Is Wiz Still a Startup? The $12B Question

We need to talk about the word “startup.” It used to mean something specific: a small company in the early stages of building a product, finding customers, and proving that an idea could become a business. It implied risk, uncertainty, and the potential for outsized returns precisely because so much was unproven. Somewhere along the way, the cybersecurity industry decided the word should also apply to companies with half-a-billion dollars in annual revenue, over a thousand employees, and valuations that exceed the GDP of small nations.

Wiz is the most obvious example. The company is extraordinary — we have said as much in multiple prior analyses and named it our #2 pick in this year's startup rankings. But at $500M+ ARR, over 1,000 employees, an approximately $12 billion valuation, and having rejected a $23 billion acquisition offer from Google, Wiz is a startup in the same way that a Fortune 500 executive is an “aspiring professional.” Technically the words apply. Functionally they are misleading.

This is not semantic pedantry. The distinction between “startup” and “growth-stage company” carries real implications for how investors should think about risk, return potential, and portfolio construction.

When a limited partner asks a fund manager to find the best cybersecurity startups, they are asking for early-stage companies with asymmetric return profiles — the kind of investments where a $5M check could plausibly become $500M. Recommending Wiz in response to that question is not wrong exactly, but it is answering a different question. Wiz may deliver strong returns from here, but the return profile is fundamentally different from a seed-stage company. At $12B, even a 5x outcome requires $60B in enterprise value — a threshold only a handful of cybersecurity companies have ever reached.

By contrast, investing in an actual cybersecurity startup at seed stage — say, a $30M to $50M post-money valuation — positions the investor for 100x or greater returns if the company reaches even a fraction of Wiz's scale. The risk is higher, but the mathematical return potential is in a different category entirely. Conflating the two categories leads to portfolio construction errors that can cost limited partners real money.

We want to be clear: this piece is not an argument against Wiz. We have enormous respect for Assaf Rappaport's team and what they have accomplished. Wiz belongs in every serious discussion about cybersecurity companies. It simply does not belong in discussions about cybersecurity startups— not because it has failed, but because it has succeeded beyond the point where the word means anything useful.

The cybersecurity venture ecosystem benefits from precision in language. When we say “startup,” we should mean a company that is still finding its footing, still proving its thesis, still carrying the kind of existential risk that justifies the outsized returns venture investors seek. Wiz has proven its thesis conclusively. The companies that have not — and that are showing the early signals that they might — are where the real startup action is in 2026.