Consolidation continues apace in the world of security. Sources tell us that Lacework — a cloud security startup that was valued at $8.3 billion post-money in its last funding round — is in talks to be acquired by another security player, Wiz, for a price of just $150 million to $200 million.

Sources close to the negotiations said that the two companies have already signed a letter of intent and described the state of negotiations as “somewhere in the middle.” That is to say, the acquisition is not yet completed and the deal could still fall through.

Although both work in the wider area of cloud security, sources tell us that there is relatively little competitive overlap between the two companies, so it would likely be a technology-plus-talent-plus-customer acquisition play. We are still trying to find out more terms of the deal, such as whether it would be in stock, cash or a mix.

Contacted for comment, Wiz would not confirm nor deny the reports on the record but provided the following statement to TechCrunch:

“Wiz has experienced unprecedented organic growth since its inception, and we are dedicated to pushing this growth even further. Simultaneously, we recognize that consolidation is the future of the security industry and therefore are actively engaged in discussions with companies across the industry. We are always exploring compelling M&A opportunities that will enhance both our technological capabilities and business expansion, as we strive to build the world’s leading cloud security platform.”

Wiz’s CEO and co-founder Assaf Rappaport — who co-founded and sold a previous security startup, Adallom, to Microsoft — has said on a number of occasions (such as here) that Wiz is looking to hit $1 billion in annual recurring revenue ahead of an IPO. We understand that its soft deadline is the end of 2025, but considering it announced ARR of only $350 million in February 2024, the company has to get aggressive to reach its goal. Lacework, we understand, has ARR of around $100 million.

The Information has reported some of the above details today, too.

The deal underscores a story of two parts.

Part one: Security startups continue to attract a lot of funding attention, but some companies that have reached high valuations over recent years are struggling to justify those numbers and are considering their options as they come close to the end of their funding runway.

From what we understand, Lacework’s investors — the longer list includes Snowflake Ventures, GV, General Catalyst, Tiger Global and many more — were shopping the company around to potential buyers, which is how Wiz came into the frame.

Lacework, we should note, is not the only security business getting a valuation haircut. Just last week, TechCrunch broke the news that Noname was in talks to be acquired by Akamai for $500 million, after last being valued at $1 billion.

Part two: Other players are emerging as consolidators in this process. Wiz — valued at around $10 billion — is one of them.

The company is positioning itself as a one-stop shop for all things cloud security en route to its IPO. Earlier this month Wiz acquired Gem Security for $350 million, and it sounds like the M&A will not end with Lacework.

Lacework, founded nearly nine years ago and based in San Jose, California, has raised over $1.8 billion from investors over the years. Most of that funding — $1.3 billion — ties to a late November 2021 round that, at the time, valued the company at $8.3 billion.