Revenue
Sacra estimates that Upwind hit $50M in annual recurring revenue (ARR) in September 2026, up from $20M at the end of 2025.
In its January 2026 Series B announcement, Upwind reported 900% revenue growth and 200% growth in its customer base over the prior year. Its enterprise customers include Siemens, Peloton, Roku and Nubank.
Upwind attributes adoption to reduced alert volume, using runtime signals to identify which vulnerable services are running and exposed in production. Customers reported 98% fewer security alerts and 60% fewer irrelevant CVEs, publicly catalogued software vulnerabilities that populate security backlogs. Those figures describe customer-reported alert reduction, rather than independently measured results across every deployment.
Valuation & Funding
Upwind raised a $250M Series B on January 26, 2026, at a reported $1.5B valuation. Bessemer Venture Partners led the round, with Salesforce Ventures and Picture Capital participating. The valuation was roughly 75x the $20M in ARR Sacra estimates Upwind had at the end of 2025.
The round brought total funding to $430M. Earlier investors include Cyberstarts, Greylock, Leaders Fund and Craft Ventures, providing a mix of cybersecurity expertise and enterprise software backing.
Amiram Shachar (CEO), Tal Zur (CTO) and Lavi Ferdman (SVP Growth) founded Upwind in 2022. They had previously built Spot.io, a cloud compute brokerage that NetApp acquired for about $450M in 2020. Headcount grew from 150 to more than 300 in the year before the Series B.
Product
Upwind sells cloud security software to enterprise security and DevOps teams running applications on clouds such as AWS and Azure. It uses data from running applications to identify which of the thousands of flagged weaknesses matter in production.
A team first connects its cloud accounts so Upwind can scan configurations and software images without installing anything. It then deploys a lightweight sensor on its servers and Kubernetes clusters, groups of machines that run containerized applications. The sensor records which programs run, which network connections open and which APIs receive traffic.
Upwind combines these events with cloud permissions and identities to build a live map of running services, showing how services communicate. While a configuration scan can identify a vulnerable library in a software image, data from running applications shows whether that library is loaded, reachable from the internet and able to access company data.
A security engineer uses the resulting shortlist of running, exposed, vulnerable code to trace the route an attacker could take and send the fix to the team responsible for the service. The same sensors flag live attacks, while AI agents released in 2026 help investigate alerts and prioritize fixes.
Business Model
Enterprises buy Upwind's cloud security platform to protect the applications and infrastructure they operate. Cloud marketplace listings provide an additional purchasing channel alongside direct enterprise sales; the company does not publish a standard price or enough contract detail to establish a uniform billing unit.
Delivering the service requires collecting, processing and storing events from customer environments, maintaining threat detections and helping teams deploy sensors. AI investigation agents add the cost of running models, while engineering, security research and sales require spending before a new contract pays it back.
Broader adoption can increase subscription revenue as customers protect more of their infrastructure or purchase additional capabilities. The economic question is whether that additional revenue exceeds the cloud processing and support costs it brings; fewer alerts can save customers time without necessarily proving higher gross margins for Upwind.
Competition
Upwind competes with Wiz, Palo Alto Networks, Orca Security, Sysdig and Aqua Security for budgets allocated to cloud-native application protection platforms (CNAPPs), which bundle configuration, vulnerability and workload security. AWS, Azure and Google Cloud also offer native tools. The central contest is deployment: agentless scanners connect through cloud APIs in minutes but assess workloads from outside, while sensors inside workloads see live behavior but require permission to run on production systems.
Agentless-first platforms
Wiz's agentless scanning lets security teams deploy without engineering approval, and it has since added runtime detection and response. Orca Security takes a similar agentless-first approach. Upwind argues that its runtime-first design prioritizes threats based on what is actually running, but installing sensors requires production access that agentless deployment avoids.
Platform consolidation
Palo Alto Networks sells Prisma Cloud and Cortex alongside firewalls and security operations tools to CISOs it already serves, giving it pricing leverage in consolidation deals. Against that bundle, Upwind competes on lower alert noise and a sensor that DevOps teams are willing to install.
Runtime security providers
Sysdig and Aqua Security started in container runtime protection and already deploy agents, so runtime visibility alone does not distinguish Upwind. Upwind instead competes on breadth, combining configuration, API, identity and AI workload security so customers can retire separate tools.
TAM Expansion
Upwind's runtime data gives it a route beyond identifying cloud configuration weaknesses into protecting AI applications and helping analysts investigate active attacks. These opportunities address AI platform and security operations spending, although turning additional capabilities into separate budgets requires more than adding features to an existing cloud security contract.
AI infrastructure security
Teams deploying AI agents need to know which tools an agent calls, what credentials it uses and which data it accesses. Upwind made AI Detection & Response generally available in July 2026, extending its existing sensors to map agent activity and flag behavior that departs from an established baseline.
This provides a potential entry into dedicated AI security spending as enterprises put agents into production. Existing workload and identity context can help Upwind explain what a compromised agent touched, but earning a separate AI security purchase depends on reliable detection and the ability to support the buyer's model and agent frameworks.
Security operations and incident response
Security operations teams need to reconstruct incidents and decide which systems or credentials to contain, rather than simply produce a list of configuration problems. Upwind's Blue investigation agent, introduced in May 2026, connects process activity, files, network connections, cloud identities and exposure information into an incident timeline that an analyst can review.
The company could compete for investigation and response budgets by supplying this evidence to teams already using separate log-analysis and case-management tools. Its advantage is context collected directly from running applications; to earn those budgets, it must fit analysts' existing workflows and demonstrate that investigations become faster without hiding important evidence.
Risks
Suite consolidation: Palo Alto Networks and Wiz can bundle runtime features into broader cloud and security operations contracts that CISOs already hold. Upwind must show that its prioritization saves enough analyst work to justify a separate vendor at renewal.
Sensor deployment friction: Upwind's advantage depends on installing sensors in production, which security teams often lack permission to do. Slow rollouts delay the alert reduction that justifies the purchase, while agentless rivals can show results without engineering approval.
Monitoring costs: Event streams and AI agent inference grow with every monitored workload and every new AI module. If contract pricing does not track that volume, adoption could shrink gross profit even as ARR rises.
DISCLAIMERS
This report is for information purposes only and is not to be used or considered as an offer or the solicitation of an offer to sell or to buy or subscribe for securities or other financial instruments. Nothing in this report constitutes investment, legal, accounting or tax advice or a representation that any investment or strategy is suitable or appropriate to your individual circumstances or otherwise constitutes a personal trade recommendation to you.
This research report has been prepared solely by Sacra and should not be considered a product of any person or entity that makes such report available, if any.
Information and opinions presented in the sections of the report were obtained or derived from sources Sacra believes are reliable, but Sacra makes no representation as to their accuracy or completeness. Past performance should not be taken as an indication or guarantee of future performance, and no representation or warranty, express or implied, is made regarding future performance. Information, opinions and estimates contained in this report reflect a determination at its original date of publication by Sacra and are subject to change without notice.
Sacra accepts no liability for loss arising from the use of the material presented in this report, except that this exclusion of liability does not apply to the extent that liability arises under specific statutes or regulations applicable to Sacra. Sacra may have issued, and may in the future issue, other reports that are inconsistent with, and reach different conclusions from, the information presented in this report. Those reports reflect different assumptions, views and analytical methods of the analysts who prepared them and Sacra is under no obligation to ensure that such other reports are brought to the attention of any recipient of this report.
All rights reserved. All material presented in this report, unless specifically indicated otherwise is under copyright to Sacra. Sacra reserves any and all intellectual property rights in the report. All trademarks, service marks and logos used in this report are trademarks or service marks or registered trademarks or service marks of Sacra. Any modification, copying, displaying, distributing, transmitting, publishing, licensing, creating derivative works from, or selling any report is strictly prohibited. None of the material, nor its content, nor any copy of it, may be altered in any way, transmitted to, copied or distributed to any other party, without the prior express written permission of Sacra. Any unauthorized duplication, redistribution or disclosure of this report will result in prosecution.