Upwind, an Israeli cybersecurity unicorn focused on cloud infrastructure security, has acquired early-stage Israeli startup Aegis in a stock-based transaction valued at tens of millions of dollars. The deal comes only nine months after Aegis was founded and gives Upwind a dedicated research team focused on attacks involving AI agents and AI infrastructure.
Following the acquisition, Upwind is establishing Upwind AI Labs for Cybersecurity, a new research and development operation examining emerging security risks created by AI systems.
The lab will study AI attack techniques, autonomous agents, skills, plugins, scanning methods and attack detection, with research feeding into Upwind’s cloud security platform.
Market reports place the value of the all-stock Aegis transaction between $25 mn and $50 mn, with Israeli publication Globes reporting an estimated price of around $30 mn. Upwind hasn’t publicly disclosed the financial terms.
Aegis was founded in early 2026 by Omri Limor and Saar Ankonina, both veterans of Israel’s Unit 8200. The founders previously worked in offensive cybersecurity before moving into commercial security roles, including positions at Centra and Sweet Security.
Their startup concentrated on attacks involving AI agents and the infrastructure around them. The company developed technology for identifying characteristics of AI-driven attacks as companies began connecting autonomous agents with cloud systems, identities, APIs and production data.
Upwind and Aegis worked together through a strategic partnership for several months before agreeing to the acquisition. Limor and Ankonina will now lead the new AI research operation, combining Aegis’s work with Upwind’s existing runtime cloud security technology.
The lab is expected to start with around 12 developers and researchers drawn from both companies. Upwind plans to increase the group to roughly 25 employees within three months and later expand it to around 35 people.
The acquisition follows another large financing round for Upwind. Earlier in September, the company raised about $300 mn at a valuation of approximately $3.8 bn, more than doubling its valuation within eight months.
Bessemer Venture Partners and TCV led the latest financing, with participation from existing investors including Salesforce Ventures, Greylock, Cyberstarts, Craft Ventures and Leaders Fund. The funding took Upwind’s total capital raised since inception above $700 mn.
In January 2026, Upwind had raised $250 mn in a Series B at a valuation of about $1.5 bn. That round brought total funding at the time to more than $430 mn and established the company as one of the better-capitalised independent cloud security vendors.
The Series B was led by Bessemer Venture Partners, with investment from Greylock, Cyberstarts and Leaders Fund alongside Salesforce Ventures and Picture Capital. Upwind said at the time that the money would support international growth and further development across cloud, data, code and AI security.
Upwind was founded in 2022 by CEO Amiram Shachar and former colleagues from Spot io, the cloud infrastructure company acquired by NetApp for $450 mn in 2020. Shachar founded Spot before leading its sale and later returned to cybersecurity infrastructure with Upwind.
The company’s security platform analyses activity inside cloud environments at runtime rather than relying mainly on periodic static scans. Upwind uses that operating data to identify active risks, trace their source and reduce the number of alerts security teams need to investigate.
That runtime approach is now moving into AI security. Models increasingly connect directly with cloud infrastructure and business systems, while autonomous agents execute actions previously performed manually by employees or developers.
Those agents create additional questions around identity, permissions and behaviour. Security teams need to understand which agents are running, which systems they access and what actions they perform once credentials or tools have been granted.
Upwind CEO Amiram Shachar said AI changes both the attack surface and the speed at which cyber operations occur. The new research lab is intended to move security research into production features faster as companies deploy agents across more infrastructure.
The Aegis team brings an offensive security background to that work. Its founders have concentrated on understanding how AI agents behave during attacks and how defenders identify actions that differ from ordinary application or human activity.
Upwind plans to connect those findings with telemetry already collected through its cloud platform. The company sees runtime information as a way to distinguish actual attack activity from theoretical weaknesses and lower the volume of false-positive alerts sent to security teams.
The strategy follows the original thesis behind Upwind. Shachar and his co-founders started the company after concluding that cloud infrastructure had become too dynamic for security models designed around periodic snapshots and static configuration checks.
Rapid growth in data volumes and AI workloads has added another layer to the problem. AI applications interact with cloud services continuously, and autonomous agents increasingly move between systems without a person approving every individual action.
Upwind’s recent financing provides the company with substantial capital to build around that shift. The $300 mn September round followed the $250 mn Series B in January, giving management resources for product development, hiring and acquisitions as larger cybersecurity vendors also invest heavily in AI security.
The Aegis transaction represents one of the first uses of that additional capital for external expansion. Rather than buying an established cybersecurity business with a large customer base, Upwind is acquiring a nine-month-old technical team working on a narrow area closely connected with its existing platform.
Upwind has also been adding senior management as the company expands. Omer Grossman, previously a senior executive at CyberArk and a former commander of the Israeli military’s Mamram technology unit, recently joined as chief business officer.
The company’s investor group includes Bessemer Venture Partners, TCV, Cyberstarts, Greylock and Craft Ventures, alongside Salesforce Ventures and other financial backers. Upwind has used the financing to expand internationally while building a wider set of cloud security products around its runtime architecture.
Its platform covers areas including cloud workload protection, cloud detection and response, API security, vulnerability management, identity security and data security. AI security is becoming another product area as enterprise customers connect models and autonomous agents with the same cloud environments.
Aegis now gives Upwind a dedicated team studying those risks before they turn into established attack patterns. The new lab will work on attack research and detection methods while translating findings into defensive controls inside the broader Upwind platform.
For Upwind, the acquisition extends a strategy it has followed since launch: analyse what applications and workloads are doing while they run, then use that context to determine which risks deserve attention. The same model is now being applied to autonomous agents as they gain access to production infrastructure.
The transaction also adds another example of consolidation among Israeli AI security startups at an unusually early stage. Aegis reached an acquisition agreement less than a year after formation, before building the longer operating history normally associated with cybersecurity M&A.
Upwind’s decision centres largely on the founders and their research rather than conventional acquisition metrics. Shachar has described specialist cybersecurity teams as harder to build than technology itself, making the Aegis team an important part of the transaction.
With the acquisition completed, Limor and Ankonina will lead research into AI attack techniques and agent security under the Upwind organisation. The company plans to expand the lab quickly while incorporating its findings into products used by existing cloud security customers.
The move puts AI security alongside cloud, data and code as a larger part of Upwind’s product roadmap. After raising $550 mn across two major financing rounds in 2026, the company is using part of that capital to expand beyond conventional cloud workloads as autonomous agents become more common inside enterprise infrastructure.
