Platform bundling threatens Upwind

The real risk to Upwind is not feature parity, it is budget gravity. Palo Alto Networks and Wiz can sell runtime security as one more box inside a larger cloud security or SOC deal, so the buyer does not need a new vendor, a new security review, or a separate renewal fight. That matters because CISOs often prefer fewer consoles, fewer agents, and one contract that covers posture, detection, response, and compliance together.1 2 3 4 5

• Palo Alto Networks has turned runtime into part of a broader platform. Cortex Cloud combines CNAPP, cloud detection and response, posture, app security, and runtime security on the same stack, and Palo Alto positions it as a unified operating layer for both cloud teams and security operations teams.2 3 6
• Wiz followed the same path by adding runtime and response around its core posture product. Earlier research ties Wiz's runtime move to the Raftt acquisition and threat detection expansion, and after Google closed the Wiz acquisition on March 11, 2026, Wiz gained even more ability to ride inside a much broader cloud buying motion.4 7 8 9
• Upwind is still growing fast, with estimated ARR rising from $20M at December 2025 to $50M at September 2026, but its pitch is narrower and more workflow specific. It has to prove that better prioritization cuts enough analyst toil and speeds enough incident response to beat the convenience discount of a platform bundle.5

The market is moving toward fewer, broader cloud security contracts that stretch from code to runtime to SOC workflows. Upwind's path is to become the product teams keep after consolidation, by owning the day to day investigation and prioritization work well enough that ripping it out would recreate alert overload inside the larger suite.1 2 4 5