The moment a cloud workload changes, the security picture around it can change too. A new application release, an altered configuration or an interaction between services may affect whether an exposure can be exploited. For security teams relying on periodic assessments, keeping pace with those changes can be difficult.

Upwind Security has built its cloud and AI security platform around the need to understand infrastructure while it is running. The company announced a $400 million Series C round led by Bessemer Venture Partners, valuing it at $3.8 billion after revenue quadrupled in 2026.

Canapi Ventures participated alongside existing investors Cyberstarts, Greylock Partners, Craft Ventures, Leaders Fund, Salesforce Ventures, TCV, Alta Park Capital, Penny Jar Capital, Cerca Partners, Swish Ventures and Picture Capital. The new valuation represents a substantial increase from the $1.5 billion valuation Upwind secured in its Series B round in January 2026. The company intends to use the funding to accelerate product development and expand its go-to-market operations.

Why Static Snapshots Have Limits Traditional security assessments can identify weaknesses at a particular point in time. But the findings do not always reveal how a system behaves in production, whether an exposure is reachable or how the issue connects to other components.

That gap can complicate prioritization. Security teams may have to investigate multiple findings before determining which ones deserve immediate attention, while the underlying environment continues to evolve.

Founded in 2022, Upwind combines runtime intelligence with context from cloud workloads, APIs and AI agents. Its platform is designed to help security, development and DevOps teams identify critical exposures, fix risks proactively and detect attacks in real time.

“AI is fundamentally changing both the cloud infrastructure architecture and the scale of cyber threats and how organizations build and operate software,” said Amiram Shachar, CEO and Co-Founder of Upwind. “Context is key to managing internal and external risks, security teams need to understand how cloud, and AI interact in real time. We built Upwind to unify those signals and eliminate complexity, helping organizations identify their most critical exposures, fix risks proactively, and detect attacks as they happen.”

From Detection to Investigation The company’s approach is not limited to identifying issues. Upwind is developing specialized AI agents that can investigate threats autonomously, act as a red team to validate attack-surface findings and help remediate infrastructure risks.

The objective is to reduce the manual work required to investigate and triage security events. As AI-powered applications and autonomous agents become more common, security teams may face activity that changes too quickly for every step of the response process to depend on manual investigation.

“Security needs to keep pace with environments that AI agents can change at a speed and scale that human teams alone cannot match,” Shachar said. “By combining real-time intelligence at runtime with the context needed to understand and remediate risk, we’re helping organizations move beyond alert management toward proactive security.”Automation does not remove the need for human judgment, but it can help teams direct attention toward decisions that require it. For organizations managing large cloud estates, that distinction can affect how efficiently security personnel investigate exposures and respond to incidents.

What Enterprises Are Seeing Upwind supports Amazon Web Services, Microsoft Azure, Google Cloud Platform and Oracle Cloud Infrastructure. Its AWS Security Hub integration allows customers to access the platform through the AWS console, with simplified onboarding and unified billing through AWS.

The company counts Siemens, Roku, Carvana, Nubank, Supabase and ClickUp among the organizations that trust its platform. Customer feedback has emphasized the practical difference between identifying a potential weakness and understanding what is actually running.

“Upwind gave us visibility into what is actually running, not just what a scan found,” said Michael Cannizzo, CISO of HedgeServ. “That changed which risks we spend our time on.”

Ping CISO Russ Kirby also highlighted the speed of implementation and the operational value of live visibility: “Setup took days. What stood out after that was visibility into live workloads rather than a snapshot, and that redirected where our team spends effort.”Those testimonials point to an important consideration for enterprise buyers: the value of a security platform depends not just on its ability to surface findings, but also on whether its information helps teams make better decisions.

A Larger Investment in Real-Time Defense The $400 million Series C gives Upwind more resources to expand its platform and enterprise presence. Its revenue quadrupled in 2026, and its valuation has risen from $1.5 billion in January to $3.8 billion.

The next phase will test whether the company’s runtime-first strategy can continue to scale as customers deploy more AI-driven workloads and autonomous systems. For Upwind, the central proposition is that security teams can respond more effectively when they understand risks in the context of the live infrastructure they are responsible for protecting.