Security1 distinct publisher2 min readPublished
Upwind's Series C more than doubles the company's price since January and funds runtime collection pulled out of the Linux kernel, but it records what five investors will underwrite rather than what cloud security buyers have already bought.
The Watch · Security desk

Follow any of these and your For You feed starts watching them — no settings page required.
product
Upwind banks $300m on refreshing the cloud asset map every 30 seconds1 distinct publisher
product
The open-weight default is for sale at $13B, and its buyer pool ships models too4 distinct publishers
build
A linear conntrack scan holds Cilium pod setup for 80 seconds at Adyen's peak1 distinct publisher
invest
OpenAI's own timeline: twelve days from agent attack to knowing it was them1 distinct publisher
Compiled by The WatchSomething wrong?How this is made
Back out the arithmetic and the January mark was $1.8 billion, so this is a 2.1x re-rating inside a single year [1][2]. The cadence is the harder number. Two rounds inside eight months put a floor of $400 million of fresh primary capital into the company, and that floor sits as low as it does only because the earlier round was described in digits rather than dollars [1][3].
The rest of the platform, past the collection layer, is conventional cloud security work. It inventories instances, encryption keys and configuration scripts and maps how they interact [7]. It compares configurations against best-practice and regulatory baselines and runs simulated attacks against the environment [9]. Recent engineering has gone into integrations with third-party cloud services [11].
That is a product description, and it is where the evidence stops. The material carries no customer count and no revenue figure, and nothing on head-to-head displacement of posture-scanning incumbents [12]. SC World's brief credits Silicon Angle with the fuller account of the round [4]. Five investors willing to underwrite a runtime-first platform at this price is a bet on where cloud security buying is going. An argument that the market has already moved off static posture scanning needs numbers this round did not publish.
This is a funding story, not a vulnerability or an incident report. The consequence is slower than that, and it lands at renewal, where the useful question is coverage. Kernel-level collection presumes a kernel you can instrument [6], and the material does not say what watches the workloads where the kernel is somebody else's. Same question for the AI inventory: generating a bill of materials for model components [8] is only as good as the components it can see, and the source names the output, not the boundary. Both are answerable in a bake-off, and both are cheaper to ask now than after a three-year commitment.
The effect lands at the next platform contract repricing: a challenger with $300 million of new capital [1] is a harder name for an incumbent to argue away on viability grounds, while what an attacker can reach this week stays unchanged.
Ranked by verification strength, evidence, and original report placement.
Upwind Security raised $300 million in additional funding in a Series C, eight months after its previous nine-figure round.
The Series C was led by Bessemer and TCV, with participation from Salesforce Ventures, Greylock and Craft Ventures.
Upwind is now valued at $3.8 billion, an increase of $2 billion since the start of the year.
SC World's brief on the round states that further coverage was provided by Silicon Angle.
Upwind's valuation at the start of the year was $1.8 billion.
The valuation has risen about 2.1 times since the start of the year.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 4, 2026
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One brief, credited onward
Everything in this story travels through a single SC World brief that names Silicon Angle as the reporting underneath it. The financial side survives that thinness because it is specific and internally consistent: $300 million, $3.8 billion, a $2 billion increase, five named funds with the leads identified. The product side does not, since the 30-second refresh, the AI-BOM output and the Red and Blue agents are Upwind's own description passed along without documentation, a test or a user.
Nothing counted
The reporting counts nothing on the demand side: no customer number, no revenue, no named deployment. The single adoption-shaped detail, expanded third-party cloud integrations, arrives undated and unnamed, and a vendor's own feature expansion is not a measure of who bought it.
Price ahead of proof
A company priced near $1.8 billion in January is priced at $3.8 billion now, and the only evidence offered for the difference is that five funds were willing to write the cheque. The capability language runs the same direction, with agents that filter flaws and catch intruders described in the present tense and never demonstrated. The gap is real but bounded, because the deal facts themselves are not inflated, only unaccompanied.
Priced by the parties announcing it
The valuation in this story was set by the same people publicising it. Bessemer and TCV mark their own new position, Salesforce Ventures invests from a company that sells into the cloud stack Upwind monitors, and the round's technical framing originates with the vendor. On the publishing side, the brief is credited to another outlet and closes with SC World's own pitch for cloud security guidance, which tells you what the page is for.
Firm on the money, thin on the product
The arithmetic is safe. A nine-figure prior round plus $300 million puts at least $400 million of primary capital in within eight months, and the $1.8 billion January mark follows from the two figures given. Confidence stops at the deal, because one secondary brief gives no way to check what the platform does or who runs it.