Google's $32 billion bet on cloud security faces February deadline

Google filed its proposed $32 billion acquisition of cloud cybersecurity company Wiz with the European Commission on January 7, 2026, according to a filing on the Commission website. EU antitrust regulators now have until February 10 to decide whether to clear the deal or open a full-scale investigation into what would become Google's largest acquisition in company history.

The transaction, announced by Google on March 18, 2025, would give the search and cloud computing giant control over one of the fastest-growing cybersecurity platforms in the enterprise market. Wiz provides multi-cloud security monitoring that allows organizations to protect their infrastructure across Amazon Web Services, Microsoft Azure, Google Cloud Platform, and Oracle Cloud simultaneously. The Israeli-American company grew from zero to a $32 billion valuation in just five years since its 2020 founding.

According to Google Cloud CEO Thomas Kurian, the acquisition addresses accelerating cybersecurity risks that organizations face across increasingly complex digital environments. "As we all see in the news every day, and our Mandiant consultants witness on the front lines with our customers, cybersecurity risks continue to accelerate with the number and severity of breaches continuing to grow," Kurian stated in the March announcement.

The deal requires customary regulatory approvals before closing. The European Commission can either clear the transaction with or without demanding concessions during its preliminary review, or open a full-scale investigation if serious concerns emerge. The United States Federal Trade Commission and Department of Justice share jurisdiction over merger reviews in American markets, where the acquisition secured approval in November 2025.

Academic research raises alarm about market concentration

Just weeks before Google filed with European regulators, researchers published striking new data about Google's expansion into digital markets that extends far beyond its well-documented merger and acquisition activity. A November 2025 paper titled "Google's Hidden Empire" presents evidence that Google has amassed an empire of more than 6,000 companies through acquisitions, investments, and support programs—substantially more than other major technology firms.

The research, authored by Aline Blankertz, Brianna Rock, and Nicholas Shaxson, documents how Google shifted investment strategy dramatically over the past decade. While the company's acquisitions decreased from 39 companies in 2014 to just 3 in 2024, its investments through venture capital arms surged. Google invested in 743 companies in 2022 alone, maintaining over 600 investments annually through 2024. By comparison, Microsoft invested in 90-164 companies per year during the same period, while Amazon increased from 12 to 227 investments.

Between 2015 and 2024, Google for Startups accounted for 57.8% of all Google investments, according to the research. This active funding of emerging technology companies creates dependencies across the startup ecosystem that competition authorities have not systematically examined. The researchers obtained their data from PitchBook, a private capital markets data provider that tracks venture capital and startup transactions with greater granularity than public market databases.

The academic analysis specifically addresses Google's proposed Wiz acquisition in its final section, drawing parallels to the company's 2007 purchase of advertising technology firm DoubleClick. That $3.1 billion transaction, which regulatory authorities approved without conditions, enabled Google to monopolize digital advertising markets over the subsequent 15 years. Federal courts in both the United States and European Union have since ruled that Google engaged in systematic anticompetitive conduct stemming from the DoubleClick acquisition.

Vertical integration concerns echo past regulatory failures

According to the researchers, Wiz presents similar vertical concerns as DoubleClick. Cybersecurity experts distinguish between "left of boom" security measures—proactive defenses that prevent attacks—and "right of boom" responses after incidents occur. Google has recently acquired three cybersecurity companies focused on incident response: Chronicle, Siemplify, and Mandiant. The Mandiant acquisition, completed for $5.4 billion, did not trigger objections from the DOJ and was not formally reviewed by the European Commission.

Wiz operates primarily in the "left of boom" space, providing comprehensive attack surface monitoring across multiple cloud platforms. The combination would give Google end-to-end cybersecurity offerings spanning prevention through response. Investors have described the acquisition as part of a "Trojan horse" strategy to expand Google's market power over essential online infrastructure, according to the research paper.

Originally, Wiz founders positioned their platform as the "Switzerland of cloud security," maintaining neutrality across competing cloud providers. The company enables businesses using multi-cloud strategies to monitor security across all their infrastructure from a single dashboard. Most enterprises adopt multi-cloud approaches for resilience, but this creates technical challenges for cybersecurity monitoring that Wiz addresses through its connective tissue across platforms.

After Google's acquisition, that neutrality stance could shift. Wiz would give Google an intrusive presence inside other businesses' internal systems, obtaining extensive corporate data fundamentally different from Google's user-facing data collection through search and advertising products. The researchers note this raises both competition and surveillance concerns.

The paper traces how regulatory authorities dismissed similar warnings when Google acquired DoubleClick. At that time, the US Federal Trade Commission and European Commission relied heavily on Industrial Organization economics models that systematically underestimate harms from vertical integration. Multiple parties raised concerns that Google would bundle its search advertising with DoubleClick's ad-serving technology and discriminate against competitors. Regulators concluded such bundling was unlikely and would prove unprofitable for Google.

Subsequent events proved those analyses wrong. Google deeply integrated DoubleClick services into its unified advertising technology systems and engaged in self-preferencing of its own services. The European Commission fined Google €2.95 billion on September 5, 2025, for distorting competition in advertising technology through anticompetitive conduct. The Commission found Google "favoured its own online display advertising technology services to the detriment of competing providers of advertising technology services, advertisers and online publishers."

Pattern of dismissed warnings and subsequent monopolization

The research documents a second case study involving Google's 2021 acquisition of fitness tracking company Fitbit for $2.1 billion. The European Commission conditionally approved that transaction with behavioral commitments intended to prevent Google from leveraging the deal to extend its market power. The commitments focused on data siloing, maintaining third-party access to Fitbit's web API, and ensuring Android interoperability with competing wearables.

Fitbit has since experienced steady decline in monthly active users, revenue, and device sales. The product fell from 40.2 million monthly active users in 2020 to 38.5 million in 2023, while revenue dropped from $1.13 billion to $910 million over the same period. Google discontinued Fitbit's web dashboard in July 2024 and announced that Google Assistant functionality on Fitbit watches would be phased out. The Fitbit co-founders and team members departed in January 2024 as Google integrated Fitbit technology into its Pixel Watch launched two years after the acquisition.

The behavioral commitments designed to address competition concerns are becoming increasingly irrelevant as Fitbit loses users and market presence. The research suggests Google never pursued a longer-term strategy for the wearables and health data business that regulatory commitments assumed would drive competitive harm. In October 2025, Google announced plans to sell Verily Life Sciences, its health data subsidiary.

According to the researchers, these cases demonstrate that authorities using Industrial Organization economics fail to correctly anticipate business strategies of acquiring firms. The abstract theoretical models create nearly insurmountable hurdles for enforcement action while corporate consultancies specializing in the same economic language help merging companies navigate regulatory reviews. The paper cites evidence of consultancies "spamming the regulator" with multiple large submissions to overwhelm capacity for effective analysis.

For the Wiz transaction, the researchers argue that similar vertical concerns require different analytical approaches. Google holds approximately 11-12% of the global public cloud services market, trailing Amazon Web Services at 30-32% and Microsoft Azure at 21-23%, according to industry estimates. However, Google's cloud revenue has grown 64% from $26 billion in 2022 to $43 billion in 2024, faster than competitors' 15% annual average growth rates.

Wiz's comprehensive multi-cloud security platform could help Google expand market power vertically into new domains while establishing enduring presence in corporate systems. The researchers note this differs fundamentally from horizontal mergers between direct competitors that regulatory frameworks more readily identify as problematic.

Geopolitical dynamics complicate enforcement decisions

The academic analysis places the Wiz acquisition within broader geopolitical context as technology companies merge interests with United States government objectives. Former Google CEO Eric Schmidt has taken advisory roles with US government agencies focused on artificial intelligence and national security. Schmidt has warned of an AI arms race with China, arguments that technology industry figures invoke to oppose regulation and secure government subsidies for major platforms.

US Commerce Secretary Howard Lutnick described this dynamic in March 2025 remarks about requiring technology companies to build government systems. "I go to the heads of Google and Microsoft and Amazon. They're all for America, building for us," Lutnick stated, explaining how the government would mandate that companies build infrastructure and then leverage that dominance globally. "Every country is gonna buy. That's a great business model."

This alignment between corporate power and state interests creates pressure on regulators to approve expansions of market dominance despite competitive harms. The researchers emphasize urgency for authorities to address these risks before they compound further. "The dynamic nature and the increasing political weight of big tech companies mean that governments and regulators are likely to come under even more pressure to allow further expansion of market power, with many negative economic, political and geopolitical implications," the paper states.

Google's Wiz acquisition announcement emphasized how the combination would strengthen cloud security across multiple platforms beyond Google's own infrastructure. According to the March press release, "Wiz's products will continue to work and be available across all major clouds, including Amazon Web Services, Microsoft Azure, and Oracle Cloud platforms, and will be offered to customers through an array of partner security solutions." The company committed to supporting packaged applications, SaaS applications, and infrastructure running on virtual and on-premises environments.

This multi-cloud strategy positions Wiz differently from typical vertical integration where an acquirer leverages dominance in one market to advantage its own products in adjacent markets. Wiz's value proposition depends on maintaining interoperability across competing cloud platforms. However, the researchers question whether this neutrality stance will persist under Google ownership given prior patterns where the company integrated acquired assets into proprietary ecosystems.

Cloud market dynamics and cybersecurity consolidation

The global public cloud services market was estimated at nearly $600 billion in 2024, with the three major US providers commanding approximately two-thirds market share. Worldwide business spending on cloud infrastructure continues accelerating as organizations adopt artificial intelligence capabilities that require substantial computing resources. Google has emphasized cybersecurity as critical to cloud computing competition, particularly as businesses deploy AI systems across their operations.

Google's existing cybersecurity portfolio includes Mandiant for incident response and threat intelligence, Google Threat Intelligence for detailed attacker analysis, and Google Security Operations for collecting telemetry data and driving automated responses. These services operate primarily in the "right of boom" space after security incidents occur. Wiz would complement them with "left of boom" prevention capabilities, creating what Google described as "a next-generation unified security platform that combines Wiz's Cloud Security Platform with Google Security Operations."

The announcement detailed how the combination would deliver "unified security platform, threat intelligence, new threat protection, AI agents, Mandiant cybersecurity professionals, and measurable defense" capabilities. Google positioned this comprehensive offering as addressing the reality that "most deployments are now multicloud or hybrid – introducing complex management challenges" while "software and AI platforms are becoming deeply embedded across products and operations, bringing new and evolving risks."

Wiz has grown spectacularly since its 2020 founding, achieving what Google called a "classic tech unicorn" trajectory. The platform rapidly scans customer environments to construct comprehensive graphs of code, cloud resources, services, and applications along with connections between them. It identifies potential attack paths, prioritizes critical risks based on impact, and empowers developers to secure applications before deployment.

According to Google, Wiz represents innovation in creating new cybersecurity categories over the past 12 months, including "code-to-cloud security and cloud-native runtime defense." The company has been widely adopted across enterprises seeking to monitor security posture across multiple cloud providers without maintaining separate security tools for each platform.

Regulatory review timeline and enforcement history

Since 2004, only four Google acquisitions have been formally reviewed by the European Commission. Three received unconditional approval—DoubleClick, Motorola Mobility, and Photomath—while Fitbit was approved with commitments. The Google/Wiz filing represents less than 2% of the more than 250 acquisitions Google has completed over the recorded period, according to the research.

Very important transactions escaped Commission review entirely. Google's 2014 acquisition of British AI company DeepMind, which developed the Gemini generative AI system, was not reviewed despite its strategic significance. The researchers note that thresholds triggering mandatory review focus on turnover, potentially underestimating importance of fast-growing companies with limited current revenue but significant competitive potential.

Even when reviews occur, the analytical frameworks employed have systematically failed to identify harms from vertical integration. The paper argues that only changing assessment tools will improve enforcement outcomes, suggesting that accounting and financial analysis approaches ground analysis in business realities better than abstract theoretical models.

The European Commission has recently demonstrated willingness to specify structural remedies in merger decisions. In its September 2025 statement of objections regarding Google's advertising technology practices, the Commission indicated concerns could only be resolved if Google ceded control of market-leading ad tech tools. This represented an unprecedented move toward structural interventions rather than behavioral commitments.

However, Google submitted formal responses rejecting structural remedies on November 13, 2025, proposing instead behavioral changes around pricing rules and interoperability. The company has challenged European Digital Markets Act enforcement claims, arguing compliance efforts degrade services for European users. Those proceedings continue alongside parallel antitrust cases in United States federal courts.

Pattern spans decades of advertising technology dominance

Google's dominance in digital advertising traces directly to the DoubleClick acquisition that regulators approved in 2008 without conditions. Internal company documents revealed during subsequent antitrust proceedings show Google implemented systematic manipulation programs including Projects Bernanke, Poirot, and Sunday beginning in 2013. These programs altered auction mechanisms to advantage Google's own advertising services while suppressing competitors.

Judge Leonie Brinkema ruled on April 17, 2025, that Google "willfully engaged in a series of anticompetitive acts to acquire and maintain monopoly power" in publisher ad server and ad exchange markets. That finding has triggered wave of follow-on litigation as publishers and ad tech companies seek damages for more than a decade of allegedly monopolistic conduct.

Multiple companies including Index Exchange, Dotdash Meredith, PubMatic, and Magnite have filed comprehensive antitrust lawsuits seeking substantial monetary damages. The complaints allege Google's systematic anticompetitive conduct prevented fair competition in markets worth over $104 billion annually. Federal prosecutors simultaneously pursue structural remedies including forced divestiture of Google's AdX advertising exchange.

The pattern established through advertising technology enforcement raises questions about whether regulators will apply lessons learned to the Wiz acquisition. The academic researchers emphasize that Google's proposed purchase of Wiz would be "an important test case to start enforcing properly" after past failures.

Investment strategy shifts regulatory scrutiny challenges

Beyond direct acquisitions, Google's extensive investment network creates dependencies that escape regulatory review. The research documents how Google invested in or supported more than 5,900 companies through 2024, far exceeding activity by Amazon, Apple, Meta, and Microsoft combined during the same period. Google for Startups provides funding, cloud credits, and other support creating relationships with emerging technology companies across the digital economy.

This below-the-radar expansion strategy allows Google to shape innovation trajectories and establish partnerships without triggering merger review thresholds. Many startups receiving Google support do not involve equity investments but rather in-kind assistance including free cloud infrastructure credits. No comprehensive data exists on how many companies received such support without also receiving direct investment, suggesting the researchers' figures represent lower bounds of Google's actual influence.

The European Union's Digital Markets Act requires designated gatekeepers including Google to report all acquisitions regardless of whether they meet standard notification thresholds. However, the Commission is only informed about rather than automatically tasked with reviewing these transactions. The legislation does not address investment relationships or support programs that create dependencies without ownership stakes.

For the Wiz transaction specifically, the filing with the European Commission begins the formal review clock. Regulators can request additional information from Google and interested third parties during the preliminary review period. If serious concerns emerge, the Commission can extend review into a full Phase II investigation lasting several additional months.

The researchers recommend that competition authorities conduct systematic reviews of Google's investments and partnerships when assessing market power in any ongoing or future cases. They suggest updated legislation and procedures to capture expansion that currently escapes scrutiny through investment rather than acquisition strategies.

Global cloud security market and competitive dynamics

The cybersecurity industry has experienced consolidation as organizations seek comprehensive protection across increasingly complex IT environments. Traditional security approaches struggle to address multi-cloud deployments, embedded AI systems, and sophisticated threat actors. Companies that can offer integrated security across prevention, detection, response, and recovery gain competitive advantages.

Google emphasized these dynamics in announcing the Wiz acquisition. "Traditional approaches to cybersecurity struggle to keep up with this evolving landscape," Kurian stated. "Organizations with modern IT environments need a cybersecurity solution that spans multiple clouds, as well as hybrid and on-premises environments; that can protect against threats to and from AI models; that can use AI to extend defenses; and that can fully integrate software development and operations into the security portfolio."

The announcement positioned Google and Wiz as sharing "a vision to improve security by making it easier and faster for organizations of all types and sizes to protect themselves, end-to-end, across all major clouds." Google's infrastructure leadership, AI expertise, and security innovation record would enhance Wiz's solutions and scalability, potentially protecting more organizations faster, according to the company.

This framing emphasizes benefits to customers and broader ecosystem rather than Google's competitive positioning. The company argued the combination would "help spur the adoption of multicloud cybersecurity, the use of multicloud, and competition and growth in cloud computing." Google committed to continuing partnerships with other leading cloud security providers in its marketplace to offer customer choice.

System integrators, resellers, and managed security service providers would gain opportunities to offer broader solutions and services to customers, while technical partners would find new integration opportunities, according to the announcement. Google pledged "full and longstanding commitment to industry standards and the open source community."

Academic researchers call for enforcement watershed moment

The November research paper emphasizes that "there is no time to lose in addressing these risks" as Google's market power increasingly merges with US geopolitical interests. The researchers argue regulatory authorities face mounting pressure to approve further expansion despite competitive harms, making the Wiz transaction a critical test of whether past enforcement failures will inform current decisions.

The analysis challenges fundamental assumptions underlying merger review processes. Industrial Organization economics models that regulators have relied upon for two decades systematically obscure vertical integration harms while creating nearly impossible hurdles for intervention. The researchers advocate for accounting and financial analysis approaches that examine actual business operations rather than abstract theoretical constructs.

"If regulators rely on the same theoretical IO economics as they did before, which is singularly ill-equipped to deal with vertical issues, they risk to fail again to identify the true harms from the proposed acquisition," the paper states. The authors note that Google's power over digital markets infrastructure and dynamics likely exceeds previously documented levels given the extensive investment network that has remained largely unexamined.

The paper was published on arXiv on November 4, 2025, and subsequently highlighted by researchers and competition policy experts. Aline Blankertz, who posted about the research on LinkedIn in early January, described the Google/Wiz merger as requiring urgent regulatory attention. "The deadline for deciding whether to approve or open a phase II investigation is February 10. It would be completely absurd not to open a phase II given the huge anti-competitive concerns about the deal," Blankertz wrote.

The post emphasized lessons from past mistakes including the Google/DoubleClick approval. "We urgently need to learn from past mistakes (like Google/DoubleClick) and start enforcing again!" Blankertz stated, calling for the European Commission to act. The research and advocacy represent growing pressure on regulators to apply scrutiny to the Wiz transaction commensurate with its scale and strategic significance.

What marketing professionals should watch

For digital marketing and advertising technology professionals, the Wiz acquisition decision carries implications extending beyond immediate cybersecurity considerations. The transaction tests whether regulatory authorities will approve continued expansion of Google's integrated platform spanning search, advertising, cloud infrastructure, and now comprehensive security services.

Historical patterns suggest behavioral commitments prove ineffective at constraining dominant platforms' ability to leverage acquisitions for competitive advantage. The Fitbit case study demonstrates how commitments designed around anticipated business strategies become irrelevant when actual post-acquisition integration follows different paths. Structural remedies including blocked mergers or required divestitures offer more durable protection but face political and analytical hurdles.

The broader context includes ongoing enforcement actions addressing Google's advertising technology monopolization, search dominance, and platform practices. Multiple jurisdictions pursue parallel cases that could reshape Google's business model fundamentally. The Wiz decision arrives amid this heightened scrutiny but also during period of increasing alignment between technology companies and government interests that may pressure regulators toward approval.

The February 10 deadline approaches rapidly. European Commission officials have not publicly commented on the review timeline or likelihood of opening Phase II investigation. Industry observers note that deals of this magnitude and strategic importance typically receive extended scrutiny, particularly when well-documented concerns about vertical integration exist and academic research specifically identifies risks.

The outcome will signal whether competition authorities have learned from past enforcement failures or will repeat analytical mistakes that enabled Google to monopolize digital advertising markets. For an industry watching consolidation across advertising technology, cloud computing, and artificial intelligence infrastructure, the Wiz decision represents a potential inflection point in how regulators approach platform power.

Timeline

• 2007-2008: Google acquires DoubleClick for $3.1 billion, obtaining dominant ad server and exchange; US and European regulators approve without conditions
• 2013-2016: Implementation of Projects Bernanke, Poirot, and Bell for market manipulation in advertising technology
• 2020: Wiz founded, beginning rapid growth to cloud security platform
• December 2020: European Commission conditionally approves Google's $2.1 billion Fitbit acquisition
• January 2023: US Department of Justice files antitrust lawsuit targeting Google's advertising technology practices
• June 2023: European Commission files case seeking to break up Google's advertising technology business
• April 17, 2025: Judge Brinkema rules Google monopolized digital advertising markets through willful anticompetitive conduct
• March 18, 2025: Google announces $32 billion definitive agreement to acquire Wiz
• August-November 2025: Multiple publishers and ad tech companies file follow-on antitrust lawsuits against Google seeking damages
• September 5, 2025: European Commission fines Google €2.95 billion for advertising technology violations
• November 4, 2025: Researchers publish "Google's Hidden Empire" documenting 6,000+ company investment network
• November 2025: Google/Wiz acquisition receives US regulatory approval
• January 7, 2026: Google files Wiz acquisition with European Commission
• February 10, 2026: Deadline for European Commission preliminary decision on Google/Wiz transaction

Summary

Who: Google LLC (Alphabet Inc.) seeks to acquire Israeli-American cloud cybersecurity company Wiz for $32 billion in its largest-ever acquisition. Academic researchers Aline Blankertz, Brianna Rock, and Nicholas Shaxson published analysis warning of competitive risks. European Commission antitrust regulators will decide whether to approve the transaction.

What: The acquisition would give Google comprehensive cybersecurity capabilities spanning prevention through incident response across multi-cloud environments. Wiz provides security monitoring allowing enterprises to protect infrastructure across Amazon AWS, Microsoft Azure, Google Cloud, and Oracle Cloud simultaneously. Researchers warn the deal presents vertical integration concerns similar to Google's 2008 DoubleClick acquisition that enabled subsequent advertising monopolization.

When: Google announced the transaction March 18, 2025, and filed with European Commission January 7, 2026. Regulators face February 10, 2026, deadline to decide whether to approve deal in preliminary review or open full Phase II investigation. The announcement came amid ongoing antitrust enforcement following April 2025 federal court ruling that Google monopolized digital advertising markets.

Where: The transaction requires approval from European Union competition authorities and received United States regulatory clearance in November 2025. Wiz operates globally providing security services to enterprises across more than 100 countries. Google holds approximately 11-12% of worldwide public cloud services market while competing with larger Amazon Web Services and Microsoft Azure platforms.

Why: Google positions the acquisition as addressing accelerating cybersecurity threats that organizations face across increasingly complex multi-cloud and AI-integrated environments. Researchers argue the deal would extend Google's market power vertically into comprehensive security offerings while establishing invasive presence in corporate systems. The transaction tests whether regulators will apply lessons from past enforcement failures that enabled Google to monopolize digital advertising through DoubleClick acquisition that authorities approved without restrictions despite similar vertical integration warnings.