Upwind Secures $250M to Extend CNAPP to AI, Data Security

A cloud security startup led by a former NetApp executive raised $250 million to build a CNAPP platform that can address a broader set of risks.

See Also: Reduce Cloud Risk in Healthcare with Security by Default

The Bessemer Venture Partners-led Series B funding will help San Francisco-based Upwind shift from building a runtime-based solution to provide a unified stack spanning vulnerability management, CSPM and CDR, said co-founder and CEO Amiram Shachar. The investment will help Upwind take on complex security challenges including misconfiguration, data exposure and identity mismanagement, he said (see: Why Upwind Is Eyeing $250M of Funding at a $1.5B Valuation).

“We realized we’re building something way bigger,” Shachar told Information Security Media Group. “It’s going to serve vulnerability management, it’s going to serve CSPM, it’s going to serve identities. We said, ‘This is the time to grow as fast as possible and grow as big as possible.’ And we feel like the company that will build the best CNAPP in the market is a $100 billion company.”

Upwind, founded in 2022, employs 337 people and has brought in $430 million from outside funding, including a $100 million Series A round in December 2024 led by Craft Ventures. The company has been led since its inception by Shachar, who previously sold cloud infrastructure optimization firm Spot.io to NetApp for $450 million in July 2020. Upwind received a $1.5 billion valuation tied to the Series B round (see: Upwind Raises $100M to Thwart Cloud Security Vulnerabilities).

How Upwind’s Approach to CDR, CSPM Differ From Competitors

Wins with large enterprises including Waste Management, Carvana and Nubank gave Upwind confidence that the company is outperforming in core areas and ready to scale fast, Shachar said. The round began with a goal of $150 million, but intense investor interest led the company to raise the cap before ultimately landing on $250 million, Shachar said.

“You always start with a lower number that you want to raise,” Shachar said. “We actually started with $150 million, and the excitement of participation in the round was really incredible. So, we started with extending it to $175 million and then to $200 and then to $210 and then to $250. So it wasn’t planned.”

While many companies treat CNAPP as a collection of siloed features, Upwind views it as an integrated fabric that brings together runtime, configuration, vulnerability, identity and application layer data, Shachar said. New domains like API security, artificial intelligence workload protection, data security and application security are being added to ensure that CNAPP is not just reactive but predictive and comprehensive.

“When you have the shared context of, ‘I know the vulnerabilities, but I also know the data classification and I also know the identities, and I also know the APIs,’ I can create much more high fidelity and high-quality security alerts,” he said. “Everything is on the table. We’ve done partnerships, we’ve acquired companies and most of the time, it will be through building ourselves.”

Upwind’s solution leverages eBPF-based sensors and serverless tracers, layered with cloud activity logs, to identify multi-step intrusion paths and build a comprehensive story around a breach, Shachar said. Upwind strengthened its CSPM by integrating attack surface management capabilities, allowing it to simulate external attacker perspectives and match exposed resources with internal configuration risks.

“Before Upwind, nobody even thought about using runtime data for vulnerability management. It was not even on the table,” Shachar said. “We broke that chain. And I think the next generation of vulnerability management is really auto remediation, from when you write the code, how we can auto remediate that, or auto remediation when it’s already deployed?”

Why Upwind Believes CNAPP Requires More Than Cloud Security

Upwind wants to push into AI security, API protection, application security and data security as natural extensions of the CNAPP context model, Shachar said. The company built its own API and data security modules, partnered with vendors such as Chainguard and Cyera to enhance capabilities quickly, and acquired Nyx to expand into application security and shift-left code scanning, Shachar said.

“API security is coming into CNAPP, anything like that’s only the beginning,” Shachar said. “From AI vibe coding to all these cursors and Claude, the way to build software requires a new approach. That’s the moment to move faster, bring more capital ahead of time so you can make larger investments.”

Upwind consistently competes with CrowdStrike, Palo Alto Networks and Wiz in nearly every RFP it enters since they are well-funded, well-established players, Shachar said. Many of the problems in modern cloud security are infrastructure and development pipeline challenges, and solving them requires deep knowledge of the software life cycle, runtime behavior and developer workflows.

“The triangle that we see is CrowdStrike, Palo and Wiz,” Shachar said. “That’s what we see in every RFP, at scale, like 99% of the time. What is unique about our approach is, if we think about it, all the problems we’re trying to solve in cloud security are new problems. The actual problem that we’re solving is, in most cases, not even a security problem. It’s a cloud problem.”

Upwind is scaling globally with investments in sales and support teams across North America, Europe, Latin America and Asia-Pacific, and Shachar said securing large, enterprise-grade clients is a critical validation point and revenue driver. The ability to bring in top engineering and field talent quickly is essential to maintaining product momentum and market coverage, Shachar said.

“CNAPP is a line item that every enterprise the world has to have. It’s not a nice to have,” Shachar said. “The number one reason that people don’t buy from Upwind today is because they don’t know us.”