Upwind Raises $400M to Turn Its Runtime Cloud Security Into a Platform Run by Blue, Red and Green AI Agents

Most cloud security tools take a snapshot of an environment and hand back a list of findings. Upwind’s bet is that the useful signal comes from watching what is actually running, and that AI agents should act on it rather than just file tickets. On October 28, 2026, the company announced a $400 million Series C led by Bessemer Venture Partners, at a valuation it puts at $3.8 billion.

Canapi Ventures joins as a new investor. Upwind’s release lists existing backers Cyberstarts, Greylock Partners, Craft Ventures, Leaders Fund, Salesforce Ventures, TCV, Alta Park Capital, Penny Jar Capital, Cerca Partners, Swish Ventures and Picture Capital as taking part, and co-founder and chief executive Amiram Shachar wrote that every existing investor came back. He put total funding at more than $800 million.

Nine months from Series B to Series C

The round lands less than nine months after Upwind’s $250 million Series B in January 2026, which Bessemer also led. Upwind says that round valued it at $1.5 billion, so by the company’s own figures its valuation has grown about 2.5 times this year.

The growth claim behind that jump is also the company’s own. Upwind says it has quadrupled its revenue in 2026, but it did not publish revenue, recurring-revenue or customer-count figures. Its boilerplate says “hundreds of organizations” use the platform and names Siemens, Roku, Carvana, Nubank, Supabase and ClickUp. Shachar’s post goes further, calling Upwind “the fastest growing company in modern cloud & AI security,” a claim the company does not back with data.

Upwind was founded in 2022. Bessemer’s January post on the Series B names the founders as Shachar, chief technology officer Tal Zur and growth chief Lavi Ferdman.

Watching live workloads instead of scanning snapshots

Upwind sells what it calls a Cloud and AI Security Platform that works “from the inside-out.” Lightweight sensors sit inside workloads and record network, process and container activity. The platform then combines that runtime data with context about the customer’s cloud workloads, APIs and agents to decide which vulnerabilities are actually reachable and which attacks are happening now.

The release contrasts this with tools built on periodic assessments and static snapshots. Customer quotes make the same point. Michael Cannizzo, CISO of HedgeServ, says Upwind showed “what is actually running, not just what a scan found.” Russ Kirby, CISO of Ping Identity, says setup took days.

Upwind supports AWS, Microsoft Azure, Google Cloud and Oracle Cloud Infrastructure. Through AWS Security Hub, AWS customers can use it from inside the AWS console and pay through their AWS bill.

Three agents, one pack leader

The AI part of the pitch is a set of specialised agents that Upwind sells as its Agentic Pack:

• Blue Agent investigates across log sources to assemble one attack story and handle exploitation attempts at runtime.
• Red Agent tests whether exposures and vulnerabilities are actually exploitable in the customer’s environment.
• Green Agent looks for a few shared root causes, such as a base image or a repeated misconfiguration, where one change clears many findings at once, and proposes fixes in code, infrastructure-as-code, packages and images.

A conversational control layer called Choppy ties the three together.

Upwind’s own research shows why remediation is the hard part. On October 19 its researchers described a deliberately broken AWS account with 18 graded findings chained into nine attack paths. They gave 12 AI models read-only access and asked each for a fix plan. By Upwind’s grading, which used an LLM to apply the rubric with researcher review, eight of the 12 plans would have broken production, and most looked right on paper. Upwind says most failures came from missing runtime context, the gap Green Agent is meant to fill.

From code-to-cloud to endpoint-to-cloud

Shachar says the new money goes into product and engineering. His list includes AI sensors for endpoints, scanners for agents and agent skills, and a rebuilt inventory graph. “It’s not about Code to Cloud anymore, it’s about Endpoint to Code to Cloud,” he wrote. He also plans to expand into identity, data and AI security, and the release adds go-to-market expansion.

The company has also launched an AI Labs for Cybersecurity with four focus areas: AI security, agentic security, frontier models, systems and benchmarks, and advanced AI systems.

For buyers, Upwind is now selling on AI agents as much as on runtime visibility. The figures that would show how fast that is working, such as revenue in dollars, customer counts and agent results in production, are still Upwind’s to disclose.