Key Takeaways

  • Upwind secured a $400 million Series C round to protect enterprise cloud and AI infrastructure across operational environments.
  • Amiram Shachar built Upwind with a team from Spot.io rooted in DevOps and cloud infrastructure rather than traditional enterprise cybersecurity.
  • The shift toward vibe coding has cut raw developer coding time by 90% while blowing up code review volume by 600%.
  • Traditional security products flood teams with disconnected alerts because they lack real-time visibility into how infrastructure is wired.
  • Managing AI infrastructure risk requires tracking how runtime systems run rather than just scanning static code repositories.

Infrastructure Context Beats Security Alerts

Most cybersecurity founders build products from a compliance mindset. They write scanners that crawl codebases, spot known vulnerabilities, and throw thousands of tickets at exhausted developers. Amiram Shachar took the opposite route when launching Upwind.

Shachar previously scaled Spot.io, a company centered on cloud compute optimization. His team spent years dealing directly with cloud operations and developer workflows. When they entered the security sector, they arrived without conventional cybersecurity resumes. As Shachar put it, “We're building a cyber security company not with cyber security background like our background is from like you know devops and infrastructure.”

That difference in origin shapes Upwind's operational philosophy. Security teams usually work in a vacuum, isolated from the systems they try to defend. They see a vulnerability flag, but they do not know if that container is actually running or exposed to the public internet. “And that knowledge of understanding how DevOps people think how infrastructure is wired how cloud ops is working it's helping us to like like help security team unlock context of operations that they never had before,” Shachar explained. When you understand the operational wiring, you can filter out static noise and focus on real threats.

Vibe Coding Inverts the Engineering Bottleneck

Generative models have rewritten how software gets built, but they have also quietly broken the traditional security review pipeline. Engineers are no longer typing out every line by hand. Instead, they prompt assistants, generate entire modules in seconds, and push them downstream.

This dynamic has created what Shachar calls vibe coding, and the math behind it is staggering. “Yeah like my coding like time has dropped down by 90%. But the review time is up by 600%,” Shachar observed.

When developers write their own code, they usually understand the edge cases, dependencies, and potential security flaws as they type. When an AI generates hundreds of lines of plausible code, that mental model disappears. The developer must now audit alien logic under severe time pressure. Security teams cannot keep pace with this deluge of machine-generated pull requests. The bottleneck has shifted from authoring code to auditing it, and rushed reviews inevitably allow unchecked vulnerabilities to slip into production.

Why Defending Cloud AI Demands Huge Capital

Upwind raised a $400 million Series C to meet the scale of modern enterprise cloud footprints. Securing AI workloads is not a problem you can solve with a lightweight software wrapper or a small feature set.

Modern enterprise architectures span hybrid environments, distributed clusters, and complex AI pipeline dependencies. Shachar is clear about why his team took such a massive capital infusion: “That's a lot of money. And I I I can tell you that this is what's needed to operate in that very important space.” Upwind wants to be the defensive layer that enterprise teams depend on across both traditional compute and autonomous model deployments. As Shachar stated plainly, “Upwind protects the cloud and AI for the world.”

What to Do With This

Audit your engineering team's pull request workflow this week. If code output has spiked due to AI generation tools, measure the average hours spent on each review. If review times have not scaled alongside volume, your engineers are approving code they do not fully understand. Establish a strict rule: any AI-generated block exceeding 50 lines must include automated runtime tests and a documented architecture check before merging.