After Rejecting Datadog Acquisition, Upwind Raises $400M

Cloud security startup Upwind, after turning down an acquisition offer from Datadog, completed a $400 million Series C round at a valuation of $3.8 billion. According to TechCrunch, this valuation matches the acquisition price Datadog had previously proposed—in other words, Upwind chose a riskier path but kept the initiative: rather than sell the company for the same price, it took a pile of cash to build on its own.

A deal of "same price, different path"

The most intriguing aspect of this deal is the overlap in numbers. Datadog's acquisition offer corresponded to a $3.8 billion valuation, and Upwind's new round carries the same $3.8 billion post-money valuation. The company did not disclose the investor list or specific terms, but the size of the round itself already signals that capital remains bullish on the cloud security sector.

From a capital structure perspective, the $400 million Series C gives Upwind the ammunition it needs to develop independently, rather than becoming a module in Datadog's security portfolio. For the founding team, this typically also means retaining control and continuing to expand at their own pace.

Why cloud security remains a capital darling

Cloud security (CSPM/CWPP and related areas), where Upwind operates, has been one of the faster-growing segments of enterprise security spending over the past few years. As enterprises migrate workloads to the cloud at scale, needs such as runtime protection, cloud misconfiguration detection, and asset inventory have shifted from "optional" to "mandatory."

Datadog, as a representative observability platform, has been steadily extending into security in recent years, with acquisitions being its common means of filling capability gaps. Its willingness to offer billions of dollars for Upwind is itself a confirmation of the value of such capabilities. And the fact that Upwind could still raise funding at an equivalent valuation after declining the offer shows that financial investors' judgment does not conflict with that of strategic buyers.

What do CSPM and CWPP mean respectively

CSPM (Cloud Security Posture Management) focuses on the configuration layer of cloud environments: continuously scanning cloud accounts, container orchestration platforms, and infrastructure-as-code templates to identify misconfigurations such as publicly exposed storage buckets, overly broad IAM permissions, and unencrypted databases, and providing remediation recommendations aligned with compliance frameworks (such as CIS Benchmark and SOC 2). Its core value is "discovering states that should not exist in the cloud."

CWPP (Cloud Workload Protection Platform), by contrast, targets running workloads, covering virtual machines, containers, serverless functions, and other forms, providing vulnerability scanning, runtime behavior monitoring, file integrity checking, and malicious process blocking. The two perspectives are complementary: CSPM governs "whether the configuration is correct," while CWPP governs "whether the runtime has been attacked." In recent years, these two categories of capabilities have converged with the CNAPP (Cloud-Native Application Protection Platform) concept, with vendors tending to offer both configuration-side and runtime-side capabilities on the same platform—Upwind is precisely focused on this integrated approach.

Why observability platforms need to move into security

Observability platforms originally solved the question of "what is happening inside the system": using metrics, logs, and distributed tracing to help engineering teams locate performance bottlenecks and failures. They naturally hold a large amount of runtime telemetry data, which happens to be the raw material required for security detection—anomalous processes, anomalous network connections, and suspicious permission calls often first manifest in telemetry signals.

Therefore, vendors like Datadog and Dynatrace have an inherent logic for extending into security: they can cross-sell runtime security capabilities to existing customers without rebuilding data collection pipelines. However, cloud asset inventory and compliance scanning on the configuration side differ significantly from observability data models, and in-house development takes a long time, making acquisitions a common choice for filling gaps. This is also the backdrop for Datadog's willingness to bid for Upwind—it is not buying a single module, but an entire set of cloud security capabilities that complement its own data advantages.

The costs and leverage of refusing to be acquired

Declining an acquisition offer at the same price is uncommon. By choosing funding rather than selling, Upwind must bear the pressure of independent growth: after the Series C, investors' expectations for its revenue growth rate, customer retention, and internationalization pace will rise markedly.

On the other hand, however, the cloud security market has yet to form an absolute monopoly, and independent vendors still have room to capture share through product differentiation and channel building. Retaining independence also means Upwind can continue to partner with multiple cloud vendors and observability platforms without being locked into a single ecosystem.

What a Series C round means

In the venture capital round system, a Series C typically corresponds to a company that has completed product-market fit and entered a phase of scaled expansion. This round of funding is generally used for sales team expansion, international market entry, channel system building, and possible M&A, rather than early-stage product R&D validation.

Another implication of a Series C is a change in governance structure: investors often require board seats, information rights, and protective provisions, giving them certain veto rights over major company decisions; meanwhile, arrangements in preferred stock terms such as liquidation preference and anti-dilution affect the founding team's actual returns in a low-valuation exit. Therefore, "raising $400 million" is not purely good news—it also means higher revenue growth commitments and stricter milestone constraints. This is why declining an acquisition at the same price is not without cost—the company has exchanged a certain monetization for a conditional, time-bound growth bet.

Signal significance for the industry

This deal sends two signals. First, valuations of cloud security assets remain high, and strategic buyers and financial investors share converging judgments on the same target. Second, high-quality security startups still have bargaining power in the primary market, and "being acquired" is no longer the only respectable exit path.

For security entrepreneurs who are watching from the sidelines, Upwind's case provides a reference: when the acquisition offer is equivalent to the financing valuation, choosing financing means trading future growth space for current independence. Whether this decision is worthwhile ultimately depends on whether the team can convert the capital into sustainable revenue growth.

One-line Summary

Upwind declined Datadog's acquisition at the same price and instead completed a $400 million Series C at a $3.8 billion valuation.

Paragraph Summary

Cloud security startup Upwind rejected Datadog's acquisition offer at a $3.8 billion valuation and instead completed a $400 million Series C, with a post-money valuation also of $3.8 billion. The article notes that this numerical overlap shows that strategic buyers and financial investors share converging judgments on cloud security asset pricing. Choosing funding over a sale means the founding team retains control and independence and can continue to partner with multiple cloud vendors and observability platforms, but it must also bear higher post-Series C pressure regarding revenue growth, customer retention, and internationalization expectations. The article argues that this case sends two signals: cloud security asset pricing remains high, and high-quality security startups still have bargaining power in the primary market; being acquired is no longer the only respectable exit path, and whether it is ultimately worthwhile depends on whether the team can convert the capital into sustainable revenue growth.