Upwind Walked Away From Datadog. The $400M Series C Explains Why
Upwind closed a $400 million Series C on October 28, 2026, at a $3.8 billion valuation led by Bessemer Venture Partners. Canapi Ventures joined as a new investor, and every existing backer returned, including Greylock Partners, Craft Ventures, Cyberstarts, Salesforce Ventures, TCV, Alta Park, Penny Jar, Swish Ventures, Cerca Partners, Leaders Fund, and Picture Capital. The round brings cumulative funding past $800 million for a company that is four years old.
The size of the check was not the most interesting part of the story. The deal that did not happen was. According to TechCrunch's reporting, Datadog spent months pursuing an acquisition of Upwind and ultimately came in at roughly the same $3.8 billion that venture investors had already agreed to pay. There was no premium above the private mark. Upwind declined and took the equity instead, choosing a cap table over a term sheet from a public company with a market capitalization near $90 billion.
That choice is worth taking seriously, because it sits where three forces in enterprise software currently intersect: how cloud security products are priced, how AI has reshaped the perimeter those products are supposed to defend, and how few credible exit paths remain for a security company that wants to stay independent.
What Upwind actually sells
It is easy to file Upwind under the generic label of cloud security, a category crowded with vendors whose pitch decks look interchangeable. The distinguishing claim is narrower and more technical than that.
Upwind sells a cloud-native application protection platform built around runtime data. The conventional model in cloud security is to look at configuration. A tool pulls the state of an account through cloud provider APIs, compares it against a rule set, and produces a list of misconfigurations and vulnerabilities. That approach is useful and it scales, but it describes how an environment is configured rather than how it behaves. A resource can be flagged as publicly exposed and still be unreachable in practice. A vulnerability can score a 9.8 on CVSS and never be invoked in production. Security teams end up drowning in findings that are technically accurate and operationally meaningless.
Upwind inverts the evidence chain. Greylock, which co-led the company's seed round and has backed every round since, described the approach at launch as combining previously unavailable runtime signals, including eBPF-based instrumentation and cloud infrastructure API telemetry, to build a real-time picture of what is executing inside the environment rather than what a periodic snapshot says about it. The practical consequence is prioritization: an exposure that is actually reachable, actually running, and actually touching sensitive data outranks one that exists only on paper.
Upwind packages this as a consolidated CNAPP covering cloud security posture management, cloud workload protection, cloud detection and response, vulnerability management, identity security, container security, and API security. Consolidation matters here. Security leaders have spent several years trying to reduce tool counts, and a platform that answers posture, threat detection, and remediation questions from one dataset is easier to justify than four point products that each generate their own alerts.
The company summarizes the philosophy as "inside-out" security, which is really an argument about evidence. Configuration snapshots are assumptions. Traffic, API calls, process behavior, and data flows inside a running workload are observations. Upwind's bet is that AI-era infrastructure, which is ephemeral by default, changes too fast for assumptions to hold.
The round, the rumor, and the rejection
The fundraising itself follows a steep curve. Upwind raised $250 million at a $1.5 billion valuation in January 2026. Nine months later it closed $400 million at $3.8 billion, a valuation that more than doubled in less than a year and roughly eleven times its seed-era mark.
The Datadog story requires some care, because the reporting is not unanimous. TechCrunch reported, citing a person familiar with Upwind, that Datadog attempted to buy the company and did not offer a premium above the $3.8 billion valuation set by venture investors, which is why Upwind stayed independent. Earlier reporting in The Information, relayed by Globes, described a roughly $4 billion approach that Upwind turned down. CTech subsequently reported that, based on its own reporting, the offer as described had not been made. Neither company commented publicly.
What is not in dispute is more instructive than the discrepancy. Whether the bid was $3.8 billion, $4 billion, or something adjacent, the reported price sat at or barely above Upwind's freshly set private valuation. That is the detail that explains the decision. An acquisition at your last round price offers founders liquidity and certainty, but it offers almost no premium for the growth still ahead. For a company adding $20 million to $30 million in annualized recurring revenue every quarter, the forward-looking math favors staying private a while longer.
It is also not the first time the two companies have circled each other. Upwind and Datadog reportedly discussed a deal worth around $1 billion the year before, which did not materialize either. The relationship reads less like a courtship that failed and more like a strategic interest that keeps getting re-priced as the target grows faster than the acquirer's willingness to pay.
The math behind a 40x multiple
Upwind's growth rate is the engine underneath the valuation. TechCrunch reported that the company has been adding $20 million to $30 million in ARR each quarter and is projected to finish 2026 at roughly $90 million. Earlier in the year, The Information reported that ARR had passed $50 million, up from about $20 million at the end of 2025. Upwind's own announcement framed the year as one in which revenue quadrupled.
At $3.8 billion against roughly $90 million in projected ARR, the implied multiple is above 40x forward revenue. That sounds extreme until you place it against the rest of the category. Cyera, another fast-growing security company, was reported earlier in 2026 to be raising at around 80x ARR despite operating losses. Google's $32 billion acquisition of Wiz closed in March 2026 at roughly 32x the company's revenue, which for a business at that scale is an extraordinary outcome and a useful anchor for what strategic buyers will actually pay.
Seen that way, 40x is aggressive but not unreasonable for a company compounding at this rate in a market with a structural tailwind. It is also the number that makes independence defensible. If the multiple compresses, or if growth decelerates faster than expected, the calculus changes quickly.
Tomasz Tunguz of Theory Ventures has argued that cybersecurity is positioned to be the third major wave of AI software spending, following AI coding tools and customer support. The logic is straightforward: enterprises that deploy AI systems create new attack surface, and attack surface has to be defended. Whether or not that prediction holds exactly, it explains why capital is flowing into security at these multiples while other software categories have cooled.
Building for the agentic era
Upwind's product roadmap over the past year reads like a company preparing for a threat model that most buyers have only started to articulate.
In December 2025, the company launched an AI security suite inside its CNAPP. The components map onto a coherent set of problems. AI security posture management covers exposed inference endpoints, model versioning and governance, overly broad IAM roles, and leaked AI API keys. AI detection and response watches agents and LLM infrastructure for anomalous behavior and jailbreak attempts by analyzing process, network, and prompt payloads at layers 3, 4, and 7. An AI bill of materials inventories models, frameworks, SDKs, and agent systems across code, cloud inventory, and runtime evidence. Network visibility extends to AI-native protocols such as JSON-RPC and HTTP/2 streaming while flagging outbound calls to OpenAI, AWS Bedrock, Azure OpenAI, and Vertex AI. There is dedicated coverage for the Model Context Protocol, tracing the sequence from a prompt through downstream function calls, file operations, and resulting system changes. And AI security testing validates systems against adversarial techniques including the OWASP Top 10 for LLMs, prompt injection, jailbreaks, and unsafe tool bindings.
The through-line is that AI risk cannot be assessed in isolation from cloud context. A model endpoint is not a separate universe from the workload that calls it, the identity that authorizes the call, or the data it reaches. Upwind's CEO Amiram Shachar framed it plainly: AI security should not be a stand-alone component, because it benefits from everything the CNAPP already knows.
In January 2026, Upwind shipped Choppy AI, a natural-language layer across the platform. Users describe what they want in plain language, and the system translates that intent into structured, visible logic: query builder expressions for inventory search, editable rules for policy creation, and conversational investigation inside the vulnerability module. The design choice that matters is transparency. Most AI features in security tooling behave like black boxes, producing an answer without exposing how it was derived. For a rule that will be enforced in production, that is a hard sell to a security team that needs to defend the logic in an audit. Choppy AI keeps every generated query visible and editable, which is a statement about what security buyers will actually accept from AI.
The company also introduced three named agents. A Blue Agent correlates across log sources to assemble a single attack narrative and handles exploitation attempts at runtime. A Red Agent safely tests whether exposures are genuinely exploitable in the customer's own environment, so teams can deprioritize theoretical findings. A Green Agent looks for the leverage points that can remediate thousands of findings at once. The framing is deliberate: the volume of AI-assisted attack activity is not something human triage can absorb, so response has to happen at machine speed with human judgment reserved for the decisions that need it.
On the distribution side, Upwind integrated its CNAPP into the Extended plan of AWS Security Hub in February 2026, letting customers purchase through AWS with a single contract and consolidated billing and access Upwind from within the AWS console. That is unglamorous work, but it is how a security vendor becomes part of an enterprise's standard operating model rather than a separate procurement battle.
The reference list has grown to include Siemens, Roku, Carvana, Nubank, Supabase, ClickUp, and Waste Management, whose CISO has publicly described a significant reduction in alerts and fewer irrelevant CVEs after rolling the platform across AWS and the broader cloud estate.
A repeat founder with a familiar playbook
Shachar has done this before. He founded Spot.io, formerly Spotinst, which used machine learning to optimize cloud compute spend and was acquired by NetApp for $450 million in 2020. The founding team around him at Upwind, including Liran Polak, Lavi Ferdman, and Tal Zur, came from the same company.
That history matters for reading the Datadog decision. A founder who has already sold a company, watched it scale inside a larger acquirer, and then started again has a different relationship with liquidity than a first-timer. The first exit answered the question of whether the outcome was possible. The second company is where the question becomes how large the outcome can get.
The repeat-founder pattern also explains Upwind's operating tempo. The company went from stealth in September 2023 to a $1.5 billion valuation in January 2026 to a $3.8 billion valuation nine months later, and it acquired the Israeli AI security startup Aegis in a stock deal reported to be worth tens of millions of dollars along the way. It also established Upwind AI Labs, focused on AI security, agentic security, frontier models and benchmarks, and advanced AI systems. Those are not the moves of a company optimizing for a clean acquisition story.
What independence costs
Choosing the round over the acquisition is a bet with a clear downside. The most likely eventual outcome for a venture-backed security company remains an acquisition, and TechCrunch noted that very few cybersecurity companies have gone public in recent years. An IPO window that has been effectively shut for the category means the realistic path to liquidity runs back through the same strategic buyers who are now bidding at private-round prices.
There is also a structural question about who those buyers can be. Google's acquisition of Wiz removed the largest independent cloud security company from the board and placed it inside a hyperscaler. For enterprises that run multi-cloud environments, having a significant portion of their security posture owned by one of the cloud providers they are trying to secure is an uncomfortable position, and it creates an opening for vendors that can credibly claim neutrality. It also narrows the field of independent acquirers, since the most natural strategic buyer for a cloud security platform is often a cloud or observability company that already has adjacent relationships.
Datadog fits that profile precisely. It sells observability, and observability sits next to security in the same telemetry. Buying Upwind would have given it a runtime security franchise built on data it already partly sees. Not paying a premium for it was a rational choice on Datadog's side and a clear signal to Upwind about how the acquirer valued the growth still ahead.
The other risk is timing. A 40x forward multiple assumes continued compounding at something close to the current rate. Anything that slows ARR growth, whether competitive pressure, a shift in buyer budgets, or the natural deceleration that comes with scale, makes the next round harder to price and the acquisition conversation easier to reopen. Upwind continues to draw acquisition interest, according to TechCrunch's source, which is a polite way of saying the option remains live.
What the company has bought itself is time and a war chest. More than $800 million raised means it can fund product expansion into identity, data, and AI without returning to market on someone else's schedule. For a security vendor competing against companies with far larger distribution, that is not a luxury. It is the precondition for staying in the category at all.
The takeaway
The headline is a $400 million round at a $3.8 billion valuation. The substance is a company that looked at an offer from a $90 billion public buyer, judged it to be roughly equivalent to the private mark it had already achieved, and decided that the next twelve months were worth more than the certainty of a signature.
That is a defensible position only because the underlying business is growing fast enough to justify it, and because the technology thesis, that runtime evidence beats configuration snapshots in a world where AI agents change infrastructure continuously, has found real enterprise buyers. Whether Upwind is right will be settled by the multiple it commands at its next financing or its eventual exit. For now, the company has made the more interesting choice, and it has done so with enough capital to live with the consequences.