Wiz Pays $450M for Dazz as CSPM Vendors Chase Application Security Integration

CSPM vendors are acquiring application security rather than building it

Wiz agreed to pay $450 million for Dazz, an application security posture management vendor, according to reporting citing a source familiar with the transaction. The acquisition connects Wiz's cloud-native application protection platform with Dazz's root-cause analysis and remediation capabilities across code, cloud infrastructure, runtime vulnerabilities, and CI/CD pipelines. The deal came weeks after Upwind announced a $400 million Series C on October 28, bringing its total funding to more than $800 million less than nine months after its $250 million Series B.

The convergence matters because standalone cloud misconfiguration scanning no longer matches how enterprises deploy applications. Code moves through CI/CD pipelines into runtime environments where infrastructure, identity, and application layers intersect. Buyers evaluating CSPM products should now assume that posture management, vulnerability detection, and remediation workflow will consolidate into a single platform within 18 months. Organizations running separate tools for cloud misconfiguration, container security, and application vulnerability management should reassess whether that architecture creates duplicate alerts and uncoordinated remediation.

Microsoft makes Azure baseline posture management opt-in instead of default

Microsoft changed Azure Foundational CSPM from default-on to opt-in for new subscriptions beginning October 27. The free plan remains available at no cost, but new customers must explicitly enable it. Existing subscriptions with the feature already active remain enabled unless administrators disable it.

The change creates an immediate operational requirement. Azure procurement and cloud governance teams must add Foundational CSPM activation to subscription landing zones and provisioning checklists. Organizations that assume Microsoft's baseline controls deploy automatically could create visibility gaps in new subscriptions. The policy shift may also improve the relative positioning of third-party CSPM tools that deploy through centralized organization-level controls rather than relying on per-subscription activation. Buyers should verify whether their infrastructure-as-code templates and Azure Policy assignments explicitly enable Foundational CSPM, particularly for subscriptions created through automated provisioning.

CrowdStrike expands from infrastructure into SaaS posture management

CrowdStrike announced an agreement to acquire Adaptive Shield on October 20, broadening its cloud security posture strategy beyond infrastructure into SaaS configuration and identity-related risk. Adaptive Shield provides SaaS security posture management, including continuous SaaS application risk assessment and detection and response for threats affecting SaaS applications. The announcement did not disclose the purchase price, customer count, or expected financial contribution.

The transaction puts additional pressure on Microsoft Defender, Palo Alto Networks' Prisma Cloud, Wiz, Okta-related security offerings, and specialist SaaS security vendors. Organizations with large Salesforce, Microsoft 365, ServiceNow, or GitHub estates may be able to consolidate SaaS posture monitoring into the Falcon platform, but buyers should seek details on integration timelines, packaging, and data source coverage before changing tooling plans. The absence of pricing and customer-count disclosure means near-term commercial impact remains uncertain.

The benchmark that separates CSPM from cloud provider certifications

A benchmark published by DigitalXForce in October scored 2,112 companies across 12 security domains, mapping controls to NIST SP 800-53, NIST CSF 2.0, and CIS Controls v8.1. The report distinguishes CSPM—which evaluates an organization's own cloud accounts—from cloud vendor assurance, which evaluates whether providers operate their own controls. It identifies Wiz, Prisma Cloud, Microsoft Defender for Cloud, and Orca as example CSPM products.

The distinction matters because treating a cloud provider's certifications as a substitute for customer-side CSPM leaves tenant and workload configuration unexamined. Procurement teams should require CSPM evaluations to cover actual configuration, not merely provider certifications. The report provides a sizable benchmark population and recognized control mappings, but the available material does not disclose comparative vendor scores or independent product performance benchmarks, limiting its usefulness for ranking products.

What to watch

The $400 million Upwind financing and $450 million Wiz–Dazz transaction indicate that CSPM vendors are competing for platform budgets rather than isolated posture-management deployments. Buyers should expect more aggressive product expansion and higher vendor consolidation pressure. Organizations running separate tools for cloud misconfiguration, container security, and application vulnerability management should reassess whether that architecture survives the next budget cycle.

Verify that Azure Foundational CSPM is explicitly enabled on every new subscription. The October 27 policy change does not affect existing subscriptions, but new subscriptions require manual activation. For organizations evaluating CSPM vendors, prioritize products that demonstrate integration across code, infrastructure, runtime, and SaaS rather than best-of-breed posture scanning. The market is moving toward converged CNAPP platforms, and standalone CSPM tools risk becoming workflow duplication.