Research · October 30, 2026

Upwind's $400M Series C — Runtime Security for the Agentic Era

Upwind closed a $400 million Series C at a $3.8 billion valuation to expand its runtime-based security platform for cloud workloads, APIs, and AI agents.

What happened

On October 28, 2026, Upwind Security announced the close of a $400 million Series C funding round at a $3.8 billion valuation. The round was led by Bessemer Venture Partners. Canapi Ventures joined as a new investor, alongside existing investors Cyberstarts, Greylock Partners, Craft Ventures, Leaders Fund, Salesforce Ventures, TCV, Alta Park Capital, Penny Jar Capital, Cerca Partners, Swish Ventures, and Picture Capital.

The company said the funding will support continued product development and go-to-market expansion. Total funding since its 2022 founding now exceeds $800 million, according to the company's announcement as reported by Securities.io and SiliconReport.

Why the pace matters

The Series C comes less than nine months after Upwind's $250 million Series B in January 2026, which was also led by Bessemer and valued the company at $1.5 billion. The valuation has therefore more than doubled in 2026, from $1.5 billion to $3.8 billion, while the company says its revenue quadrupled during 2026. Both the valuation step-up and the revenue claim are company-reported figures from the announcement, not independently audited results, and this article does not convert them into a revenue estimate or a valuation judgement.

Upwind was founded in 2022 in San Francisco by Amiram Shachar and colleagues from Spot, the cloud infrastructure optimization company NetApp acquired. Its premise is that cloud security should be judged on what is actually running inside live environments, rather than on periodic scans and static snapshots.

What the platform does

Upwind's Cloud and AI Security Platform combines runtime intelligence — data gathered from cloud workloads, application programming interfaces, and AI agents while they are running — with context about which exposures are actually reachable. The company says this gives security, development, and DevOps teams a shared view of the most critical risks, how to fix them, and attacks as they happen.

The platform supports Amazon Web Services, Microsoft Azure, Google Cloud Platform, and Oracle Cloud Infrastructure, and can be accessed inside the AWS console through an AWS Security Hub integration, with billing through the customer's AWS account. The company says hundreds of organizations use the platform, and names Siemens, Roku, Carvana, Nubank, Supabase, and ClickUp among them.

The announcement also describes three AI agents the company uses to amplify security teams: the Blue Agent investigates across log sources and data points to build a single attack story; the Red Agent verifies whether exposures and vulnerabilities are actually exploitable in the customer's environment; and the Green Agent finds the pressure points where fixes can remediate large numbers of findings. In September 2026, the company launched its AI Lab for Cybersecurity, with initial focus areas including security for AI, agentic security, frontier models and benchmarks, and advanced AI systems.

What this does not show

A funding round is not a product result. The announcement discloses no audited revenue figure, no customer count beyond "hundreds of organizations," no headcount update, and no timeline for profitability or a public listing. The "fastest-growing" and "most capitalized" framings in the announcement are the company's own characterizations and are not repeated here as findings. What is verifiable is the financing itself: a $400 million close, a named lead investor, a stated valuation, and a stated use of proceeds — product development and go-to-market expansion.

For BlitzLab's purposes, Upwind is a candidate to watch, not a scored company. It is unlisted, so it carries no BlitzLab score, and this article makes no scoring claim about it. The relevant question for a future assessment is whether runtime context becomes a durable advantage — a moat built on live-environment data and remediation speed — or whether the large cloud providers and incumbent security vendors absorb the same capability into their own platforms. The next evidence will be customer retention and expansion, not the next funding headline.

Sources