Upwind Security announced a $400 million Series C at a $3.8 billion valuation on October 28, 2026, led by Bessemer Venture Partners. The company says the money will fund product development and go-to-market expansion for its cloud and AI security platform. The announcement puts specialized security agents at the center of that expansion.
Upwind describes three roles: Blue investigates threats, Red tests whether exposures are exploitable, and Green identifies opportunities to remediate risks across infrastructure. The pitch connects two sides of AI security: protecting workloads and autonomous agents, and using agents to help defenders manage them.
The financing itself is straightforward. The financial comparisons need more care. Upwind says revenue quadrupled in 2026, while TechCrunch reports a forecast of roughly $90 million in annualized recurring revenue by year-end. Those figures measure different things, so they cannot establish either a growth discrepancy or a matching growth rate.
The Funding Round and Its Valuation
Bessemer led the round with participation from new investor Canapi Ventures and existing backers including Greylock Partners, Cyberstarts, Craft Ventures and Salesforce Ventures. Bloomberg also reported the $400 million financing and $3.8 billion valuation.
The Series C follows a $250 million Series B in January 2026, which valued Upwind at $1.5 billion. The two rounds show how quickly its financing scale has changed:
| Round | Timing | Capital Raised | Reported Valuation |
|---|---|---|---|
| Series B | January 2026 | $250 million | $1.5 billion |
| Series C | October 2026 | $400 million | $3.8 billion |
The Series B figures appear in TechCrunch’s reporting, while Upwind’s announcement supplies the Series C details. The latest valuation is about 2.5 times the January figure. That increase measures investor pricing, not revenue growth or product effectiveness.
In a separate company blog post, CEO and co-founder Amiram Shachar said the round brings total funding to more than $800 million. He described plans to expand product and engineering work across cloud and AI infrastructure.
For buyers, that capital gives Upwind resources to develop broader coverage and support enterprise deployments. It is useful context when assessing a supplier’s capacity to invest, but it cannot answer whether the platform catches the right threats or safely changes production systems.
Revenue Growth and ARR Are Different Measures
Upwind’s release says revenue quadrupled in 2026. It supplies neither an absolute revenue figure nor the precise comparison periods behind that statement.
TechCrunch, citing a person familiar with Upwind’s financials, reports that the company is projected to finish the year at roughly $90 million in annualized recurring revenue, or ARR. That is an anonymously sourced forecast, separate from the company’s published growth claim.
Revenue generally measures income recognized over a period. ARR expresses recurring business as an annualized run rate at a particular point in time. A rapidly growing subscription company can therefore have a year-end ARR figure substantially different from the revenue recorded during that year.
A fourfold increase in revenue and a $90 million ARR forecast can both be true. The published figures lack the matching definitions and dates needed to compare their growth rates directly.
The valuation calculation is more useful, provided its conditions stay attached:
$3.8 billion valuation ÷ $90 million forecast ARR ≈ 42.2 times forecast ARR.
That arithmetic supports TechCrunch’s description of a valuation above 40 times forecast ARR. It is not a multiple of audited annual revenue, and it depends on Upwind reaching the reported forecast.
My view is that 42 times forecast ARR says more about expectations than established scale. Investors are assigning substantial value to future expansion. The published numbers do not show margins, retention, cash consumption or the contribution of individual products, so they offer little basis for judging how efficiently that expansion might happen.
What Blue, Red and Green Are Meant to Do
Upwind’s October 28 blog gives the clearest breakdown of its three agents. Their roles map to distinct security tasks:
| Agent | Upwind’s Description | Practical Question It Addresses |
|---|---|---|
| Blue | Investigates across logs and other data points to assemble an attack story | What happened, and how are the events connected? |
| Red | Tests whether exposures and vulnerabilities are exploitable in the customer’s environment | Can an attacker actually use this finding here? |
| Green | Finds changes that can remediate large numbers of findings and affected resources | Which intervention could remove the most risk? |
These are vendor-described capabilities. The supplied funding materials contain no independent evaluations of investigation accuracy, testing safety or remediation success, and they leave execution permissions and rollback behavior unspecified. Upwind’s blog is the source for the named roles; its press release more broadly describes agents that investigate, validate attack surfaces and remediate infrastructure risks.
Blue: Reconstructing the Attack
Blue’s job is to connect evidence across data sources. Individual alerts may describe a suspicious login, an API call or unusual workload activity. An investigation has to determine whether those events belong to the same incident and what happened between them.
That makes the quality of the supporting evidence important. A useful investigation should let an analyst follow the underlying events, understand their sequence and check the agent’s explanation. A fluent summary alone would be a weak basis for making an incident-response decision.
Red: Testing the Exposure
Red addresses a different problem: a vulnerability finding does not automatically explain whether an attacker can exploit it in a particular deployment.
Upwind says Red safely tests exploitability within the customer’s environment. The operational value would come from distinguishing findings that present a usable attack opportunity from those whose surrounding conditions limit exploitation.
“Safe” is an important claim here. Buyers should establish the permitted targets, testing methods and production safeguards before authorizing an automated agent to probe infrastructure.
Green: Finding High-Impact Fixes
Green focuses on what Upwind describes as pressure points that can address thousands of findings and resources. The implication is that one well-chosen intervention could resolve many related exposures.
I’d pay closest attention to Green’s authority boundaries. An agent that recommends a change creates a review task; an agent allowed to execute it introduces production-change risk. Those are materially different operating models, even if both are described as remediation.
Read together, the three roles suggest a useful workflow: reconstruct the incident, validate the exposure, then select a fix. Whether customers can connect those steps reliably depends on evidence quality, permissions and the controls around each action.
Why Runtime Context Changes Prioritization
Upwind’s platform uses information from live workloads, APIs and agents to help teams understand risks and detect attacks. Its announcement contrasts this runtime approach with reliance on periodic assessments and static snapshots.
Shachar summarized the premise in the release: “Context is key to managing internal and external risks.” Upwind’s announcement says the platform combines that context to identify critical risks and reachable exposures.
Consider a hypothetical application image containing a vulnerable library. A package scan can identify the affected version. Runtime information can add evidence about the running workload and its activity. Exposure testing can then examine whether the conditions required for exploitation exist in that deployment.
Each step answers a different question:
- Inventory and scanning: What potentially vulnerable components are present?
- Runtime context: What is happening in the live environment?
Frequently Asked Questions
3 questions
1How Much Did Upwind Raise?
Upwind announced a $400 million Series C on October 28, 2026, at a $3.8 billion valuation. Bessemer Venture Partners led the round.
