Investors are backing Upwind because it is building a cloud-security platform around runtime visibility: sensors observe what applications and workloads are doing, then correlate that activity with vulnerabilities and attack paths. Bessemer Venture Partners led a $250 million Series B announced January 26, 2026, after Craft Ventures led a $100 million Series A in December 2024. The funding signals strong investor conviction, but it does not by itself establish that Upwind’s technology outperforms competing platforms.
What is Upwind, and what does its CNAPP do?
Upwind sells a cloud-native application protection platform, or CNAPP, for securing applications and the cloud infrastructure they run on. Its product combines three areas: application security, security posture management and real-time protection across development and production.
- Application security: applies security guardrails before code reaches the cloud.
- Posture management: provides visibility into live workloads, services and data flows.
- Real-time protection: detects and can stop threats involving APIs, AI and applications.
That combination puts Upwind in a broad cloud-security category. TechCrunch described its coverage as spanning cloud security posture management (CSPM), cloud workload protection (CWPP), cloud detection and response (CDR), API security, vulnerability management, identity security and container security.
How does Upwind’s runtime-first approach work?
Upwind’s central distinction is that it uses runtime observations—evidence of what is happening in running software—to help assess cloud risk, rather than relying only on static configuration checks or lists of known vulnerabilities. Bessemer Venture Partners describes lightweight sensors collecting network, process and container events as a continuous data stream. Upwind’s correlation engine adds metadata, identities and other context to those events to build an execution graph.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
That context can help answer a practical security question: is a vulnerability reachable in this particular container or service, and what path could an attacker take to exploit it? A finding connected to a live workload and plausible attack path may be more actionable than a vulnerability alert with no evidence that the affected code is exposed or used.
This is the basis for Upwind’s pitch to reduce alert noise: prioritize issues using evidence from running systems and their relationships. Upwind has claimed a 90% reduction in alerts, as reported by TechCrunch in 2024. That is a company claim, not an independently verified benchmark in the available reporting; it should not be read as a result every customer will achieve.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
How much has Upwind raised, and who invested?
| Announcement | Funding or valuation | Investors and attribution |
|---|---|---|
| Series A, December 2, 2024 | $100 million raised, according to Upwind | Led by Craft Ventures; TCV, Alta Park and existing investors also joined. Upwind’s named backers included Greylock, Cyberstarts, Leaders Fund, Cerca and Sheva. |
| Series A valuation, reported in 2024 | $900 million post-money valuation; $180 million in total funding at that time | Reported by TechCrunch. The valuation is a private-company funding-round figure, not a public-market price. |
| Series B, announced January 26, 2026 | $250 million raised | Led by Bessemer Venture Partners, according to Bessemer. The announcement describes this as a Series B. |
Upwind’s 2023 funding announcement also named Penny Jar Capital. In April 2025, Business Wire reported that the company had secured $180 million since its 2022 founding; that figure reflects reporting before the 2026 Series B and should not be mistaken for a current cumulative total.
The $900 million post-money valuation belongs specifically to the 2024 Series A reporting. The cited 2026 Series B announcement gives the round size but does not establish a new valuation, so the 2024 figure should not be carried forward as Upwind’s current valuation.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why are investors betting on Upwind?
Bessemer’s investment thesis centers on the changing nature of cloud workloads. It argues that containers and Kubernetes make deep runtime visibility increasingly important because workloads can change quickly and dependencies shift. In that environment, collecting events is only useful if a platform can connect them to identities, services and potential attack paths.
Bessemer also emphasizes the founders’ DevOps background and Upwind’s effort to turn raw sensor data into context-rich signals that can help reduce unnecessary security tickets. Those are the investor’s reasons for backing the company, not independent proof that the approach has reduced risk or workload for customers at a particular rate.
Rank #4
For investors, the bet is that companies will pay for a platform that unites broad cloud-security coverage with enough runtime context to make findings more actionable. That thesis depends on execution: product breadth, deployment fit, customer adoption and the quality of risk prioritization all matter alongside the underlying technology.
What did the Nyx Security acquisition add?
Upwind announced its first acquisition, Nyx Security, in April 2025. Business Wire said Nyx’s technology can identify when application functions execute, locate vulnerable code loaded in memory and detect behavioral anomalies. The announcement said Nyx’s team would strengthen Upwind’s eBPF capabilities, runtime detection and application-layer observability.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
The strategic fit is a move closer to the application itself. Cloud infrastructure sensors can show activity across containers and networks; application-layer detection can add detail about which functions run and how code behaves. The combination supports Upwind’s runtime-security positioning, though the acquisition announcement does not provide independent performance comparisons against other products.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should Upwind be compared with Wiz and other CNAPP vendors?
A useful comparison is not simply whether a vendor says it offers runtime security. Buyers should determine whether runtime data is foundational to its risk model or an optional layer, and whether the platform connects observed activity to reachable attack paths in a way analysts can verify.
- Runtime depth: Ask what events are observed, how application and container context is captured, and which capabilities depend on runtime sensors.
- Signal quality: Request examples showing how a finding is tied to a live workload, identity, service or attack path. Treat alert-reduction percentages as vendor claims unless independently validated under comparable conditions.
- Coverage: Compare support for CSPM, CWPP, CDR, API, identity, vulnerability and container security against the workloads and controls the organization actually needs.
- Deployment fit: Verify cloud-provider, Kubernetes and marketplace integrations, along with sensor deployment requirements and operational overhead.
- Evidence of adoption: Seek customer references and clarify how reported customer and employee totals are defined and dated.
The available information establishes Upwind’s runtime-oriented product narrative and funding history, but it does not establish that it is objectively superior to Wiz or another CNAPP. A product evaluation should test coverage and signal quality against the buyer’s own environments rather than assume a winner from investor backing.
What is known about Upwind’s size and company history?
Upwind’s newsroom says it was founded in October 2022 in San Francisco by the team behind Spot.io, which was acquired by NetApp. Its company snapshot, accessed October 1, 2026, lists 300+ employees and 150+ customers; both are company-reported figures, not independently audited counts.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The same snapshot lists support for AWS EKS and availability through Google Cloud Marketplace. Marketplace presence can offer a purchasing route, but buyers still need to confirm current regional availability, technical requirements and whether the offering fits their cloud commitments.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
