Upwind is a cloud and AI security platform for security teams that run workloads in the public cloud. It joins posture data with what is actually happening at runtime, so teams can see which risks are live, plan fixes and catch attacks as they unfold.
The problem it targets is noise. Cloud teams face long lists of findings with little sense of which ones an attacker could actually use today, and Upwind’s answer is to rank risk by what is running and reachable.
At A Glance
| Vendor | Upwind |
|---|---|
| Category | Cloud security |
| Identities covered | Cloud identities and entitlements, AI agents and their skills |
| Deployment | Agentless cloud scanners plus eBPF-based runtime sensors |
| Agentic AI | Agentic Pack with Blue, Red, Green and Choppy agents |
| Customers | People.ai, Vestiaire Collective, Spacelift, Petrofac, EvenUp |
| Funding | Series C stage |
| Market classification | Cloud Security |
What Upwind Does
Posture tools tell a team what is misconfigured, but not which of those issues sits on a workload that is running, exposed and being touched by an attacker. Upwind feeds both agentless scans and runtime sensor data into a “Realtime Intelligence” layer that links code, pipelines, cloud configuration and runtime behaviour. The result is one live inventory, “a live map of the environment to know which workloads and agents are running”, against which exposures are ranked and attacks are detected.
Products
Application Security
Application Security catches problems before a workload is deployed. It scans infrastructure as code, checks the software supply chain through software composition analysis and SBOMs, and adds a container admission controller that can stop unsafe images entering a cluster.
Security Posture
This group serves cloud and security teams who need to know where their environment is exposed. It brings together CSPM, CIEM for cloud identities and entitlements, DSPM for sensitive data and AI-SPM for AI services, with attack path analysis and exposure management on top. Vulnerability management and security for containers, Kubernetes and serverless workloads sit in the same group.
Realtime Protection
Realtime Protection is for the moment something goes wrong. Cloud detection and response links workload runtime signals with cloud activity to spot meaningful deviations. Attack surface management, API security and DAST cover what is reachable from outside, and a managed detection and response service supports incident handling.
Agentic Pack
The Agentic Pack gives stretched security teams AI agents that do the first pass of investigation, validation and fixing.
| Blue | Investigates incidents by correlating runtime, cloud and identity signals into a timeline, then gives a verdict and recommended response. |
|---|---|
| Red | Finds exploitable attack paths by probing vulnerabilities, exposures, identities and permissions in the live environment. |
| Green | Groups findings by shared root cause and delivers fixes as pull requests across code, IaC, packages, images and cloud configuration. |
| Choppy | A conversational control plane that dispatches the other three agents and passes evidence between them. |
How It Works
| Component | What it does |
|---|---|
| Agentless scanners | Cloud scanners collect posture and configuration data through cloud APIs without installing anything on workloads. |
| Runtime sensor | An eBPF-based sensor runs on workloads to add live process, network and behaviour context. |
| Realtime Intelligence | Both feeds land in this shared layer, which builds the live inventory and links findings from code to runtime. |
The scanners give broad coverage of every account, while the sensor adds depth where it is installed. That one inventory then feeds detection, exposure ranking and the Agentic Pack agents.
Identities And Systems Covered
| Cloud identities and entitlements | CIEM maps identities and their permissions, baselines their behaviour and helps remove risky privileges. |
|---|---|
| AI agents | The inventory shows which agents are running, and the platform watches for malicious agent skills, MCPs and high-risk agent configurations. |
| Workloads | Containers, Kubernetes and serverless workloads. |
| Clouds | AWS, Google Cloud, Microsoft Azure and Oracle Cloud. |
Integrations
| Area | Integrations |
|---|---|
| Identity security | Britive |
| Vulnerability management | ServiceNow VR |
| Automation and AI | OpenAI ChatGPT, n8n |
| Other | Origin |
Company Background
| Founded | 2022. |
|---|---|
| Headquarters | San Francisco, United States. |
| Leadership | Amiram Shachar (Co-Founder and CEO) and Rinki Sethi (CSO). |
| Funding | A $400 million Series C led by Bessemer Venture Partners on 28 October 2026, for a reported total of more than $800 million. Other investors include Greylock Partners, Cyberstarts, Craft, Salesforce Ventures, TCV and Leaders Fund. |
Note: This overview is compiled from Upwind’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.