Upwind Secures $400M at $3.8B Valuation Post Datadog

Walking away from a four billion dollar acquisition check requires extraordinary confidence in your business trajectory. Most startup founders dream of negotiating a nine-figure buyout from an established tech giant, cashing out equity, and retiring from corporate stress. Amiram Shachar chose a harder path. Cloud security venture Upwind Security confirmed on Wednesday, October 28, 2026, that it finalized a $400M Series C funding round that pushes its private market valuation to $3.8B. The transaction arrives barely months after Shachar rejected an acquisition offer from observability giant Datadog valued at nearly $4B. The funding round, led by Bessemer Venture Partners with participation from major institutional syndicates, more than doubles Upwind valuation from the $1.5B benchmark set during its Series B round earlier this year. Shachar decision to stay independent shows that investor appetite for real-time cloud defense remains resilient, even as wider software markets face valuation corrections. The capital expansion reflects late-stage equity dynamics we monitored when Ramp expanded autonomous financial platforms.

The financial momentum behind Upwind stems from rapid revenue acceleration. Company financial disclosures show that annual recurring revenue quadrupled over the past twelve months, climbing past an estimated run rate of $80M. Total private capital raised by the four-year-old firm stands at $830M, providing a substantial cash cushion to expand engineering teams in Tel Aviv and sales operations in San Francisco. Upwind built its reputation by rejecting legacy cloud security posture management tools that rely on periodic static scans. Instead, the platform operates from the inside out: using lightweight kernel sensors to inspect live operating system memory, active network sockets, and autonomous software agent behaviors in real time. Major enterprise clients, including digital banking leader Nubank, automotive retailer Carvana, and streaming hardware maker Roku, deployed Upwind to protect mission-critical cloud tenancies. Strategic private capital investments across mature software companies match patterns we followed when Temporal secured Series E growth capital.

The Datadog Rejection: Choosing Independence Over an Early Exit

To grasp why Upwind leadership walked away from Datadog acquisition bid, one must examine the corporate rivalry reshaping enterprise infrastructure. Over the past twenty-four months, cloud observability providers like Datadog, Dynatrace, and New Relic attempted to expand into security markets, seeking to protect client workloads rather than just monitoring server performance.

Datadog saw Upwind as an immediate shortcut into runtime security. Upwind board and executive team calculated that selling for $4B would undervalue the enterprise long-term potential. Shachar, who previously founded cloud infrastructure optimizer Spot and sold it to NetApp for $450M in 2020, recognized that modern computing architectures demand runtime context that static security tools cannot provide. The rapid adoption of autonomous reasoning models and software agents inside corporate clouds is generating complex security threats that overwhelm legacy firewalls. Shachar observed that customer demand over the last three months exceeded the prior four years combined. By raising $400M in fresh primary equity, Upwind secured the capital required to build a standalone enterprise security provider capable of challenging incumbents like Palo Alto Networks, CrowdStrike, and Wiz. Corporate consolidation trends across security developers were analyzed in our report on software ventures acquiring smaller specialized teams.

Runtime Context: The Inside-Out Architecture

The technical differentiation that powered Upwind commercial growth sits in its runtime-first architecture. First-generation cloud security tools operate by taking snapshots of cloud configuration files and scanning code repositories for known software bugs.

Static scanning produces thousands of false-positive alerts. A security scanner might flag five hundred theoretical vulnerabilities inside a container image, sending panicked alerts to engineering teams. In reality, four hundred and ninety of those code files sit dormant on hard drives, never executed by running applications. Upwind deploys extended Berkeley Packet Filter sensors directly into the Linux operating system kernel. The software observes which files are loaded into active processor memory, which network connections are opened, and which software processes make system calls. If a vulnerable software library sits on disk but is never executed, Upwind ignores it; if an unvetted script begins executing memory commands, Upwind terminates the process instantly. This inside-out context cuts alert fatigue by over ninety percent, allowing corporate defense teams to focus on active threats. High-value cybersecurity alliances were detailed in our review of CrowdStrike expanding partnerships to secure automated software.

Comparing Cloud Native Application Protection Platforms