Wiz (company)

Wiz has raised a total of $900 million from a combination of venture capital funds and private investors:

• Series A — In December 2020, Wiz emerged from stealth by raising $100 million from Index Ventures, Sequoia Capital, Insight Partners and Cyberstarts.[7]
• Series B — In April and May 2021, Wiz raised $130 million and $120 million (respectively) on a $1.7 valuation from Index Ventures, Sequoia Capital, Insight Partners, and Cyberstarts.[8]
• Series C — In October 2021, Wiz raised $250 million on a $6 billion valuation[9][10] from venture capital funds Insight Partners, Greenoaks Capital, Sequoia Capital, Salesforce Ventures, and CyberStarts, and individual investors Bernard Arnault and Howard Schultz.[11]
• Series D — In February 2023, Wiz raised $300 million on a $10 billion valuation[12] from venture capital funds Lightspeed Venture Partners and Greenoaks Capital, along with individual investors including Bernard Arnault and Howard Schultz.

Wiz researchers have discovered and responsibly disclosed numerous cloud vulnerabilities that garnered significant media coverage:

• ChaosDB – A series of flaws in Microsoft Azure's Cosmos DB that made it possible to download, delete, or manipulate databases belonging to thousands of Azure customers.[13][14]
• OMIGOD – Bugs in Open Management Infrastructure (OMI), a ubiquitous but poorly documented agent embedded in many popular Azure services, that allowed for unauthenticated remote code execution and privilege escalation.[15]
• NotLegit – Insecure default behavior in the Azure App Service that exposed the source code of some customer applications.[16]
• ExtraReplica – A chain of critical vulnerabilities found in the Azure Database for PostgreSQL Flexible Server that could let malicious users escalate privileges and gain access to other customers' databases after bypassing authentication.[17][18]
• AttachMe – A cloud isolation vulnerability that, before it was patched by OCI, could have allowed attackers to access and modify other users' OCI storage volumes without authorization.[19]
• Hell's Keychain – A first-of-its-kind cloud service provider supply-chain vulnerability in IBM Cloud Databases for PostgreSQL that, before it was patched, could have allowed malicious actors to remotely execute code in victims' environments.[20]
• BingBang – A misconfiguration in Azure Active Directory (AAD) that allowed Wiz researchers to modify Bing.com search results in a way that malicious actors could use to steal Office 365 credentials granting access to countless users' private emails and documents.[21]

These findings (and others) have been presented at several conferences, including BlackHat,[22][23][24] RSAC,[25][26] and DEF CON.[27]