Three $400M Bets on Governing AI Agents: Upwind, Island and Cyera

Three cybersecurity companies have each raised $400 million in the past six weeks, and all three are making the same bet. Upwind announced its Series C on Wednesday. Island and Cyera raised in late September. They sit in different categories (cloud security, the enterprise browser and data security), but each now pitches itself as the place to govern what AI agents can see and do. They can't all be the control plane for agents. For buyers, that means the same claim arriving from three directions. The only way to sort it out is to test it.

Upwind raises $400M: a runtime-first CNAPP goes wider

Category: Cloud Security → CNAPP

Upwind announced a $400 million Series C on 28 October. Bessemer Venture Partners led the round, Canapi Ventures joined as a new investor, and all existing investors returned. Bloomberg and SiliconANGLE report a $3.8 billion valuation, up from about $1.5 billion at its Series B in January. Upwind says revenue has quadrupled this year but hasn't disclosed a figure. Upwind built its CNAPP around runtime data from live cloud workloads. It's now extending into endpoints and code, adding scanners for AI agents and skills, and shipping its own agents that investigate alerts, validate vulnerabilities and carry out fixes.

If you use Upwind: expect the product to get broader quickly. Ask which new capabilities are generally available and which are still roadmap. Before you let an agent remediate anything, test what permissions it needs and which approval steps you can enforce.

For competitors: Upwind competes with CNAPP platforms such as Wiz (part of Google since March 2026), Palo Alto Networks, CrowdStrike and Sysdig. For buyers who'd rather not have cloud security owned by a cloud provider, a well-funded independent stays on the shortlist. The move into endpoints also brings Upwind closer to EDR vendors.

Island raises $400M: the enterprise browser goes after agents

Category: Edge & Secure Access → Enterprise Browser

Island raised a $400 million Series F on 24 September at a $6.4 billion valuation, up from $4.8 billion in March 2025. Evolution Equity Partners led the round. Island started with a Chromium-based browser and has since added data loss prevention, network security and an extension for consumer browsers. It now pitches a single policy engine and audit trail for people and AI agents, across browsers, devices, apps and data. "Agents do not operate in a single layer of the technology stack, so they cannot be governed from one," said CTO Dan Amiga.

If you use Island: the product is moving from a browser to a broader governance layer. Check which new modules your licence covers. Then test the agent controls (identity, guardrails, human approvals, cost limits) against agents you actually run.

For competitors: the enterprise browser market has become a contest between a dedicated browser and securing the browser people already use. Palo Alto Networks sells Prisma Access Browser and Google sells Chrome Enterprise. CrowdStrike agreed in January to buy Seraphic, which secures sessions in any browser. Island's new funding gives it room to keep making the case for the dedicated approach.

Cyera raises $400M: data security as the AI trust layer

Category: Data Security → DSPM

Cyera added a $400 million extension to its Series G on 22 September. The money came from Growth Equity at Goldman Sachs Alternatives, at an unchanged valuation of over $12 billion, the same price as June's $600 million round. Cyera has raised $1.4 billion this year and says the money goes to its AI security roadmap, the US federal market, and EMEA and APAC. In July it bought non-human identity vendor Oasis Security, and its Agent Guardian and Cyera Endpoint products track what AI agents access and do.

If you use Cyera: the platform now spans DSPM, DLP, non-human identity and agent monitoring. Ask how Oasis is being integrated, whether it's priced separately, and which agent-monitoring features are in production today.

For competitors: a month after Proofpoint agreed to buy Varonis, data security is splitting into vendors inside larger platforms and well-funded independents. Cyera has the capital to keep buying adjacent capabilities, which raises the bar for other independents such as BigID and Sentra.

Three control points, one claim

Each company sees a different slice of what an agent does. Upwind sees the cloud workloads agents run on and, increasingly, the endpoints. Island sees the browser session and the apps behind it. Cyera sees the data agents read and move. Our read: today these overlap more than they replace each other. A large enterprise could buy "agent governance" three times, with three policy engines and three inventories of the same agents. None of the three has published independent evidence that its view of agents is complete.

What buyers should test

If you're evaluating any of these vendors on their AI agent claims, run the same four tests in your bake-off:

1. Discovery: point it at your own environment. Which agents does it find, including local coding agents and ones nobody approved?
2. Control, not just visibility: what can it actually block, require approval for or revoke, and what does it only log?
3. Its own access: what permissions does the tool need to do this, and who audits it?
4. Overlap: if you already own one of the others, where does agent policy live, and which tool wins when they disagree?

Is your category on the move?

CNAPP, enterprise browsers and DSPM all moved this month. When a competitor raises $400 million, buyers revisit their shortlists. If you're a vendor in one of these categories, verify your Picari profile so buyers comparing the market see your current capabilities and evidence.

---

---

Sources

• Help Net Security, "Upwind secures $400 million to protect AI across endpoints, code, and cloud," 28 Oct 2026. helpnetsecurity.com
• SiliconANGLE, "Cloud security startup Upwind raises $400M at $3.8B valuation as revenue quadruples," 28 Oct 2026. siliconangle.com
• Bloomberg via Insurance Journal, "AI Cybersecurity Startup Upwind Raises at $3.8 Billion Value," 28 Oct 2026. insurancejournal.com
• The Next Web, "Island raises $400m at a $6.4bn valuation to govern AI agents," 24 Sep 2026. thenextweb.com
• The Next Web, "Cyera has now raised $1.4bn this year to police AI agents," 22 Sep 2026. thenextweb.com
• CrowdStrike, "CrowdStrike to Acquire Seraphic, Turning Any Browser into a Secure Enterprise Browser," 13 Jan 2026. crowdstrike.com
• Techzine, "Google closes $32B Wiz deal, its largest acquisition ever," 11 Mar 2026. techzine.eu