Part IThe Story
At four o'clock in the morning, in the last days of July 2024, Assaf Rappaport was awake and composing his own caption. By his own account, the papers for the largest acquisition in Google's history were drafted and ready to sign. The price was $23 billion for Wiz, the cloud security company he and three friends had started during a pandemic lockdown about four and a half years earlier. That was roughly double the $12 billion valuation investors had put on it that May. He and his partners had decided, at the last possible moment, not to sign. "We had a gut feeling it was too soon," he would say two years later on Israeli public television, sounding like a man still slightly amazed at what he had done. "I felt like a fool at 4:00 a.m." He could picture the label floating over his head as he walked into every room for the rest of his career: Here's the fool who could have sold for $23 billion but is now worth $8 billion.
The number in that caption gives him away. He did not pick $12 billion, the last price anyone had actually paid for Wiz stock. He picked $8 billion, a markdown he had already worked out in advance: what his pride might cost once the IPO window shut and public investors got to vote. Only someone who has spent a lifetime anticipating other people's disappointment would bother to calculate that figure.
Then he picked up the phone and called Sundar Pichai, which was the strangest part, because the whole affair had started with Rappaport not answering. Four months earlier, the chief executive of Alphabet had written to him directly, and the email had gone unread.
What follows is mostly an account of the people who sat next to him: on buses, in lecture halls, at a gas station on the coastal highway, in a private hotel room in New York. It is about a country that produced him and then, in July 2024, briefly tried to fold his company into its budget. It is about a man worth more than $3 billion who still, as far as the public record shows, does not own a car. And it is about the difference between being unreachable and being approachable, which in Rappaport's case is a smaller distance than it sounds.
By the Numbers
Wiz and the Man Who Built It
$32BGoogle's all-cash price for Wiz, the largest acquisition in Google's history (closed March 11, 2026)
$23BGoogle's first offer, declined in July 2024
18 monthsTime for Wiz to go from $1M to $100M in annual recurring revenue
45%Share of the Fortune 100 using Wiz by 2024
$320MMicrosoft's 2015 price for Adallom, the founders' first company
~10%Rappaport's estimated stake in Wiz, worth over $3B before taxes
July 2001When the four co-founders met, on a bus to the IDF induction center
The One Who Doesn't Answer
Pichai's email arrived in March 2024. It sat unanswered for two months. Fortune later made a point of saying this was not a negotiating tactic: Rappaport had simply never seen it. He was flying between New York, where Wiz kept its headquarters, and Tel Aviv, where most of its engineers worked. The company had just reported $350 million in annual recurring revenue and a $10 billion valuation, reportedly the fastest any software-as-a-service company had reached that mark. "In other words," the magazine wrote, "the guy was busy." In May, at a cybersecurity conference in San Francisco, a contact close to both companies took him aside and suggested he check his inbox.
So the head of one of the most valuable companies on earth needed an intermediary to get Rappaport's attention.
People who knew him at eighteen would not have been surprised. In 2024, Rappaport sat down with the documentary filmmaker Harry Spitzer for a Sequoia Capital profile and described his place in his family with what Spitzer called "characteristic middle-child-of-five wryness."
— Assaf Rappaport, to Sequoia Capital, October 2024I'm the one that everybody was generally upset with, not answering the phone, not being available, not being there. So the disappointment, that's my role.
The household itself is harder to pin down. Sequoia's profile calls him the middle of five. A Calcalist profile published on the day the Google deal was announced calls him an only child, raised by his mother, Tzipi, after his parents separated when he was young. Neither account addresses the other. Whatever the exact count of siblings, the person who keeps reappearing in the reporting is Tzipi: practical, unimpressed by titles, and later the owner of a new apartment that her son, still a renter, bought for her.
His habit of being absent had one officially excused episode. The summer after he finished high school, Rappaport was selected for Talpiot, the Israel Defense Forces program that takes the country's strongest math and science students, combines university study with military technology training, and sends graduates into the units that matter most. He was surprised to be chosen. "I always felt like my admission was by mistake," he told Spitzer. "I always had imposter syndrome." The program's schedule meant he arrived at the Hebrew University of Jerusalem a full week after classes started, too late for the day when students set their curricula.
He handled it the way he would later handle much bigger decisions: he looked for a friend. "When I arrived on campus I found Yinon and I told him, 'I'm just going to join your classes for the day.'" Yinon Costica had chosen computer science, so Rappaport did too. He went on to earn a bachelor's degree in computer science, physics, and mathematics, and later a master's in computer science from the Technion, supervised by Professor Danny Raz.
His field of study, in other words, was settled by where a friend happened to be sitting. That pattern holds for much of the rest of his career.
The Most Clichéd Story in Israel
In April 2021, a year after founding Wiz, Rappaport wrote an essay for the Israeli financial daily Calcalist listing seven lessons from reaching a $1.7 billion valuation. The first was that the team matters more than the idea. To make the point, he opened by mocking himself:
"I'm the entrepreneur with the most cliche story in Israel: A Tel Avivian; graduate of Talpiot (an elite Israel Defense Forces training program); alumnus of Unit 8200 (the IDF's renowned intelligence-gathering unit) and of Unit 81 (a Military Intelligence technology unit that's even more secretive and selective than Unit 8200); and a former consultant for McKinsey."
The self-mockery is sincere, but the list is also a map of a national machine. Israel identifies its most gifted teenagers, puts them through classified technical work at an age when their peers abroad are choosing dormitories, and returns them to civilian life with security clearances, close-knit networks, and expertise that has a market value. Rappaport completed Talpiot, served in Unit 81, and finished as a captain in 8200. He was an excellent product of a system he would later argue with in public.
The friendships started before any of that, on a bus. "We are a team that met on a bus to the IDF Induction Center in July 2001," Costica said in March 2025, "and we have been working together ever since." The four were Rappaport, Costica, Ami Luttwak, and Roy Reznik. They met again at Hebrew University in the fall of 2002, and Spitzer's account says they quickly became inseparable. Spitzer describes them as "the kind of friends who constantly pushed each other in new, challenging directions but in a way that felt expansive—and fun."
Each of the four is worth a short sketch, because the company was built around how they fit together.
Costica is the product mind. Shardul Shah of Index Ventures, who has backed the group since 2012, has called him "among the top 5 minds in product that I have ever come across." His first principle, as Shah describes it, is to make a promise to customers and then build a product that keeps it. In an industry Shah describes as full of "snake oil," Costica's distinguishing trait is a kind of commercial honesty.
Luttwak, the chief technology officer, went to Hebrew University and earned a master's at its Benin School of Engineering and Computer Science. He states the group's ambition more plainly than anyone else. "If you really are going to win, you have to assume you're going to win," he told Index. "You have to build with the expectation that you're going to win." He also explained why the four seldom need meetings: "Whether you need a great motivator, a great project manager, a great engineer—or if you need someone who can tell a story, who's good with investors, who understands customers—we're very efficient and can accomplish a lot without really needing to talk."
Reznik ran research and development. The public record says the least about him of the four, which in a small group of friends is a role in its own right.
Rappaport was the one who told the story, dealt with investors, and, on a famous occasion, failed to show up for them.
After the army he went to McKinsey. "I joined McKinsey straight out of the army, with a strong tech toolkit but little understanding of the private sector and the forces that drive it," he said in 2025, when the firm marked its centennial and its Israeli office turned twenty-five. "Very quickly, I realized it was the best possible business school—one that exposes you, right from the start, to the issues and challenges occupying the minds of top CEOs. I worked on projects in Australia and saw firsthand how global companies operate." The posting matters less than what he took from it: the young officer learned how large organizations think, and he would spend the next fifteen years selling to them.
"I think part of the magic of the relationship is how different we all are," Rappaport said of his co-founders in 2023. "Each co-founder has a distinct personality. It allows us to bring out the best in each other."
Sixteen Partners and a Gas Station
The first company was founded either in 2012, according to most accounts, or in 2013, according to Rappaport's own essay. Even the founders' list varies by source. Rappaport names all four friends. Some later reference works list only two of them alongside him. What everyone agrees on is how unusual the starting point was. "We started without an idea or a direction," Rappaport wrote, "but we decided to commit ourselves to the project for a year."
They began with a group of people and a deadline. The product came later. The company became Adallom, a cloud access security broker that protected data stored in software-as-a-service applications, which was then a new and largely unprotected category.
They were also determined to keep it to themselves. "It was very important to us that the company would be ours," Rappaport wrote. "We were wary of bringing in partners who might take over the startup, like venture capital funds." He later recognized how naive this was: "We had no idea that the more we would try to avoid them the more interested they would become."
That brings in Gili Raanan, then a general partner at Sequoia Capital. His own record reads like a version of the same national story. He served in 8200 and won the Israel Defense Prize in 1996. He is widely credited with inventing the CAPTCHA and helped build the first web application firewall. He built two enterprise software companies that were sold to EMC and IBM. He joined Sequoia in 2009, and in 2018 he left to found Cyberstarts, a fund that invests only in cybersecurity. He has since said he never asks founders about their technology or product. He asks about their mothers and their childhoods, looking for evidence of real hardship overcome.
Rappaport avoided him. "His phone number was not in my contacts and one time I answered by mistake, and there he was, on the line." Raanan asked for a meeting. Rappaport offered one "in a few more months." Raanan insisted on a specific time and place, and they agreed on a date a few days out.
"I just stood him up," Rappaport wrote. "That's how arrogant and inexperienced I was. It's not something I'm proud of."
Raanan was not offended and kept at it. He talked the founders into an introductory meeting, which Rappaport describes as an ambush. He expected one person. Sixteen partners from Sequoia's American and Israeli offices were in the room, including the managing partner Doug Leone, whom Rappaport notes has been called "the godfather of Silicon Valley." Rappaport presented the team and deliberately left out the business plan, the amount they wanted to raise, and what they would do with it. "Looking back, I acted like an idiot, because the things I ignored were the things they were most interested in."
Sequoia offered $5 million the next day. The founders asked for the weekend to think. Raanan insisted on breakfast that Friday at a gas station between Tel Aviv and Moshav Michmoret, a spot on the coastal road he chose so he would not have to drive all the way down. The Jerusalem Post would later refer to the founders' "napkin-signed seed round," and that phrase is about all the record says of how the meeting ended.
Years later, Raanan, by then chairman of Wiz, discussed "the Wiz founder who stood him up—and why he never forgot it" on Michael Eisenberg's podcast Invested. A gas station, an unread phone number, a missed meeting: Rappaport's career keeps running into people who would not accept that he was unavailable.
Shardul Shah of Index Ventures had a similar experience. Shah started at Summit Partners after the University of Chicago, joined Index in 2008, and led early investments in Datadog and a long list of security companies. His stated investing principles are short: "It's all about the founder. Invest with extreme conviction. Go big or go home." Rappaport arrived forty-five minutes late to their first meeting. According to Index's later account, it made no difference. The meeting ran ninety minutes, Shah thought about it all weekend, and Index had a term sheet ready by Monday. What Shah says he remembers best is not the valuation but a later phone call, on his birthday, when Rappaport invited him to join the board.
"A product and a market can change," Shah said, "but extraordinary people are able to adapt and rebuild again and again."
Microsoft bought Adallom in July 2015 for about $320 million. The four friends went with it.
Life on the Mothership
Rappaport's later description of his time at Microsoft is affectionate. "I was on the mothership," he said at Fortune's Brainstorm Tech conference in 2024. "I truly, I love Microsoft. I had a great job, great impact on security."
He worked for a period in Palo Alto. He led the Cloud Security Group, which worked on security for Azure. In January 2018, at thirty-four, he was named head of Microsoft's research and development center in Israel. The post had been empty since Yoram Yaacovi stepped down in September 2017. The center was founded in 1991 and was Microsoft's first research outpost outside the United States. It employed about 1,500 people across three cities: Herzliya, north of Tel Aviv; Haifa, the northern port; and Nazareth, the largest Arab city in Israel. Rappaport was one of the youngest people ever to hold the job.
Calcalist recorded his tenure in small details. In October 2018, at the paper's annual digital conference in Tel Aviv, he talked about a cultural shift inside the company. He mentioned that when he came back from California, Microsoft had given him a Mac, which he took as a strange sign of the new Microsoft. "He soon switched back to his Surface Pro," the paper reported. He described moving staff into a WeWork building in Tel Aviv so employees could commute by electric scooter. He spoke about diversity in direct terms. Hiring women and minorities was not enough, he said; they had to be promoted. "If women are not promoted, they will not come." He noted that applications from Arab candidates rose after the Nazareth office opened. He called diversity a business necessity: varied teams build better products.
His mother focused on something else. When he got the job, one of her first questions, as Calcalist later told it, was: "Does the job come with a car?"
The paper did not record whether it did. It did record that he rode the employee shuttle to the Herzliya office every day. In 2018, an Israeli LinkedIn post that spread widely described "the youngest CEO in Israel tech" who, after selling his company for $320 million, "still lives with a roommate and rides the bus to work."
One morning on that shuttle, a young product manager named Raaz Herzberg sat down next to him. She was then working on Microsoft security products, including Azure Sentinel, and would later become Wiz's chief marketing officer. "I sat down next to him simply because there was no other seat available," she said. "He is very friendly, so we started talking."
Rappaport remembered it this way: "Raaz sat next to me. We didn't know each other, but she was full of amazing ideas about what could be improved at the company." The conversation led to an excellence program for young product managers at Microsoft Israel. After that, he said, "whenever I had doubts I would go to consult with her."
The head of a 1,500-person organization was available, every morning, to whoever took the seat next to him. That is the reverse of the unanswered phone, and both traits belong to the same man.
He also knew when the job was finished, and he made the decision in his usual informal way. "My first flight back from Redmond," he told Forbes, "I wrote on a napkin a list of what I wanted to do at Microsoft, what was important for me to accomplish. When I finished the napkin, I left the job."
Microsoft announced his departure on December 18, 2019. Its statement said he was leaving to start a new company. The other three were going with him.
Nobody Picks Up the Phone
The founding of Wiz is dated January 2020 in some records and March 2020 in others, including Rappaport's own memory. Either way, the four left in the weeks when the world was shutting down. "It felt like the most horrible decision ever," he said later. He had walked away from a job he loved and a company he called the mothership, and now he was a startup founder no one would call back.
"Nobody picks up the phone, nobody answers us," he told Fortune about the early months. For a man whose family had cast him as the one who never answered, this was a reversal.
Their first employee was Herzberg, the product manager from the shuttle, then twenty-seven. She was hired to report to Costica. During lockdown, the team's whole operation was calling security chiefs at large organizations, presenting the idea, and asking for feedback. "We gave them presentations, ten a day," she recalled. The idea at the time was a network security product. The responses were warm. "I heard on the other side of the line an American guy saying, 'It sounds great.'"
After ten days of these calls she was supposed to go to the engineers and tell them what to build. She found she could not. "I realized that I had no idea what I was asking them to build," she said. "It was frustrating because the conversations were too general, and I couldn't see what the solution was supposed to look like in detail."
She said so to the founders: she did not understand it. Her later explanation of the lesson, on Lenny Rachitsky's podcast, is simple. Polite enthusiasm is not demand. Demand looks like a buyer asking about price or asking to start a proof of value. Ynetnews later wrote that Herzberg was the one who "saved Wiz," by making clear the company "would not go far unless it significantly changed direction."
It changed direction. What came out of the change is easy to describe. Wiz connected to a customer's cloud accounts through their own APIs. It did not require installing software "agents" on every machine, which had been the industry's slow and resented norm. It mapped the customer's entire cloud environment into what the company called a Security Graph, a model of the links between resources, configurations, identities, and vulnerabilities. Then it showed which combinations of those amounted to an actual path an attacker could take. Deployment took minutes. Customers got a ranked list of real problems instead of thousands of undifferentiated alerts.
The market they entered was, by startup convention, the wrong one. When the Israeli security executive Alon Arvatz interviewed Rappaport for a book, Rappaport said Wiz had entered "a red ocean," a crowded and contested market. Arvatz was puzzled until Rappaport explained. Cloud security had existed as a category for about a decade before Wiz. Earlier vendors had already spent years teaching buyers why it mattered and getting budget lines created for it. Wiz did not have to persuade anyone that the problem existed. It only had to persuade them that its product was better. "The advantage that we had," Rappaport said, "is learning from the mistakes of the others."
On timing, he later became almost certain: "If you pinpoint a time in history, probably March 2020, that's the time to start a cloud security company." Lockdown pushed companies into the cloud faster than their security could follow. The founders who had been unable to get anyone on the phone were arriving just as the problem became urgent.
The company's name, according to one profile, is short for "Wizard."
Speed as an Argument
Wiz came out of stealth in December 2020 with a $100 million Series A from Index, Sequoia, Insight Partners, and Raanan's Cyberstarts. Forbes reported an estimated valuation of $500 million. In February 2021 it reached $1 million in annual recurring revenue. That spring it raised $130 million and then another $120 million at a $1.7 billion valuation, with Greenoaks joining the earlier investors. Rappaport wrote that it became a unicorn faster than any cybersecurity company before it.
In October 2021 it raised $250 million at $6 billion. The investors included Salesforce Ventures and two people not usually associated with cloud infrastructure: Bernard Arnault and Howard Schultz.
In August 2022 the company said it had reached $100 million in ARR about eighteen months after hitting $1 million, which it claimed was the fastest any startup had done it. Nine months later it was at $200 million. In February 2023, while much of the technology industry was cutting staff, Wiz raised $300 million at $10 billion. By that spring it had about 700 employees and offices in Israel, New York, and Denver. Its customers included Chipotle, Colgate-Palmolive, Morgan Stanley, and Snowflake. "For us, it's still an unlimited market," Rappaport told CNBC in May 2023. "The opportunity is still huge, so we can still grow in triple digits a year, and even in a downturn and potential recession." He said, with some satisfaction, that Wiz was taking business from Palo Alto Networks.
By the end of 2023 ARR was $350 million. In 2024 Wiz brought in Dali Rajic from Zscaler as president and chief operating officer. It raised $1 billion at a $12 billion valuation from investors including Andreessen Horowitz, Thrive Capital, Greylock, and Lightspeed. It began buying companies: Raftt for about $50 million in December 2023, Gem Security for about $350 million in April 2024, and Dazz for $450 million in November 2024. A planned acquisition of Lacework fell apart in due diligence in May 2024. By late 2024 Wiz reported more than $500 million in ARR, about 1,995 employees, and customers among 45 percent of the Fortune 100.
The pace was meant to make a case. Shah described Wiz's approach as "unconventional" because it rejected the standard advice for startups, which is to start narrow: one type of user, one cloud, one region. Wiz aimed at large, complicated enterprise cloud environments from the beginning, on the view that for a big customer, a pile of narrow tools is just another source of pain. The early valuations were bets that the company could carry that weight, and every step up in revenue was evidence the bets were sound.
Speed attracted criticism, too. In an August 2023 Forbes cover story, the reporter Alex Konrad wrote that some of Wiz's detractors privately compared Rappaport to another visionary Israeli founder, Adam Neumann. Even allies called Wiz's sales tactics aggressive. A rival, Orca Security, had sued. The same story included Howard Schultz's endorsement: "His superpower is that despite how confident and successful he's been at a young age, he's steeped in humility."
Both descriptions can be true of the same person. Index described him as "a self-described introvert with a quiet, unassuming nature," and then said that "behind that image is one of the most ambitious entrepreneurs of his generation." He wore jeans, sneakers, and a T-shirt to the office, sometimes napped there in the afternoon, and also told the market that the eventual owner of cloud security would be worth an enormous sum. His manner was gentle and his targets were not.
Breaking into the Old House
Wiz built much of its reputation by finding serious flaws in the cloud platforms it ran on, and a large share of those flaws were in Microsoft's.
In August 2021, Wiz researchers disclosed ChaosDB, a set of vulnerabilities in Azure's Cosmos DB that would have let an attacker download, delete, or alter databases belonging to thousands of Azure customers. The Register's headline said Wiz had "utterly pwned" the service. Next came OMIGOD, bugs in a widely used and poorly documented management agent built into many Azure services, which allowed unauthenticated remote code execution. Then NotLegit, a default setting in Azure App Service that exposed some customers' source code. Then ExtraReplica, a chain of flaws in Azure's managed PostgreSQL service that could let one customer reach into another's databases. In March 2023 came BingBang, a misconfiguration in Azure Active Directory that let Wiz's researchers change the results on Bing.com, which an attacker could have used to steal Office 365 credentials and open private email and documents.
Rappaport posted about it with obvious pride: "I'm incredibly proud of our Wiz Research team for their remarkable discovery of the #BingBang." He added that "all issues were responsibly disclosed to Microsoft upon discovery," and that Microsoft "rapidly fixed" them.
The irony is plain. The former head of Microsoft's Cloud Security Group was running a company whose researchers kept finding holes in Microsoft's cloud. There is no suggestion of malice. The research was disclosed through proper channels and the vulnerabilities were patched. Wiz also went after Oracle, with AttachMe, a flaw that could have let attackers read and modify other customers' storage volumes, and IBM, with Hell's Keychain, which the company described as a first-of-its-kind supply-chain vulnerability at a cloud provider. In January 2025, days after a Chinese AI lab had shaken the markets, Wiz found an exposed DeepSeek database containing chat histories and other sensitive data.
The point for customers was straightforward. A security company that can break into the cloud provider can protect the customer from what the provider overlooks. Rappaport had worked inside the house long enough to know where its weak spots were.
Arvatz's book interview adds another inheritance from Microsoft. During their years there, he wrote, the founders saw how Microsoft "is managing enterprise security sales on HUGE scale." They learned how to sell to large enterprises from one of the companies they would later embarrass in public, which is a lesson that rarely gets acknowledged.
Money Out of Israel
In 2023, Benjamin Netanyahu's government moved to restructure Israel's judiciary, and the country's technology sector, which had long been reluctant to take political positions, became one of the strongest centers of opposition. Rappaport took part in the protests. He then went further than most chief executives. He announced that Wiz would move its money out of Israel and keep in the country only what it needed for salaries and essential operations.
The 8200 captain and Talpiot graduate, a product of the state's elite pipeline, was voting with his balance sheet against that state's government.
Wiz's legal structure made this possible. The company was incorporated and headquartered in New York, with its engineering in Tel Aviv. "We have the privilege to be bolder in our statements," Rappaport told Konrad, as one of Israel's most valuable startups that was technically American. Distance gave him freedom to speak. Schultz, an investor who had watched this up close, said of him: "He wears his heart on his sleeve, and he loves his country."
In June 2023 Konrad joined Rappaport at Tel Aviv's Pride parade, which Rappaport attends every year. Konrad described the mood that year as "tense." Rappaport came out as gay at a young age. His long-term partner, Ophir, was an educator before moving into technology. At Wiz, Rappaport became the first chief executive in Israel to offer surrogacy grants to both same-sex and heterosexual couples. Five years earlier, on a conference stage, he had said that if women were not promoted they would not come. The surrogacy grants applied the same principle to a different question: whom a company makes room for.
Then came October 7, 2023, and the war, and everything changed. Raanan said publicly that the attack changed how he invests, and that it led him to Hapoel Tel Aviv, the football club. Wiz kept growing. As Google's acquisition moved through regulators, the country was still in conflict. In March 2025, when the deal was announced, an Israeli education writer posted that he had written his episode about Rappaport "from an anti-rocket shelter," "between sirens" and headlines about the $32 billion deal.
By May 2026, two months after closing, Rappaport was speaking more like a patriot than a protester, though he had not given up the protester's edge. At a Kibbutz Movement leadership conference at the David Dead Sea Hotel, he said that "Google should be appreciated for deciding to make its largest investment here during the most difficult time for Israel." He promised that Wiz, now an Israeli subsidiary of Google, would "maintain its Israeli DNA." He also warned that Israel was falling behind in artificial intelligence, and he named the institutions he thought could fix it, in one sentence that took a side in a political fight: "I think academia in Israel should lead the issue of artificial intelligence, and they should stop bashing universities. Cyber, the Mossad and 8200 are at the forefront."
In a single sentence he defended the universities the government had attacked and the intelligence services that had trained him. He did not treat these as contradictory loyalties, because for him they were not.
The Jerusalem Post's annual list of the fifty most influential Jews tracked his rise. In 2023 he was 20th, sharing a slot with other technology executives. In 2024 he was 33rd, again in a group. In 2025 he was 10th alongside his three co-founders. In 2026 he was listed alone at number 7.
Two Envelopes
When Rappaport finally read Pichai's email in May 2024, he went to Mountain View with Costica. The conference in San Francisco had just ended. At the Googleplex they met Thomas Kurian, who runs Google Cloud, and Pichai was there as well. Google had good reasons. Its cloud business had become an important source of growth, but large customers wanted assurance their data was safe there, and Wiz's scanner worked across Amazon, Microsoft, Oracle, and Google alike. Within a month, Google offered $23 billion.
When news of the talks came out in July, Israel treated the deal as nearly done. Avi Simhon, head of the National Economic Council, reportedly told a closed budget meeting that the purchase would close a hole in the 2025 budget and allow the government to avoid some cuts. In wartime, a country was counting a private transaction as public revenue. An Israeli news site later summed up the national mood as a moment of "addictive escapism."
On Friday, July 19, 2024, a faulty update from CrowdStrike, one of Wiz's main competitors, crashed millions of Windows machines around the world. An Israeli commentator later speculated that the outage looked to Wiz like a chance to strengthen its standing at a rival's expense. Rappaport has never cited it as a reason. His own explanation was the gut feeling, the sense that it was too soon, and his worry that "everything was moving so quickly."
Then came the decision not to sign, four in the morning, the imagined label, and the call to Pichai. Rappaport recalled that he made the call "dreading the conversation." He said Pichai responded graciously, saying he felt he had lost his right-hand man and asking how the two companies could become the best of partners from then on. "It was a style of leadership I hadn't encountered before," Rappaport said.
On July 23 he wrote to employees. "I know that last week was intense," he began, "with the 'buzz' that was created regarding a possible acquisition." Then: "Although we are flattered by the offer we received, we chose to continue our path to building Wiz." The next goals were $1 billion in ARR and an IPO. Speaking to Fortune later, he was less composed: "It is one of the toughest decisions a founder can make. We had some natural reservations, and everything was moving so quickly."
About six months later, Pichai asked him to an urgent, private breakfast in a hotel room in New York. Rappaport described what happened in September 2026 on Kan 11, Israel's public broadcaster, in his first detailed public account of the deal:
— Assaf Rappaport, on Kan 11's Meeting with Roni Kuban, September 2026I received an envelope with '$30 billion' written on it. I said no right away. Whenever a proposal comes in, when a company decides to acquire another, it's a huge compliment... but the initial figure they present isn't the final one, so you always say no.
So there were two pieces of paper. The napkin on the flight from Redmond was a private list, and when it was complete he left. The brown envelope in New York carried a number that would have made him one of the richest people in his country, and he turned it down before breakfast was over, apparently with less agonizing than the July decision had cost him. Writing on the napkin was how he decided. Refusing the envelope was how he negotiated.
On March 18, 2025, Alphabet announced it would buy Wiz for $32 billion in cash. That was $9 billion more than the offer of the previous summer. Fortune reported a termination fee of $3.5 billion, and other outlets reported slightly different figures. The IPO market had weakened, and a new administration in Washington was seen as more open to large acquisitions. Rappaport's explanation was more personal: "After getting to know the team, the culture, and seeing just how impressive everyone was, saying yes the second time felt natural."
The European Commission cleared the deal without conditions in February 2026. It closed on March 11, 2026. It was the largest acquisition in Google's history, the largest cybersecurity acquisition ever, and the largest exit by an Israeli technology company, surpassing Mobileye, which also had roots at Hebrew University.
Two months later, at the Dead Sea, someone asked him whether it had been the right call. "I don't know if I did the right thing," he said.
On July 29, 2026, he published a post on Wiz's blog titled "Wiz's First 6 Months as Part of Google." Its first line was: "Fast gets even faster."
The Rented Apartment
With a stake estimated at about 10 percent, Rappaport stood to receive more than $3 billion before taxes. Very little about his daily life changed.
He has rented the same apartment in an old building in central Tel Aviv for more than a decade. He does not own a car. He walks or takes public transit, often with his dog, Mika. Friends told Ynetnews this is a matter of convenience, not principle: parking in his neighborhood is difficult. He eats junk food and avoids vegetables. He listens to podcasts, especially the one hosted by the celebrity chef Ruthie Brodo. He takes breaks during the workday to nap in the office or throw a ball for Mika, whom Wiz officially titled its Chief Dog Officer. In a Technion photograph taken after the deal, Mika sits between Rappaport and his former thesis advisor, Danny Raz.
He is not ascetic. He always flies business class. He spends on travel and concerts. On one occasion he bought a block of tickets to a Beyoncé concert abroad and invited all his friends. He bought his mother an apartment in Park Bavli, a high-end Tel Aviv development built by the billionaire Yitzhak Tshuva. So the son rents and the mother owns. The woman who asked whether the job came with a car got the more lasting gift.
Where his money has gone is investing. Calcalist reported in July 2026 that he held at least thirty-seven active startup investments and stakes in eight venture funds, including Cyberstarts, Sequoia, Andreessen Horowitz, and Index, the investors who once had to work to reach him. Eleven of the companies had already been sold or gone public. Anthropic, Deel, Torq, and Descope are among the holdings. His checks are usually a few hundred thousand dollars or less. He takes no board seats. Most opportunities, the paper noted, are brought to him by founders and funds who want his name in the round. In the first half of 2026 alone he made at least ten investments, mostly in what the industry calls agentic AI and in AI-era identity security. He is a founding limited partner of Mensch Capital Partners. In 2026 he also moved into Israeli media through the Merit Foundation and a $27 million deal involving Israel Entertainment. In August, Ynetnews reported he was in talks to buy the McDonald's franchise in Israel.
The man who stood up Sequoia now receives more calls than anyone could answer. Founders seek him out, wait for him, and try to get a meeting.
The record keeps returning to one moment, though, which happened years before any of this money, on an ordinary morning on the Microsoft shuttle to Herzliya. The head of a 1,500-person research center was sitting in a regular seat on a regular bus, in a job his mother hoped would come with a car. A twenty-something product manager got on, looked down the aisle, and saw no other empty seat.
"I sat down next to him," Raaz Herzberg said, "simply because there was no other seat available."
Part IIThe Playbook
What follows takes the patterns from Part I and turns them into principles. Some are counterintuitive. Several contradict the standard startup canon. All of them come from specific decisions that Rappaport and his partners made, sometimes reluctantly and sometimes, by his own account, foolishly, between a gas station on the coastal highway and a hotel room in New York. The register here is more analytical, and the evidence is the same.
The Rappaport Playbook
- 1.Commit to the people before the problem.
- 2.Enter the red ocean.
- 3.Treat "It sounds great" as a no.
- 4.Serve the hardest customer on day zero.
- 5.Make speed your evidence.
- 6.Publish the incumbent's flaws.
- 7.Apprentice inside the cathedral, then leave by napkin.
- 8.Never accept the first number.
- 9.Walk away without burning the bridge.
- 10.Keep your personal overhead below your conviction.
- 11.Leave the seat next to you open.
- 12.Use structural distance to speak plainly.
Principle 1
Commit to the people before the problem
Adallom began with no product idea. "We started without an idea or a direction," Rappaport wrote, "but we decided to commit ourselves to the project for a year." This is the opposite of the usual founding story, where an insight comes first and a team is assembled around it. The four friends treated the team as the fixed asset and the idea as something they would discover. Their working relationship was already almost twenty years old when Wiz was founded, which is why Luttwak could say the group accomplished a lot "without really needing to talk."
The investors who backed them think the same way. Shah's first principle is "It's all about the founder." Raanan asks about founders' mothers rather than their technology. Wiz's initial product was wrong, and Herzberg showed it was wrong within weeks. The company survived that because what the investors had bet on was the group of four, not the idea.
This only works under conditions most founders lack: proven trust, complementary skills, and a time limit. The one-year commitment was the discipline that made it work. It allowed exploration without letting exploration drag on indefinitely.
Tactic: Before choosing what to build, write down how long you will commit to a specific group of people, and judge the team by whether you would start over with them if the idea failed.
Principle 2
Enter the red ocean
When Arvatz asked Rappaport about Wiz's success, his first answer surprised the interviewer: "We entered a red ocean." Startup advice says to find uncontested markets. Rappaport's argument was that uncontested markets are expensive. You have to convince buyers the problem exists, get budget created for it, and outlast their doubts. Cloud security had existed for roughly a decade before Wiz. Earlier vendors had already educated buyers and gotten spending approved.
That changes the calculation. A crowded market with existing budgets is a market where a much better product can win share quickly, because the buyer is already shopping. Wiz's growth reflected switching, not category creation. CNBC reported it was taking business from Palo Alto Networks. "The advantage that we had," Rappaport said, "is learning from the mistakes of the others."
The risk is the obvious one. A red ocean punishes products that are only slightly better. The strategy requires a real step-change: agentless deployment, a graph instead of a stream of alerts, results in minutes instead of weeks.
Tactic: Look for categories where customers already have budget and are unhappy with what they bought, and compete on a difference they will notice in the first hour.
Principle 3
Treat "It sounds great" as a no
Wiz's first months produced a lot of encouragement. Herzberg ran ten customer presentations a day and kept hearing some version of "It sounds great." After ten days of this she could not tell the engineers what to build, and she said so. Her admission that she did not understand led to the pivot that made the company.
Her later framework separates politeness from demand. Positive feedback costs a buyer nothing. Asking about price, or asking to start a proof of value, costs them time and political capital inside their own organization. Only the second kind tells you anything. Her related rule: founders should close deals themselves before hiring a sales team, because "if you can't sell the product yourself, it's unlikely someone else will."
Rappaport's own customer rule, "The first priority should always be the customer," sounds like a platitude until you see what it means in practice. It does not mean listening to customers' compliments. It means watching what they do.
Tactic: For every customer conversation, record only the concrete next step the customer asked for, and treat any meeting that ends without one as a rejection.
Principle 4
Serve the hardest customer on day zero
Most startups start narrow by design: one type of user, one cloud, one market segment. Shah has written that "for most founders" this is the right choice. Wiz did the opposite and built for large, complicated, multi-cloud enterprise environments from the start, environments used daily by development, security, and operations teams.
The reasoning was about the customer's actual experience. For a large company, many narrow tools mean many noisy alert streams competing for limited attention. A product that covers the whole environment solves the customer's real problem, which is understanding everything at once, not scanning one part of it. The result showed up in the customer list: 45 percent of the Fortune 100 within about four years.
The cost was serious engineering and capital requirements from the beginning, which leads to the next principle. Building broad from day zero is only possible if you can raise money fast enough to pay for it.
W
The Conventional Playbook vs. Wiz
Where Rappaport's team deliberately broke from startup orthodoxy.
| Conventional wisdom | Wiz's approach | Phase |
|---|---|---|
| Start with an insight, then find a team. | Commit to the team for a year; find the idea later. | Adallom |
| Find a blue ocean. | Enter a red ocean where budgets already exist. | Wiz founding |
| Start narrow: one persona, one cloud. | Serve multi-cloud Fortune 100 environments from day zero. | Wiz founding |
| Install agents for deep visibility. | Connect through APIs, agentless, with results in minutes. | Product |
| Avoid antagonizing platform partners. | Publicly disclose flaws in Azure, OCI, and IBM Cloud. | Scale |
| Take the life-changing offer. | Decline $23B; decline $30B; accept $32B. | Exit |
Tactic: If your buyers' main problem is having too many tools, do not ship another narrow one; scope your first version to cover the whole problem, even if that delays launch.
Principle 5
Make speed your evidence
From the outside, Wiz's financing pace looked reckless: $1.7 billion in the spring of 2021, $6 billion that October, $10 billion in early 2023, $12 billion in 2024. But each round was supported by revenue, and the revenue itself made the argument. Going from $1 million to $100 million in ARR in eighteen months, and then to $200 million nine months after that, persuaded investors more than any pitch deck could.
Speed also kept the company aligned internally. "Being the fastest-growing company, the pace is very fast," Rappaport said to Index; "everyone is always running together." Fast growth leaves little room for internal politics. The fundraising paid for the broad, day-zero product and for acquisitions such as Gem and Dazz that extended the platform.
Speed has costs, and the record shows them. There were comparisons to Neumann, allies who called the sales approach aggressive, and a lawsuit from Orca. Fast companies make enemies. The principle holds only when the growth is real, and Wiz's was large enough that it eventually overshadowed the criticism.
Tactic: Raise your next round on demonstrated revenue growth rather than projections, and use each round to pay for the breadth that keeps the growth going.
Principle 6
Publish the incumbent's flaws
Wiz Research turned vulnerability discovery into market credibility. ChaosDB, OMIGOD, NotLegit, ExtraReplica, and BingBang were all found in Microsoft's cloud. AttachMe was in Oracle's, Hell's Keychain in IBM's, and the exposed database was DeepSeek's. Each disclosure made the same case to buyers: this team understands the platforms better than the platforms do.
!
The Disclosure Ledger
Selected vulnerabilities found and responsibly disclosed by Wiz Research.
| Finding | Target | Exposure |
|---|---|---|
| ChaosDB | Microsoft Azure | Cosmos DB databases of thousands of customers |
| OMIGOD | Microsoft Azure | Unauthenticated remote code execution via OMI agent |
| ExtraReplica | Microsoft Azure | Cross-tenant PostgreSQL database access |
| BingBang | Microsoft Azure | Bing.com result manipulation; Office 365 credential risk |
| AttachMe | Oracle Cloud | Access to other users' storage volumes |
| Hell's Keychain | IBM Cloud | Cloud provider supply-chain remote code execution |
| DeepSeek exposure | DeepSeek | Public database with chat histories and sensitive data |
What makes this a strategy and not just aggression is the discipline around it. Every finding was disclosed responsibly, and Rappaport made sure to note that Microsoft "rapidly fixed" BingBang. The target was the vulnerability, not the vendor. That let Wiz embarrass its former employer repeatedly without creating a lasting conflict. Customers saw expertise, and the platforms saw a skilled outside auditor.
Tactic: Put a research team on finding real flaws in the platforms your customers depend on, disclose responsibly before publishing, and treat each finding as the strongest marketing you can produce.
Principle 7
Apprentice inside the cathedral, then leave by napkin
The years at Microsoft, from 2015 to 2019, were a deliberate apprenticeship. Arvatz noted that the founders saw firsthand how Microsoft "is managing enterprise security sales on HUGE scale." Rappaport ran a 1,500-person research organization in three cities and led the group responsible for Azure security. When Wiz began selling to the Fortune 100, its founders already knew how large buyers make decisions, because they had spent four years on the selling side for one of the biggest enterprise vendors there is.
The way he left is just as useful. "I wrote on a napkin a list of what I wanted to do at Microsoft," Rappaport said. "When I finished the napkin, I left the job." He defined in advance what he had come to accomplish, so the decision to leave did not depend on how he felt at any given moment. When the list was complete, he left, even though it felt like "the most horrible decision ever," and even though it meant giving up a job he called the mothership.
The McKinsey years fit the same pattern. Rappaport called it "the best possible business school," and it let him learn how CEOs think before he had to sell to them.
Tactic: When you take a job inside a large organization, write a short list of what you intend to learn and accomplish there, and treat finishing the list as the signal to leave.
Principle 8
Never accept the first number
"The initial figure they present isn't the final one, so you always say no." Rappaport said this about a $30 billion offer, which is the context that matters. Most founders treat a large bid as a peak to grab before it disappears. Rappaport treated it as the buyer's opening position, and his reasoning was simple: a company that has decided to acquire you has shown its intent, and its first price shows its intent and nothing more.
G
Two Envelopes: The Google Negotiation
How $23 billion became $32 billion.
Mar 2024
Sundar Pichai emails Rappaport. The message goes unread for two months.
May 2024
Prompted at a San Francisco conference, Rappaport and Costica meet Pichai and Thomas Kurian in Mountain View.
Jun 2024
Within a month, Google offers $23 billion, roughly double Wiz's $12 billion valuation.
Jul 2024
With documents ready, Wiz walks away. July 23 memo to staff: the goal is $1 billion ARR and an IPO.
~Early 2025
At a private breakfast in a New York hotel room, Pichai hands over a brown envelope reading "$30 billion." Rappaport declines on the spot.
Mar 18, 2025
Alphabet announces an all-cash, $32 billion agreement.
Feb 2026
The European Commission clears the deal unconditionally.
Mar 11, 2026
The acquisition closes, the largest in Google's history.
The math is straightforward. Turning down $23 billion and then $30 billion produced $9 billion more than the first offer, along with what Fortune reported as a $3.5 billion termination fee. The rule only works with leverage behind it. Wiz had revenue growth that made going public a real alternative, which is why its refusals were believable.
Tactic: Before any acquisition conversation, set a credible independent path and a walk-away number, and treat the buyer's first offer as information about how much they want you, not as a final price.
Principle 9
Walk away without burning the bridge
Turning down $23 billion with signing documents already prepared could have ended the relationship. It did not, partly because of a phone call Rappaport did not want to make. He called Pichai himself, "dreading the conversation," and Pichai responded in a way Rappaport had not expected, asking how the two companies could become the best of partners. "It was a style of leadership I hadn't encountered before," Rappaport said.
The lesson works in both directions. Rappaport made his refusal personally and directly instead of through bankers or a press release, and that kept the relationship intact. Pichai responded generously instead of with wounded pride, and that kept a $32 billion deal possible six months later. Rappaport's own description of the second agreement emphasized the relationship: "After getting to know the team, the culture... saying yes the second time felt natural."
The 4 a.m. label is also part of the lesson. Rappaport imagined the worst-case version of his own humiliation in detail, down to an $8 billion markdown, and made the decision anyway. Facing the regret directly is different from pretending it isn't there.
Tactic: When you decline a serious offer, deliver the refusal yourself, directly to the decision-maker, and use the conversation to set up the next one.
Principle 10
Keep your personal overhead below your conviction
After the $320 million sale of Adallom, Rappaport lived with a roommate and took the bus. After the $32 billion sale of Wiz, he still rents, still has no car, and still walks the dog. His friends describe it as convenience, not a statement. The effect matters more than the reason. A founder whose personal needs are small can turn down a huge offer without his own expenses pressuring him.
Personal liquidity often pushes founders toward early exits. A founder with a large mortgage, family obligations, and expensive habits sees a $23 billion offer differently from one whose main indulgences are business-class seats and Beyoncé tickets for friends. Rappaport's spending is real but limited: travel, concerts, an apartment for his mother. It is not a large fixed cost that the business has to cover.
The same pattern shows up in his angel investing after the exit: checks usually in the hundreds of thousands, no board seats, mostly passive. He invests the way he lives, with small, scattered bets instead of large commitments.
Tactic: Keep your fixed personal costs low enough that no single offer can solve a financial problem for you, so that you can judge each deal on what it does for the company.
Principle 11
Leave the seat next to you open
Wiz's most important early hire came from a shuttle bus. Herzberg sat next to Microsoft Israel's general manager because there was nowhere else to sit, and he listened to her. That conversation led to an excellence program for young product managers. A few years later she was Wiz's first employee, and the person who said she did not understand the product, which led to the pivot.
Rappaport is famously hard to reach in some ways: unread email, a missed meeting with Sequoia, forty-five minutes late to Index. In other ways he is unusually reachable. He took the employee shuttle while running a 1,500-person organization. He dresses casually and treats employees, as colleagues describe it, as equals. These two traits work together. He ignores formal channels and is open to informal ones. The people who have reached him tended to do it by being physically nearby, not by scheduling something.
There is a broader point about sourcing talent. The best ideas inside a large organization often belong to people who would never get on the senior leader's calendar. A leader who travels with everyone else hears from them.
Tactic: Spend part of every week somewhere you are not in charge, such as the shared commute, the open table, or the general cafeteria, and treat unplanned conversations there as a real source of hires.
Principle 12
Use structural distance to speak plainly
Rappaport moved Wiz's money out of Israel during the judicial-reform protests. He marched at Pride in a tense year. In wartime he told a room of kibbutz leaders that the government "should stop bashing universities." He could say all this partly because of how Wiz was structured: headquartered and incorporated in New York, with engineering in Tel Aviv. "We have the privilege to be bolder in our statements," he told Forbes.
The principle is not that every founder should take public political positions. It is that your company's structure determines how much you can say safely, and you should be clear about that. Wiz could stand to lose some local goodwill. A company that depends on government contracts or on one domestic market might not.
His positions were also consistent. He defended diversity on a conference stage in 2018, offered surrogacy grants at Wiz, and later defended universities and 8200 in the same speech. Schultz's description, "He wears his heart on his sleeve, and he loves his country," holds together because his dissent came from attachment to the country, not distance from it.
Tactic: Before taking a public position, identify which parts of your company's structure absorb the risk, and speak only on issues where you have been consistent and the company can bear the consequences.
Free playbook
Get The Business Model Playbook
58 business models, one visual page each: how the money flows, the metrics that matter, and who runs it. Free when you join the Faster Than Normal email.
Free. No spam. Unsubscribe anytime.
Part IIIQuotes and Maxims
In their words
— Assaf Rappaport, Fortune Brainstorm Tech, 2024If you pinpoint a time in history, probably March 2020, that's the time to start a cloud security [company].
— Assaf Rappaport, Candid with Index, August 2023There is a tension that you need to play with that you're solving an important problem from the get-go, but that you also need to be sure you're building for the future.
— Assaf Rappaport, Calcalist, April 14, 2021We had no idea that the more we would try to avoid them the more interested they would become.
— Assaf Rappaport, to CNBC, May 2023For us, it's still an unlimited market. The opportunity is still huge, so we can still grow in triple digits a year, and even in a downturn and potential recession.
— Assaf Rappaport, Kibbutzim Leadership conference, May 27, 2026I don't know if I did the right thing.
Maxims
- The team is the asset; the idea is a variable. Commit to the people for a fixed period and let the product emerge.
- Crowded markets have budgets. A red ocean full of educated buyers rewards the product that is clearly better.
- Compliments are free; price questions cost something. Count only the actions customers take, not what they say.
- Build for the hardest buyer first. Breadth from day zero solves the problem large enterprises actually have.
- Growth is the pitch. Let revenue justify the valuation before you ask for it.
- Break into the platforms, then help fix them. Responsible disclosure turns criticizing incumbents into credibility.
- Write the napkin, then leave. Decide in advance what a job is for, so leaving depends on the list and not your mood.
- The first number is never the final number. A buyer's opening offer shows how much they want you, and nothing more.
- Refuse in person. The way you walk away decides whether the counterparty comes back.
- Small overhead allows large refusals. A founder who needs little can say no to a great deal.
