We just completed our quarterly cloud spend review, and our Wiz bill has increased by approximately 187% compared to the previous quarter. The only material change was the phased enablement of the new "advanced" modules over that period: Attack Path Analysis, Advanced CSPM, and the Internal Developer Portal. While the value proposition was pitched as "context," the operational cost is now a serious point of contention.
The billing model appears to shift from a primarily asset-based count to one heavily influenced by graph relationships and continuous control evaluations. Enabling Attack Path Analysis, for instance, didn't just add a feature; it seemingly multiplied the underlying data points scanned and correlated per asset. Our bill breakdown now shows new, opaque line items:
* **"Cloud Configuration Relationships Scanned"**: This exploded after Advanced CSPM. Every VPC, subnet, security group, and IAM role permutation is now a billable event.
* **"Inter-resource Graph Nodes"**: A direct result of the attack path engine. The bill implies we're being charged for the *potential* paths between resources, not just the resources themselves.
* **"Continuous Control Evaluations"**: The volume of checks per hour seems to have increased dramatically with these modules, where previously we had scheduled scans.
The core issue is the lack of predictable, transparent cost forecasting. The sales engineering team provided vague assurances that "usage will scale with your environment," which is technically true but practically useless for budgeting. There was no clear explanation that enabling these features would fundamentally change the *unit* of billing, not just add a flat premium.
Has anyone else done a detailed before/after analysis? I'm looking for concrete data points, not feelings. Specifically:
* What was the percentage increase in your bill after enabling each advanced module?
* Has anyone successfully mapped their cloud inventory count (e.g., number of EC2 instances, containers, cloud accounts) to the new Wiz billing metrics?
* Are there specific configuration thresholds in Wiz that trigger exponential cost growth? For example, does having over 500 IAM roles in a single account cause a step-function increase in "relationship" calculations?
I'm preparing a report for our procurement and security leadership. The value of the tool is not in question, but the cost efficiency and predictability certainly are. If this pricing model is consistent, many enterprises will hit a hard ROI ceiling quickly.
—davidr
—davidr
That's a huge jump. We're just starting our own evaluation of Wiz. Your breakdown about graph nodes and relationships being billable is really concerning.
When they demoed these modules to us, the cost impact wasn't clear at all. Did your account team give you any warning about this kind of billing model shift before you enabled everything, or was it all in the fine print?
We were looking at Attack Path Analysis specifically, but now I'm worried.
It's a fair question. In my experience, the billing specifics often *are* in the documentation, but the practical impact isn't always emphasized during demos. The shift to graph-based billing can be subtle until you see it on an invoice.
For your evaluation, I'd suggest a very controlled, module-by-modable pilot. Enable Attack Path for a single, defined project or workload and monitor the billing metrics for that specific resource for a full month. That'll give you real data on the cost per asset before any org-wide commitment.
It turns the demo promise into something you can actually measure.
Yeah, the demo we saw didn't cover the cost impact either. It was all about the security benefits, which are great, but the billing model felt like an afterthought.
I think user1528's idea about a pilot is smart. We might try that too, on just one team's project. It's frustrating that you have to reverse engineer the pricing yourself though.