Upwind unifies API, identity, runtime, AI

Upwind is trying to win cloud security by being the product a team can standardize on, not the best standalone runtime sensor. Sysdig and Aqua already cover runtime inside containers and Kubernetes, so Upwind extends the buying case by putting posture, workload behavior, API traffic, identity activity, data exposure, and newer AI risks in one system. That lets a security team investigate one alert across misconfigurations, live processes, service calls, and permissions without jumping between tools.1 2 3 4 5

• The product is built to correlate static findings with what is actually running. Upwind combines cloud scanners, runtime telemetry, process activity, file access, network flows, and L7 traffic inspection, so a vulnerable workload can be judged by whether the code path is live, what identity it runs as, and what data or APIs it touches.2 3 5
• That is a broader pitch than classic runtime vendors. Sysdig still centers its CNAPP around runtime insights and Falco based detection, while Aqua and Sysdig both come from protecting containers in production. Upwind is packaging adjacent controls that are often bought separately, especially API security, CIEM style identity analysis, DSPM style data discovery, and AI workload monitoring.3 4 6 7
• The breadth matters because cloud security budgets are shifting toward consolidation. Upwind has scaled from about $20M ARR at December 2025 to about $50M by September 2026, which suggests the platform story is resonating beyond a point runtime tool and into a larger CNAPP replacement motion.1

The next step is deeper consolidation around live application context. As AI services, non human identities, and east west API traffic become part of normal production systems, the vendors that can connect posture, runtime, identity, and application behavior in one workflow should keep taking share from narrower point tools.2 4 5