Upwind closed a $400 million Series C at a $3.8 billion valuation, about nine months after its Series B. The round is a bet that security teams will keep choosing an independent, runtime-first cloud security platform while the large platform vendors consolidate.
What Is Covered in This Article:
- The round: Upwind raised $400 million at a $3.8 billion valuation, led by Bessemer Venture Partners, about nine months after its Series B.
- Runtime as the draw: Runtime context shows which findings are actually reachable, and Upwind has emerged as a key independent option after Google’s acquisition of Wiz.
- The independence bet: The capital has to prove buyers will pay for independence at scale; 41% of organizations already run a mix of platform and point offerings.
- Integration decides displacement: Practitioners rank integration and compatibility among their top priorities for cloud-native application protection platforms (CNAPPs), so winning share depends on fitting the workflows teams already run.
- Questions for buyers: Measure runtime reprioritization in a proof of concept, and ask which commitments survive a change of ownership.
The News: Upwind Security announced it has closed a $400 million Series C round at a $3.8 billion valuation, led by Bessemer Venture Partners. Canapi Ventures joins as a new investor, alongside returning backers that include Greylock Partners, Cyberstarts, Craft Ventures, Salesforce Ventures, and TCV. The round was first reported at $300 million in September and grew by $100 million before closing. It follows a $250 million Series B in January 2026 at a $1.5 billion valuation and brings total funding to more than $800 million. Upwind says the capital will go toward product and engineering, including expansion into identity, data, and AI, along with a broader go-to-market push.
Founded in 2022 and headquartered in San Francisco, Upwind has a large presence in Israel, where roughly 240 of its approximately 550 employees are based. The company sells a cloud and AI security platform built on runtime data from cloud workloads, application programming interfaces (APIs), and AI agents. The platform runs on Amazon Web Services (AWS), Microsoft Azure, Google Cloud, and Oracle Cloud Infrastructure, and AWS customers can buy it through their AWS account via an AWS Security Hub integration. The company says its revenue has quadrupled in 2026, without disclosing figures, and it is building AI agents to investigate threats, validate attack-surface findings, and remediate risks.
The round follows Upwind’s September acquisition of Aegis, a nine-month-old Israeli AI security startup, in a stock deal that market sources estimated at around $30 million (terms were not disclosed). The Aegis founders now lead the new Upwind AI Security Lab.
Upwind’s $400M Series C Is a Bet on Independent Cloud Security
Analyst Take: Funding rounds are, by design, the vendor’s moment, but this one comes with more context than most. Upwind closed the round days after Globes, citing The Information, reported that the company had turned down an acquisition offer from Datadog in the $4 billion range, which the funding announcement does not mention. If accurate, the founders and investors chose independence over an exit, and an observability vendor looked at runtime cloud data and saw a security business, a sign of how close running production and defending it have become.
Runtime Context and the Seat Wiz Left Open
Upwind has emerged as a key independent vendor in cloud security following Google’s acquisition of Wiz, and timing is only part of the reason. Its runtime-first design answers a question most cloud security programs struggle with: of the thousands of findings a scan produces, which ones are loaded, reachable, and in use? Runtime data is a cheap and repeatable test for that, and the customer comments Upwind chose to publish with the round are, tellingly, about which risks their teams stopped spending time on.
There is a cultural point as well. Security teams often like their own tools, chosen by and for them, rather than whatever arrives bundled with a cloud provider or an adjacent platform. Our data suggests that preference is not going away: in the Futurum 1H2026 Cybersecurity Decision-Makers Survey (N=929), 41% of organizations describe their security stack as a mix of platform and point offerings.
The Independence Bet
The money now has to prove that independence is something buyers will pay for at scale, not just appreciate. Google (with Wiz), AWS, Palo Alto Networks, CrowdStrike, and Microsoft can fold cloud security into agreements customers already hold, independents such as Orca Security and Sysdig make their own runtime arguments, and Datadog’s reported interest shows observability vendors want in as well. Because many buyers already own some cloud security capability, much of Upwind’s growth has to come from replacing tools rather than filling empty slots.
That is where integration matters. In the May 2026 CNAPP Observatory from ETR, part of Futurum (N=300), practitioners named integration and compatibility as their second most cited priority (38%), behind only visibility and detection (47%). For a vendor asking to replace incumbents, that is the bar to clear.
Three Ways AI Meets Security
We find it useful to separate three conversations the market tends to blend under “AI security”: AI for security (using AI to do security work), security for AI (protecting the models, agents, and data an enterprise deploys), and security from AI (defending against attackers who use it). Upwind’s plans touch all three.
Its Blue, Red, and Green agents, for investigation, exploit validation, and remediation, are AI for security. That pattern is now common, with Wiz, CrowdStrike, and others offering similar red-team and blue-team agents, so the agents alone are unlikely to set Upwind apart; the runtime data underneath them might. Remediation also raises an ownership question: when an agent changes production infrastructure, someone has to own the outcome.
The AI Security Lab and the planned agent and skills scanners point at security for AI, while the announcement’s argument about speed is, at heart, about security from AI.
What This Means for Buyers and Vendors
In a proof of concept, measure the reprioritization. Ask what share of existing findings runtime data downgrades or escalates in your own estate, and what sensor coverage that number assumes.
At contract time, plan for a change of ownership. With consolidation this active, ask which data portability and roadmap commitments hold if the vendor is acquired.
Upwind’s hurdle is showing the displacement. That means evidence that customers retired tools, not just added one, and that the platform slots into the detection, ticketing, and identity workflows they already run.
What to Watch:
- Does the endpoint sensor ship, and how is it packaged? Upwind’s “endpoint to code to cloud” scope moves it toward endpoint vendors’ ground; pricing will show whether that is a platform feature or a new front.
- Which AI lens does Upwind lead with? Watch whether the AI Security Lab’s first releases protect AI workloads and agents, extend its own agents, or address AI-assisted attacks; each reaches a different buyer.
- What evidence backs the agents? Published results on how often the validation agent confirms or rejects a finding, or how remediation changes are reviewed, would separate Upwind’s agents from similar offerings.
- Which acquisition comes after Aegis? Upwind has signaled more AI-focused deals, some of which could grow the AI Security Lab; the next target will show where the company judges building too slow.
For more information, read the full announcement from Upwind.
Declaration of generative AI and AI-assisted technologies in the writing process: This content has been generated with the support of artificial intelligence technologies. Due to the fast pace of content creation and the continuous evolution of data and information, The Futurum Group and its analysts strive to ensure the accuracy and factual integrity of the information presented. However, the opinions and interpretations expressed in this content reflect those of the individual author/analyst. The Futurum Group makes no guarantees regarding the completeness, accuracy, or reliability of any information contained herein. Readers are encouraged to verify facts independently and consult relevant sources for further clarification.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Read the full Futurum Group Disclosure.
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
