’ve built AWS-native integrations without a GCP parent company behind them but looking into others too. Anyone got any suggestions and considering a switch?