Wiz sells a multicloud CNAPP that Google now owns. Microsoft Defender for Cloud sells a CNAPP that lives inside Azure and reaches out to AWS and GCP. Both promise posture, workload protection, entitlements and attack paths. We read the documentation, the price lists and the acquisition filings. Checked on 27 October 2026.
Documentation review: not tested. We have not used the products in this review. It is a structured reading of published evidence, linked throughout. How we review products explains what that covers.
Status: correct as at 27 October 2026. Prices are public list prices as displayed on the dates given; real deals are negotiated.
Disclosure: no vendor sponsored, reviewed or saw this review before publication, and there are no affiliate links. Google completed its acquisition of Wiz on 11 March 2026; see ‘Who owns whom’. Our independence policy explains how we work.
Verdict
Wiz is the stronger multicloud CNAPP pick on published peer scores and agentless breadth; Defender for Cloud is the sensible default when Azure is already the security centre of gravity.
- Good for: Wiz suits multicloud estates that want one agentless graph across AWS, Azure, GCP and Oracle. Defender for Cloud suits organisations already deep in Microsoft security who want CSPM, CWPP and AI posture billed against the same Azure bill.
- Not for: Wiz is a poor fit for shops that refuse a Google Cloud-owned security platform on principle, even if the product still covers other clouds. Defender for Cloud is a poor fit as a sole CNAPP when Azure is a minority of the estate and you need one primary console outside Microsoft.
- Price: Wiz lists Essential at $24,000 and Advanced at $38,000 per year for 100 workloads on AWS Marketplace (opens in a new tab) (checked 27 October 2026); other prices are by quote. Defender for Cloud has a free Foundational CSPM tier; paid Defender CSPM (opens in a new tab) lists at about $5.11 per billable resource per month on the Azure Retail Prices API, with separate CWPP plans (checked 27 October 2026).
- Score: No numeric score (documentation review)
Who owns whom
On 18 March 2025 (opens in a new tab) Google announced a definitive all-cash agreement to buy Wiz for $32 billion. On 11 March 2026 (opens in a new tab) Google said the deal had closed. Wiz joined Google Cloud, kept its brand, and Google repeated that the products would keep working across AWS, Azure, GCP and Oracle Cloud.
That is the first fact any buyer has to sit with. Wiz is no longer an independent CNAPP. It is a Google Cloud asset that still sells multicloud coverage. Defender for Cloud is a Microsoft product. Neither company is neutral about cloud preference; both publish multicloud connectors anyway.
Wiz’s own completion materials still claim trust among a large share of the Fortune 100. That is a vendor claim, not one we have verified. Treat marketing tallies as colour, not evidence.
Head to head
| Area | Wiz | Microsoft Defender for Cloud |
|---|---|---|
| What it is | Multicloud CNAPP / AI-APP, now owned by Google Cloud | Microsoft CNAPP combining CSPM, DevSecOps and CWPP |
| CSPM | Agentless API connectors; Security Graph | Free Foundational CSPM; paid Defender CSPM for advanced features |
| CWPP | Agentless assessment; optional Wiz Sensor for runtime | Plan-based: Servers, Containers, Storage, Databases, APIs and more |
| CIEM | Entitlement risk on the Security Graph | Native CIEM in Defender CSPM for Azure, AWS and GCP |
| Attack paths | Toxic-combination paths on the graph | Attack path analysis and Cloud Security Explorer (Defender CSPM) |
| AI-SPM | AI BOM, AI attack paths, AI runtime (opens in a new tab) | AI SPM under Defender CSPM (opens in a new tab); separate AI threat protection plan |
| Multicloud | AWS, Azure, GCP, Oracle and Kubernetes | Azure native; AWS and GCP connectors; Arc for hybrid |
| List price | AWS Marketplace Essential $24k / Advanced $38k per 100 workloads per year | Foundational CSPM free; Defender CSPM ~$5.11/resource/month; CWPP per plan |
| Peer Insights (CNAPP) | 4.8 / 5 as listed on Gartner Peer Insights (CNAPP compare page, October 2026) | 4.4 / 5 as listed on Gartner Peer Insights (CNAPP compare page, October 2026) |
CSPM and the graph
Both products start with posture. Wiz’s pitch is agentless: connect cloud accounts over API, build a Security Graph, and surface toxic combinations rather than endless CVE lists. Its platform page (opens in a new tab) puts agentless visibility, the graph and attack-path analysis at the centre.
Defender for Cloud splits CSPM in two. Foundational CSPM is free (opens in a new tab): inventory, Secure Score, the Microsoft cloud security benchmark, and basic multicloud connectors. Paid Defender CSPM adds agentless vulnerability scanning, the cloud security graph, attack path analysis, data-aware posture, governance and code-to-cloud context.
On paper the paid Defender CSPM feature list overlaps heavily with Wiz. The practical difference is where the graph lives. Wiz’s graph is the product. Defender’s graph is one plan inside a wider Microsoft security estate that already includes Defender XDR, Entra and Sentinel for many buyers.
Edge: Wiz for a specialist multicloud posture console. Defender for Cloud when Secure Score and the Microsoft ecosystem already drive the programme.
CWPP, sensors and plans
Workload protection is where the packaging diverges. Microsoft sells discrete CWPP plans: Defender for Servers Plan 1 and Plan 2, Containers, Storage, databases, App Service, Key Vault, Resource Manager, APIs and AI Services. The product overview (opens in a new tab) treats those plans as the CWPP layer of the CNAPP.
Azure Retail Prices for Global (USD, checked 27 October 2026) put classic Defender for Servers Plan 1 at about $4.91 per server per month ($0.00672 per hour) and Plan 2 at about $14.60 ($0.02 per hour). Defender CSPM’s Standard node metre is about $5.11 per month ($0.007 per hour). Containers, storage and the rest bill separately. The public pricing page also describes a Defender Workload Unit model; treat the retail API figures as the auditable list rates we could read without a signed-in calculator.
Wiz keeps assessment agentless and sells optional runtime. On AWS Marketplace (opens in a new tab) the Sensor add-on is $28,000 per year for 100 sensors on top of Advanced, and Wiz Defend is $18,000 per year for 300 GB of log ingest per month. That is a different shape of bill: fewer SKUs on the quote, more weight on workload count and add-ons.
Edge: Defender for Cloud if you want to switch workload plans on and off. Wiz if you prefer a platform quote plus a small set of runtime add-ons.
CIEM and attack paths
Both vendors treat identity risk as part of CNAPP rather than a separate shopping trip. Microsoft documents CIEM inside Defender for Cloud (opens in a new tab) for Azure, AWS and GCP under Defender CSPM, after Entra Permissions Management was retired. Wiz folds entitlement risk into the same Security Graph that drives its attack paths.
Attack path analysis is a paid Defender CSPM capability. Microsoft’s attack-path documentation (opens in a new tab) describes externally driven, exploitable paths across multicloud assets, including storage, containers, serverless, APIs and AI agents, with the Cloud Security Explorer for graph queries.
Wiz describes the same problem as toxic combinations: internet exposure plus vulnerable software plus over-privileged identity plus sensitive data. The language differs; the buyer question is the same. Which console will your cloud and identity teams actually open every morning?
Edge: Roughly level on published capability. Choose the graph your operators will use.
AI-SPM
Both now sell AI security posture. Wiz’s AI-SPM page (opens in a new tab) lists AI discovery and inventory, an AI bill of materials, exposed AI endpoints, AI attack paths and AI runtime protection. Microsoft’s AI SPM overview (opens in a new tab) puts generative-AI discovery, recommendations and attack paths under Defender CSPM, with a separate Defender for AI Services threat-protection plan billed per tokens.
Neither page replaces a dedicated agent-runtime product. Both extend the CNAPP graph into models, training data and AI services. If AI posture is a board slide rather than a SOC queue, either will do the slide. If you need inline agent controls, look elsewhere in the market.
Pricing models
Wiz does not publish a self-serve calculator on wiz.io. The usable public rates are marketplace and framework listings. AWS Marketplace (checked 27 October 2026) shows Essential $24,000 and Advanced $38,000 per year for 100 workloads, plus Sensor, Code and Defend add-ons. The UK G-Cloud listing for Wiz Advanced shows £220 an instance a year (opens in a new tab). Wiz’s own pricing page asks for a custom quote.
Defender for Cloud is metered and public. Foundational CSPM is free. Paid plans appear on the Azure pricing page (opens in a new tab) and in the Retail Prices API. Expect the bill to grow with every CWPP plan you enable, which is honest and also easy to under-estimate. Microsoft offers up to 22% off with one-year pre-purchase commit units.
Edge: Defender for Cloud for predictable public metres if you can forecast resource counts. Wiz for a negotiated platform price if your procurement team prefers one number.
Other players
The CNAPP shortlist does not end at two.
- Palo Alto Cortex Cloud / Prisma Cloud: the Palo Alto cloud security stack, aimed at buyers already in that estate who want code-to-cloud and SOC workflow in one vendor.
- CrowdStrike Falcon Cloud Security: strong where the SOC already runs on Falcon and wants runtime and identity correlation with endpoint.
- Orca Security: agentless CNAPP peer; still independent as of this check, with a smaller Peer Insights sample than Wiz or CrowdStrike on the alternatives lists we saw indexed.
On Gartner Peer Insights in the Cloud-Native Application Protection Platforms market, the compare page in October 2026 listed Wiz CNAPP at 4.8 out of 5 and Microsoft Defender for Cloud at 4.4 out of 5 (Gartner Peer Insights (opens in a new tab)). Peer scores are opinions of reviewers, not lab results.
Who should buy which
- Azure-heavy, already on Defender: start with Foundational CSPM, then Defender CSPM, then only the CWPP plans you will actually staff.
- True multicloud, security team wants one graph: shortlist Wiz, and decide whether Google ownership is acceptable.
- Already Palo Alto or CrowdStrike: price their cloud module before paying for a third console.
- AI posture as a board requirement: either Wiz AI-SPM or Defender CSPM AI SPM will produce the inventory; neither replaces agent runtime controls.
What we could not verify
We quote Gartner Peer Insights scores only, not review counts, because the counts could not be re-read on the day of publication. Wiz Fortune 100 share is a vendor claim. Exact negotiated Wiz discounts are not public. Azure portal calculator output can differ from Retail Prices API metres once enterprise agreements apply. We found no independent lab shoot-out that cleanly ranks Wiz against Defender for Cloud on identical estates in 2026, so we have not invented one.
Sources: every figure above links to its source, with the date we checked it. Spotted an error? Tell us.
Gartner and Peer Insights™ are trademarks of Gartner, Inc. and/or its affiliates. All rights reserved. Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)