Yinon
Costica

Most founders start by building. Costica started by listening. Before Wiz wrote a meaningful line of code, he and the team conducted structured interviews with 100 Chief Information Security Officers over three months. The question was not "what feature do you want?" The question was: what problem is worth $1 million per year to you, versus what problem is worth $10,000?

The answer was cloud visibility. Enterprises had moved to the cloud fast. Security had not kept up. Nobody really knew what was running in their cloud environment, what was misconfigured, what was exposed. Existing tools generated so many alerts that security teams had learned to ignore them. The actual risk was invisible.

Costica's insight - and the founding product bet of Wiz - was architectural: scan cloud environments via APIs without deploying any agents. No software installed in customer environments. No ongoing maintenance burden. A security product that was also, radically, simple to use. "What was missing was simplicity," he has said in interview after interview. It is the most compressed version of a product thesis that built a $32 billion company.

The team made three pivots before landing on this architecture. The original concept was a cloud networking tool. Then a compliance solution. Then, finally, the agentless vulnerability scanner that would become Wiz's core. Every pivot came from customer conversations, not conviction. Costica has written and spoken extensively about this discipline - the willingness to discard what you believe in favor of what customers will actually pay for.

Wiz launched its first product in April 2020 - three months into a global pandemic. Within 18 months, it hit $100 million in annual recurring revenue - a speed record for enterprise software that has not been broken. Within two years, more than half of the Fortune 100 were paying customers. The company raised at a $6 billion valuation, then $10 billion, then $12 billion. In 2024, Google reportedly offered $23 billion. The founders turned it down.

Costica is not an AI evangelist. He is an AI realist, which is considerably more useful. At Google Cloud Next 2026, he is speaking on "Navigating Agentic Cyber Defense" - not because AI is exciting, but because it is already being weaponized. His framework for thinking about AI threats is disarmingly blunt.

"AI is very accessible," he told the Big Technology Podcast. "It's simplified, it can be used at scale. State nations, organized crime, teenagers in basements." Three threat categories, escalating from the organized to the chaotic, all newly empowered by the same tools that make developers more productive.

His concern about "vibe coding" - where developers generate entire applications through AI prompts without reading the output - is specific and grounded. When a vulnerability surfaces in AI-generated code, the developer who prompted it into existence may have no idea what they built. The security debt is invisible until it isn't.

Wiz's response to the AI security challenge has been architectural. The product has evolved from cloud posture management to encompass AI security posture management - scanning AI workloads, LLM configurations, and agentic systems with the same agentless approach that worked for cloud infrastructure. The bet is that AI is just software, and software has vulnerabilities, and someone needs to find them before the other side does.

"When we think about AI, first, we need to understand that it's code," Costica has said. "And code has vulnerabilities like any other software." It is the kind of thing that sounds obvious once someone says it, but is not obvious enough that the industry has acted accordingly.