Upwind raises $400 million as endpoint AI sensors and agent scanners remain in development

Upwind announced the close of a $400 million Series C on October 28 at a $3.8 billion valuation. Bessemer Venture Partners led the round, with Canapi Ventures and existing investors participating. In his accompanying post, CEO Amiram Shachar says the investment brings total funding to over $800 million. The new round, cumulative financing and valuation describe different aspects of the transaction; none measures how well the security platform performs.

The company says the financing will support product development and go‑to‑market expansion. The more useful product question is where Upwind’s current platform description ends and the capabilities it is still building begin. Its two announcements make that distinction possible without treating the financing as a feature launch.

Upwind [describes its approach](https://www.globenewswire.com/news‑release/2026/10/28/3390753/0/en/upwind‑closes‑400‑million‑series‑c‑at‑3‑8‑billion‑valuation‑as‑revenue‑quadruples‑in‑2026.html) as combining runtime intelligence with context from cloud workloads, APIs and AI agents. The aim is to give security, development and DevOps teams a shared view of activity and the exposures they should investigate. The distinction is between recording that something exists and understanding what is happening in its environment. A scan can identify an asset or finding; runtime observations add information about activity. That additional context can inform prioritization, but its presence does not by itself establish that a particular vulnerability is reachable, that an attack has occurred or that a response will be correct. Shachar’s [post assigns different roles to Blue, Red and Green agents](https://www.upwind.io/feed/the‑next‑wave‑is‑here‑upwinds‑400m‑series‑c‑to‑build‑the‑cloud‑ai‑security‑platform): investigating activity, assessing exposure and supporting remediation. These are the company’s descriptions of its products. The announcements do not independently validate detection, testing or remediation, and this reporting does not establish a security guarantee.

The CEO [explicitly says Upwind is building](https://www.upwind.io/feed/the‑next‑wave‑is‑here‑upwinds‑400m‑series‑c‑to‑build‑the‑cloud‑ai‑security‑platform) AI sensors for endpoints and scanners for agents and skills, alongside work to reinvent its inventory graph. Those are funded development directions, rather than evidence that all of those capabilities are generally available to every customer today. That boundary matters for the proposed expansion from cloud infrastructure toward the endpoints and agent‑related components connected to it. A platform’s existing runtime approach and a plan to collect or organize additional kinds of information are separate commitments. The post does not provide a release calendar, eligibility list or feature‑by‑feature availability matrix for the work in progress.

The [issuer release says Upwind supports AWS, Microsoft Azure, Google Cloud Platform and Oracle Cloud Infrastructure](https://www.globenewswire.com/news‑release/2026/10/28/3390753/0/en/upwind‑closes‑400‑million‑series‑c‑at‑3‑8‑billion‑valuation‑as‑revenue‑quadruples‑in‑2026.html). It also describes access through the AWS console via AWS Security Hub, with onboarding and billing through AWS. That describes a distribution arrangement; it does not set out a price or establish that every planned capability is included for every account. For an enterprise reading the announcement, the practical questions remain the scope of its own deployment, which information the current platform can observe and which proposed capabilities have actually shipped. The $400 million round gives Upwind resources to expand that work. Company statements and customer quotations in the announcements are interested‑party accounts, rather than independent evidence of protection, operating savings or improved security outcomes. AI‑generated conceptual illustration by OpenTools Team, based on Upwind’s October 28 funding announcement and development plans. The runtime and roadmap labels distinguish the described platform from work still being built. Not Upwind’s interface, actual technical architecture or customer deployment, or evidence of security performance. Based on [Upwind’s announcement](https://www.upwind.io/feed/the‑next‑wave‑is‑here‑upwinds‑400m‑series‑c‑to‑build‑the‑cloud‑ai‑security‑platform).