Costs and pricing

How the money moves

The customer pays almost everyone: the CISO usually signs for the platform, the cloud team's commitment often pays for it, and app teams pay in time.

Enterprise deals land 15-35% below list in third-party data. One buyer-data platform, in data updated in February 2026, puts the average saving on Wiz at about 22% and the median contract at about $154,000 a year.

How companies of different sizes use it

Survey data by company size is thin, so the bands and spend figures below are my rough estimates, built from buyer data, list prices and budget surveys.

A startup (under 50 people) usually runs on one cloud, most often AWS, with a handful of accounts. It turns on the cloud's own tools, GuardDuty and Security Hub on AWS or the free posture tiers at Microsoft and Google, and its startup credits pay for them. Those credits can't be spent on marketplace software, so a platform like Wiz would be paid in cash, and most startups wait. What they do buy is a per-developer code scanner such as Snyk and, once SOC 2 comes up, a compliance automation tool. The CTO or a founding engineer owns security part-time. My rough estimate is under $30,000 a year on cloud security tools. The push to the next step is a big customer's first security questionnaire and the credits running out.

A scale-up (about 50 to 500 people) is still mostly on one cloud, with hundreds of workloads, usually on Kubernetes. The credits are gone and there's rarely a cloud commitment yet, so security becomes a visible bill. The company's first security hire (often a head of security reporting to the CTO) inherits a pile of native findings and either buys a platform such as Wiz or Orca at the small end of their pricing or adds a code scanner and a managed detection service to the native tools. AWS's Security Hub Extended also lets a company this size buy partners such as Upwind on the AWS bill with no long-term contract. My rough estimate is $40,000-200,000 a year. What pushes it on is another compliance framework, another cloud, a serious incident or more findings than one person can sort by hand.

A mid-market company (about 500 to 2,000 people) often runs on more than one cloud with a few thousand workloads. Its first CISO leads a small team while the platform team owns the accounts. The inventory software company from the start of this guide is about this size. A CNAPP platform is the norm here, bought against native tools that are already on, plus code scanning and often a managed security provider. This is also where committed-spend deals with the clouds usually begin, which changes how the platform gets bought (more below). I'd put cloud security tools at roughly $100,000-400,000 a year, and my rough estimate is that the engineers' time to fix what the platform finds costs more than the licence. Preparing for an IPO, acquisitions that add clouds, or board questions after a peer's breach push it to the next step.

An enterprise (roughly 2,000 to 10,000 people) runs several clouds with hundreds of accounts. It usually has a CNAPP platform, the native tools on every cloud and point tools inherited from acquisitions, and often buys cloud security inside a bigger security deal, such as Palo Alto's Cortex Cloud or a CrowdStrike Falcon Flex credit pool. The CISO owns the platform line and the vendor choice, a cloud security team runs it, and a cloud platform team owns the accounts and the commitment. My rough estimate is $300,000-1.5 million a year, a small slice of the whole security budget. At this size, consolidation, how the commitment gets spent and who fixes the findings matter more than the licence price. Regulation (NYDFS, DORA, FedRAMP), another cloud and big acquisitions push it further.

A Fortune 500 company (revenue above about $7.5 billion) runs everything at once: all the big clouds plus its own data centers, thousands of accounts, often more than one CNAPP platform after acquisitions, native tools, security suites and home-grown policy code. The CISO reports to the board, a cloud security organization runs the tools, and procurement and FinOps own the cloud commitments and the marketplace route. My rough estimate is $1-5 million or more a year, partly paid through marketplaces against those commitments. There's no next size up; the pressure comes from regulators, whose rules get stricter for the biggest firms, and from the board.

The cloud commitment. Startups have credits instead of a commitment, and since credits only buy the cloud's own services, they tilt startups toward native tools. Scale-ups usually sit below the point where a committed-spend deal makes sense, which outside advisers put at roughly $1-2 million a year of cloud spend, so the marketplace is just a convenient way to pay. Mid-market companies cross that line, and nearly every enterprise and Fortune 500 company has a commitment, worth tens of millions a year at the largest. From then on, a security tool bought through the cloud's marketplace can count toward money already promised to the cloud, while native tools such as GuardDuty count in full as ordinary usage. For a company heading for a shortfall, a platform deal bought that way costs close to nothing at the margin, and I suspect that's often why a deal closes in a particular quarter. How much of a commitment marketplace purchases may fill is negotiated; advisers quote different caps, and no cloud publishes one.

Wiz runs on AWS and holds AWS's "Deployed on AWS" badge, so Google's largest security asset draws down its rival's commitments.