Runtime security connects live workload activity with cloud and AI risk.
Upwind announced a $400 million Series C funding round on October 28, 2026, led by Bessemer Venture Partners, to expand its cloud and AI security platform. For beginners, the important technical idea is not the funding itself: Upwind is betting that security teams need to prioritize what is actually happening in live cloud workloads at runtime, rather than treating every configuration warning or code finding as equally urgent.
Key takeaways
- Upwind announced a $400 million Series C on October 28, 2026, and said the round brought its total funding to more than $800 million.
- Independent reporting put the company’s post-money valuation at $3.8 billion, although that valuation was not stated in Upwind’s own funding post.
- Runtime security adds live evidence—such as running processes, network activity, and file access—to traditional cloud security findings.
- Upwind says it is expanding from cloud workload security into AI security, identity, and data security.
- Its announced Blue, Red, and Green AI agents are intended to investigate, validate, and prioritize remediation work, not replace security ownership.
What did Upwind announce?
On October 28, 2026, Upwind co-founder and CEO Amiram Shachar announced a $400 million Series C financing. Bessemer Venture Partners led the round. Upwind named Greylock Partners, Cyberstarts, Craft, Salesforce Ventures, Alta Park, Picture Capital, Swish Ventures, Cerca Partners, TCV, Penny Jar, and Leaders Fund as participating existing investors, and said Canapi Ventures joined as a new investor.
A Series C is a later-stage venture-capital round. It does not mean a product has been released or that every announced capability is immediately available to every customer. In this case, Upwind said the capital would support product and engineering growth for a platform that protects cloud and AI infrastructure.
Reuters reported the financing at a $3.8 billion valuation. TechCrunch and CTech also reported that figure. Readers should distinguish the confirmed funding amount from the reported valuation: Upwind’s October 28 post confirms the $400 million round and the investors, while the $3.8 billion valuation comes from independent reporting.
| Term | What it means for a beginner | What is known in this announcement |
|---|---|---|
| Series C | A venture funding round usually used to scale a business, product, or market reach. | Upwind announced a $400 million Series C. |
| Lead investor | The investment firm that typically contributes a major share and helps set the round’s terms. | Bessemer Venture Partners led the round. |
| Valuation | An estimate of the company’s value used in the investment transaction; it is not revenue or cash on hand. | Reuters, TechCrunch, and CTech reported $3.8 billion. |
| Runtime security | Security analysis that uses evidence from systems while they are operating. | It is the central technical approach Upwind describes for its platform. |
Why does runtime cloud security matter?
Cloud environments change continually. A team may deploy containers, serverless functions, APIs, managed databases, Kubernetes clusters, identities, and AI services many times each day. Traditional security tools can examine infrastructure-as-code files, cloud configurations, permissions, container images, and known vulnerabilities before or after deployment. Those checks remain useful, but they do not always reveal whether a risky component is exposed, running, reachable, or being used in a way that creates immediate danger.
Runtime security introduces operational context. For example, a vulnerability in a container image may deserve lower priority if the container is not running. The same vulnerability deserves closer attention if the container is running in production, has an internet-facing path, handles sensitive data, and has shown suspicious process or network behavior.
This is a prioritization model, not a claim that static scanning is unnecessary. Secure cloud programs still need preventive controls: least-privilege identity policies, code review, image scanning, secrets management, patching, and infrastructure configuration checks. Runtime information helps teams answer a narrower but essential question: which of the known issues can matter in the live environment right now?
What is the difference between a snapshot and runtime context?
A snapshot is a point-in-time assessment. For instance, a scanner can report that an object-storage bucket is publicly accessible, a workload contains a vulnerable library, or an identity role has broad permissions. These are important findings, but the scanner may not know whether the bucket is being accessed, the library is loaded by the application, or the role is actively used by a production service.
Runtime context is evidence collected while workloads operate. It can include process execution, system calls, network connections, file activity, and cloud metadata. Upwind’s documentation says its Kubernetes Sensor monitors process, file-system, network, and system-call activity for containers running on a node. The documentation also describes applying eBPF policy and filtering in the Linux kernel.
eBPF, short for extended Berkeley Packet Filter, is a Linux technology that can safely run constrained programs in the kernel under verification rules. Security products use it to observe selected system behavior with lower overhead than approaches that repeatedly move high-volume events to user space. It is powerful, but it must still be deployed, configured, updated, and governed carefully.
How does Upwind’s runtime approach work?
Runtime telemetry adds operational evidence to cloud security findings.
At a high level, a runtime-first workflow connects four layers of information: what was deployed, what is currently running, what it can reach, and what it is doing. The exact data sources and controls vary by cloud provider and product configuration, but the security objective is to move from an isolated alert to a connected explanation of risk.
- Discover assets and configuration. The platform identifies cloud resources, workloads, identities, APIs, and their security posture.
- Collect runtime telemetry. Sensors and cloud integrations observe activity such as processes, network communication, and file or system activity.
- Correlate the evidence. The platform links a vulnerability or misconfiguration to the workload, identity, service, or data path involved.
- Prioritize and respond. Teams can focus on exposures that are active or reachable, then investigate, contain, or remediate them through their established operational processes.
For Kubernetes, Upwind documents an Operator-based deployment model. The Operator deploys the Upwind Sensor as a DaemonSet, which means Kubernetes aims to run one sensor pod on each applicable node. Upwind says the sensor runs as a user-mode process and that the related kernel-level observation enables detection and preventive actions such as stopping compromised containers or blocking malicious processes.
This architecture has practical implications. A team needs an approved deployment model, Kubernetes role-based access control permissions, node compatibility, a plan for sensor lifecycle management, and clear operational ownership. Runtime telemetry can be highly valuable, but it is also security-sensitive data that requires retention, access, and privacy decisions.
What do Blue, Red, and Green agents mean?
Upwind’s October 28 announcement describes three AI agents: Blue, Red, and Green. These names describe intended security roles, not standard industry categories or guarantees of autonomous operation. Organizations evaluating such features should ask what data each agent can access, what actions it may take, what approval gates exist, and how its conclusions are auditable.
| Agent named by Upwind | Stated purpose | Beginner interpretation |
|---|---|---|
| Blue Agent | Investigates across log sources and data points to build an attack story. | It is intended to assemble scattered security signals into an incident narrative. |
| Red Agent | Verifies exposure and attack surface by safely testing whether a vulnerability is exploitable in the environment. | It is intended to reduce false urgency by checking whether a finding can actually be used. |
| Green Agent | Finds pressure points that can remediate many findings and resources. | It is intended to identify high-leverage fixes instead of asking teams to resolve alerts one by one. |
The distinction matters because AI-assisted security can help with the volume problem, but it does not erase the need for controls. A safe operating model should limit permissions, require human review for high-impact changes, preserve logs of actions and decisions, test workflows in non-production environments, and have a rollback plan. An agent that can change cloud infrastructure or identity permissions must be treated as privileged automation.
Why does AI expand the cloud security attack surface?
AI security requires visibility into the permissions and connections around agents.
AI systems run on familiar cloud foundations—identities, APIs, storage, compute, networks, and secrets—but they can connect those foundations in new ways. An application may call a model API, retrieve private documents, invoke tools, write to a database, or ask an agent to execute business workflows. Each connection adds permissions and data paths that need to be understood.
Upwind said it is building AI Sensors for endpoints, scanners for agents and skills, and a revised inventory graph. Its phrasing, “Endpoint to Code to Cloud,” reflects the idea that security teams need to trace risk across employee devices, application code, cloud workloads, and AI-enabled processes rather than treating them as separate environments.
For a beginner, an inventory graph can be understood as a map of relationships. Rather than listing an AI agent, an API key, a cloud role, and a database separately, the graph tries to show how they connect. That can help a team see a path such as: an exposed API reaches an AI service; the AI service has a credential; that credential can access a data store.
What is a realistic example of runtime prioritization?
Consider a development team that deploys an order-processing API to a Kubernetes cluster. A scanner finds a known vulnerability in a library included in the container image. At first, the alert alone does not answer whether it is urgent.
Runtime signals can add relevant questions. Is the affected container running in production? Is the vulnerable code path loaded by the API? Does the workload accept traffic from the internet? Has the process opened unexpected outbound connections? Does the service account have access to production customer records? Is the vulnerable container a retired test deployment with no traffic, or the active payment-facing deployment?
If the evidence shows an internet-facing production container, an active vulnerable process, and a high-privilege service identity, the security team can elevate the finding. The remediation might include patching the image, redeploying the workload, tightening the identity permissions, and adding a network control. If runtime evidence shows the image is unused, the team can still schedule remediation, but it may not outrank an active exposure.
This is the value proposition of runtime context: it helps security and engineering teams spend scarce response time on the combination of exposure, reachability, active behavior, and business impact. It should not be used as a reason to permanently ignore dormant vulnerabilities, because conditions can change when a workload is redeployed or an identity permission changes.
What are the trade-offs of runtime-first security?
Runtime-first tools can improve prioritization, detection, and incident investigation, but they introduce trade-offs. Sensors may require privileged access, cloud integrations may need broad read permissions, and the collection of detailed activity data can increase cost and governance work. Coverage can also vary across Kubernetes, virtual machines, serverless services, managed platforms, and developer endpoints.
Teams should also avoid overrelying on a single severity score. A runtime platform may reduce noise, but its prioritization depends on complete telemetry, correct asset relationships, and policy decisions. Missing a cloud account, cluster, identity integration, or network segment can produce a misleading picture of risk.
The right question is not whether runtime security replaces posture management, code security, or endpoint security. It is whether the organization can connect those disciplines well enough to make faster, defensible decisions. Upwind’s announced direction toward identity, data, and AI reflects that broader integration challenge.
How can a beginner team get started with runtime cloud security?
- Start with an inventory. List cloud accounts, subscriptions, projects, Kubernetes clusters, production workloads, internet-facing services, critical data stores, and privileged identities.
- Classify high-value paths. Identify where customer data, payment activity, production deployment credentials, and AI application secrets flow.
- Keep preventive controls in place. Continue scanning code, dependencies, infrastructure-as-code, container images, identities, and cloud configurations.
- Add runtime visibility carefully. Pilot sensors or integrations in one non-critical environment first. Measure coverage, performance, alert quality, and operational effort.
- Define response ownership. Decide who investigates alerts, who can block a process or container, who approves infrastructure changes, and how incidents are documented.
- Test AI-related permissions. Map which agents can call tools, which credentials they use, what data they can retrieve, and how those permissions can be revoked.
For teams considering Upwind specifically, the most useful proof-of-concept measure is not the raw count of findings. Instead, test whether the platform can accurately connect a meaningful finding to a live workload, its identity, its network exposure, and a practical owner who can fix it. That is the operational promise behind runtime security.
When is Upwind’s expanded cloud and AI security direction available?
Upwind announced the financing and its product direction on October 28, 2026. The company said it plans to invest more deeply in the platform and expand into identity, data, and AI, while describing AI Sensors, agent and skill scanners, and the Blue, Red, and Green agents. The announcement does not provide a public feature-by-feature release schedule or general-availability dates.
Therefore, prospective customers should treat the announcement as a roadmap and investment signal, then verify the current availability, supported environments, licensing, sensor requirements, and automation controls directly with Upwind before planning production deployment.
Frequently asked questions
What did Upwind raise in its Series C?
Upwind announced a $400 million Series C financing on October 28, 2026. The company said Bessemer Venture Partners led the round and that its total funding exceeded $800 million.
What is runtime cloud security?
Runtime cloud security uses evidence from live systems—such as running processes, network connections, file activity, and system calls—to add context to vulnerabilities and cloud configuration findings.
What is eBPF and why is it relevant to Upwind?
eBPF is a Linux technology for running verified programs in the kernel. Upwind says it uses eBPF filtering and policy to collect runtime context and respond to security-significant events in Kubernetes environments.
Do Upwind’s AI agents replace security analysts?
No. Upwind describes Blue, Red, and Green agents as tools for investigation, exposure validation, and remediation prioritization. Security teams still need to control permissions, validate results, approve high-impact changes, and own incident response.
Is the reported $3.8 billion Upwind valuation confirmed by Upwind?
Upwind’s funding announcement confirms the $400 million Series C but does not state a valuation. Reuters, TechCrunch, and CTech reported a $3.8 billion valuation for the round.
Based on reporting by Upwind | Cloud & AI Security for the Realtime Era, Upwind Documentation, Reuters via MarketScreener, TechCrunch and CTech.
Join the conversation! Your thoughts help the community grow.