Aqua Security

Aqua Security is one of the original architects of cloud-native security, and its open-source foundation is a moat competitors cannot buy: Trivy is arguably the most widely deployed vulnerability scanner in the world, embedded in countless CI/CD pipelines and Kubernetes workflows, and Tracee brings eBPF-based runtime detection — a bottoms-up developer distribution engine that seeds the enterprise CNAPP sale. Aqua's platform secures the full application lifecycle from code to runtime across containers, Kubernetes, serverless, and cloud VMs, and its runtime-security heritage differentiates it in a CNAPP market that is over-indexed on posture scanning; when an attack is actually in progress, Aqua's runtime detection and blocking is genuinely differentiated capability. Having crossed a $1B valuation in 2021 and reached unicorn status again with a $60M Evolution Equity–led extension in early 2024, the company has the scale and installed base of a mature vendor. The November 2025 transition to CEO Mike Dube, the former president and CRO, with founders Dror Davidoff and Amir Jerbi moving to advisory roles, reads as a deliberate move toward a go-to-market-led, exit-ready phase. In a consolidating cloud-security market where every platform vendor wants runtime and supply-chain coverage, an established CNAPP pure-play with dominant open-source distribution and real runtime IP is both a durable independent and an obvious acquisition target.

Aqua has been comprehensively out-run by Wiz, whose agentless CNAPP redefined the category, hit a reported nine-figure-and-climbing ARR at extraordinary speed, and agreed to a landmark acquisition by Google — leaving earlier movers like Aqua looking flat-footed on the exact market they helped create. That is the core problem: Aqua raised its last meaningful round in 2021, and the modest $60M extension in 2024 at a flat ~$1B valuation signals a company that has stopped compounding while the market's growth accrued to newer architectures. CNAPP is now a bloodbath — Wiz/Google, Palo Alto Prisma Cloud, CrowdStrike, Microsoft Defender for Cloud, Orca, and Sysdig all attack the same budget, and the platform players increasingly bundle cloud security into deals Aqua cannot match on breadth. The open-source engine that drives adoption is also a monetization trap: Trivy's ubiquity does not convert cleanly to revenue when competitors and customers can use it free. A founder-to-operator CEO handoff in late 2025 amid this pressure often precedes a sale rather than a growth reacceleration, and a flat-valuation unicorn in a category defined by a $30B-plus acquisition may find its most likely outcome is a modest strategic exit, not the independent platform future the bull case imagines.