Upwind, a San Francisco startup that uses AI to secure cloud infrastructure, closed a $400 million Series C round at a $3.8 billion valuation led by Bessemer Venture Partners. Existing investors Greylock Partners and Craft Ventures also participated. The round comes nine months after the company raised $250 million at a $1.5 billion valuation.
The financing nearly collapsed when Datadog attempted to acquire Upwind. Datadog, a publicly traded company that sells observability tools for monitoring how software runs, did not offer a premium above the $3.8 billion valuation set by venture capital investors. Upwind chose to remain independent.
Upwind has grown quickly amid rising AI-driven cybersecurity threats. The four-year-old company adds $20 million to $30 million in annualized recurring revenue each quarter and is projected to end the year at roughly $90 million in ARR. At more than 40 times forecast ARR, the valuation sits well below the 80x multiple fetched by Cyera, another fast-growing cybersecurity startup earlier this year.
Theory Ventures general partner Tomasz Tunguz recently argued that cybersecurity is poised to be the third big wave of AI software that companies will pay for, after AI coding tools and customer support. By walking away from an acquisition offer, Upwind signals it believes the company will ultimately exceed the $3.8 billion Datadog was prepared to pay. Though few cybersecurity companies have gone public recently, an eventual sale remains the most likely outcome.
Upwind continues to draw acquisition interest. The company was founded by Amiram Shachar, who previously sold his cloud spend management startup Spot.io to NetApp for $450 million. Upwind calls its approach "runtime" security: it alerts and remedies attacks and vulnerabilities in active services in real time.
How Upwind's runtime security differs from traditional cloud monitoring
Unlike observability platforms that focus on logging and metrics after the fact, Upwind's runtime security actively alerts and remediates threats while services are running. The system intercepts suspicious activity in live environments and can automatically take action to contain or eliminate vulnerabilities before they escalate. This approach shifts security left into the execution phase rather than treating it as a separate post-deployment concern.
What the $400 million means for Upwind's product roadmap
The fresh capital will allow Upwind to expand its AI models for threat detection, hire additional engineering talent, and deepen integrations with major cloud providers. For development teams, a more sophisticated runtime security layer means fewer false positives when scanning live services and faster remediation cycles when anomalies appear.
Upwind's decision to remain independent also signals confidence in the category. With the company projected to surpass $90 million in ARR by year-end, the venture-backed path offers a route to a valuation that may exceed what any single acquirer would offer today.