After an extensive six-month evaluation period, we recently completed the migration of thirty Google Cloud Platform projects—spanning development, staging, and production environments for a suite of internal B2B applications—to the Wiz security platform. The primary motivators were the promise of unified cloud security posture management (CSPM), vulnerability management across containers and VMs, and the agentless deployment model. Like many, we were initially drawn by the simplified pricing narrative often presented, which suggests a linear and predictable cost based on cloud provider spend. Our actual financial outcome, however, diverged significantly from this model.
Our infrastructure is moderately complex, featuring:
* A mix of Compute Engine VMs and GKE clusters (auto-scaling node pools).
* Cloud SQL (PostgreSQL) instances, Memorystore for Redis, and BigQuery datasets.
* Pub/Sub topics and subscriptions forming an event-driven backbone.
* Cloud Storage buckets with varying data access patterns.
The initial quote was calculated as a percentage of our committed GCP monthly spend. The reality post-migration revealed several critical cost drivers that were either under-emphasized or entirely opaque during the sales cycle:
* **Resource Counting Methodology:** Wiz counts *every* uniquely identifiable resource, including dormant objects. We discovered charges for:
* Stopped Compute Engine instances (retaining their boot disks).
* Individual Cloud Storage objects exceeding a certain count threshold within buckets, not just the buckets themselves.
* Every single Pub/Sub subscription and topic, each counted as a discrete resource.
* **The "Seat" Expansion:** While the platform is agentless, full operational access for our platform engineering and security teams required more user seats than initially scoped. The per-seat cost for advanced features like GraphQL API access and custom policy creation added a substantial 22% overrun to our base fee.
* **Data Scanning Costs:** The CSPM component has a defined cost, but proactive vulnerability scanning of container registries and VM disks incurred additional data processing charges that were not clearly itemized in the preliminary estimate. This was particularly impactful for our large, frequently updated container images.
A simplified breakdown of our first full month versus projection:
```plaintext
Projected Monthly Cost (based on % of GCP spend): $8,500
Actual Invoiced Cost: $12,700
Variance: +49.4%
Breakdown of Delta:
- Base CSPM (aligned with projection): $8,500
- Additional Resources (dormant VMs, Pub/Sub, granular storage): $2,100
- Extra User Seats for full API/Platform access: $1,400
- Data Scanning Operations (container/disk): $700
```
The technical implementation itself was smooth, and the GraphQL API for extracting findings is indeed powerful for integration into our existing orchestration middleware. The value of the visibility is not in question. However, the pricing model's complexity rivals the cloud bills it aims to clarify. For engineering leaders considering a similar migration, I recommend:
1. Conducting a detailed resource inventory using Wiz's own pre-sales tools, explicitly accounting for all IaaS/PaaS objects, not just active compute.
2. Negotiating a clear cap or inclusion for data scanning operations in the contract.
3. Defining "user" roles and access needs upfront, as API-driven automation may require dedicated service accounts counted as seats.
The platform delivers profound insight, but the journey from a percentage-based headline to the final invoice is fraught with granular, additive line items. One must approach the cost model with the same rigor one applies to cloud cost optimization itself.
— Harper
— Harper