Three years is barely enough time for most startups to figure out product-market fit. Upwind Security just used that window to reach unicorn status and then some.
The San Francisco-based cloud security company announced Monday it has closed a $250 million Series B funding round at a $1.5 billion valuation. That brings total capital raised to $430 million since October 2022—a timeline that even by the frenzied standards of enterprise software feels compressed.
Bessemer Venture Partners led the round, joined by new backers Salesforce Ventures and Picture Capital. A who's-who of earlier believers also returned: Greylock, Cyberstarts, Leaders Fund, Craft Ventures, TCV, Alta Park Capital, Cerca Partners, Swish Ventures, and Penny Jar Capital. The company is calling this moment "The Next Wave," though perhaps more than the founders expected when they first set out.
The Second Act Nobody Saw Coming
Upwind's founding team isn't new to the exit game. CEO Amiram Shachar, along with CTO Tal Zur and SVP of Growth Lavi Ferdman, previously built Spot.io—a cloud infrastructure optimization company acquired by NetApp in 2020 for around $450 million. They could have retired. Instead, they jumped back in.
What they found was a market hungry for better cloud security tools. The numbers tell part of the story: 900% year-over-year revenue growth. A customer base that doubled to more than 150 clients, including Siemens, Peloton, Roku, Wix, Nextdoor, and Brazil's digital banking giant Nubank. Headcount that ballooned from roughly 150 employees to over 300 in just twelve months.
But raw growth figures don't fully explain how Upwind captured attention in a crowded field.
Inside-Out Security in an Outside-In World
Most cloud security platforms work from the outside looking in—scanning for vulnerabilities, checking configurations, monitoring perimeter defenses. Upwind flips that model. The company uses eBPF technology (Extended Berkeley Packet Filter, for the uninitiated) to embed visibility directly into the runtime environment where applications actually operate.
Shachar calls this approach "runtime-first" or "inside-out" protection. In practice, it means Upwind can observe what's happening inside containers and serverless functions as they run, not just assess them before deployment or monitor network traffic afterward. The company claims this cuts alert noise by 98% and eliminates 60% of irrelevant common vulnerabilities and exposures (CVEs)—the security flaws that IT teams spend countless hours triaging.
Whether those metrics hold up at scale across diverse customer environments remains an open question. But early adopters seem convinced enough to bet their infrastructure on it.
A Market That Can't Decide If It's Hot or Overheated
Upwind operates in the Cloud-Native Application Protection Platform space—mercifully shortened to CNAPP in industry parlance. It's a category barely five years old that encompasses everything from vulnerability management to identity controls to runtime protection, all tailored for cloud-native architectures.
The market is exploding. Dell'Oro Group projects CNAPP will hit $6 billion by 2028 and approach $8 billion by 2029, up from roughly $2 billion in 2023. That kind of growth attracts both genuine innovation and speculative excess.
Consider the ecosystem Upwind now inhabits: Google agreed last year to acquire CNAPP provider Wiz for $32 billion in a deal expected to close sometime in 2026. That's not a typo. Thirty-two billion dollars for a company founded in 2020. Meanwhile, Datadog reportedly sniffed around Upwind last July, exploring an acquisition around $1 billion before the company chose to raise instead.
The CNAPP landscape is consolidating fast, with larger security vendors gobbling up point solutions and cloud providers building native offerings. Upwind's bet is that its runtime-focused approach offers enough differentiation to carve out sustainable territory. Time, as always, will tell.
Fast Money, Faster Expectations
Upwind's fundraising velocity mirrors its growth trajectory—which is to say, blistering. The company raised a $50 million seed round in September 2023, followed by a $100 million Series A at a $900 million post-money valuation in December 2024. Now, barely a year later, it has added another $250 million at a near-billion-dollar markup.
That kind of momentum creates its own gravity. Investors pile in, valuations climb, and suddenly a startup that might have spent years methodically building is instead sprinting to justify eye-watering paper gains.
Shachar says the fresh capital will fund expansion into data security, AI protection, and code security—buzzwords that happen to align with where enterprise buyers are currently anxious. The company is particularly focused on AI security capabilities, a sensible play given that nearly every CTO is now fielding questions about securing AI workloads.
There's also an emphasis on shifting security "left"—bringing tools closer to developers to catch misconfigurations before they reach production. It's an old idea repackaged for the cloud era, and one that has foundered before when security teams couldn't convince engineering organizations to actually use their tools.
Going Global While Others Pull Back
Upwind isn't just scaling its product; it's scaling its footprint. The company has expanded beyond its core U.S., U.K., and Israel markets into Australia, India, Singapore, and Japan. It added more than 100 channel partners over the past year—distribution relationships that enterprise software companies often need to reach mid-market buyers.
The startup has also deepened integrations with Amazon Web Services and Microsoft Azure while establishing partnerships with Google Cloud and Oracle Cloud Infrastructure. In a particularly timely move, Upwind forged a strategic collaboration with NVIDIA around AI infrastructure protection—capitalizing on NVIDIA's position as the default hardware provider for AI workloads.
Last April, the company acquired Nyx, an application runtime security startup, though financial terms weren't disclosed. Small tuck-in acquisitions like these often signal a maturing company filling gaps in its platform rather than relying solely on organic development.
The Cloud Security Paradox
Here's the tension Upwind and its competitors face: Cloud environments were supposed to be more secure than traditional data centers, with built-in isolation, encryption, and identity controls. Instead, they've introduced new attack surfaces—ephemeral containers that spin up and down in minutes, serverless functions with sprawling permissions, AI agents making autonomous decisions, and data constantly moving between services.
The old security playbook doesn't work. Firewalls and antivirus software designed for static servers are nearly useless when infrastructure is defined by code and changes by the hour.
Shachar frames this as an opportunity. "The security landscape is fundamentally shifting," he said in a statement. Whether Upwind's runtime-first approach proves the right answer—or just another layer of complexity in an already overwhelming field—will depend on execution over the next few years.
For now, the company has capital, customers, and momentum. In the startup world, that's enough to keep the story going. Whether it leads to a successful IPO, a blockbuster acquisition, or a cautionary tale about unsustainable growth will depend on what comes next.
One thing seems certain: At this pace, we won't have to wait long to find out.
