Business

Datadog’s reported $4bn Upwind bid disputed: what UK buyers should do

The Information says Datadog offered nearly $4bn for cloud security firm Upwind; CTech says no offer was made. What it means for UK buyers.

Rising market chart graphic with the headline Datadog's $4bn Upwind bid: reported, then disputed.

A report that Datadog offered close to $4bn for cloud security startup Upwind has been flatly contradicted by an Israeli tech outlet. Whether or not the bid was made, UK security buyers should treat it as a clear sign that runtime cloud security is moving into the big observability platforms.

What happened

On 22 October 2026, The Information reported that Datadog, the US monitoring and observability company, had offered nearly $4bn to acquire Upwind, a cloud security startup founded in Israel in 2022 by Amiram Shachar. According to that report, Upwind had not accepted. It was instead finishing a $300m funding round that would value it at about $3.8bn, so the reported bid carried only a slim premium over its private valuation. The Information also said Upwind had received approaches from other companies but had not accepted them.

The same day, CTech, the English-language technology site of Israel’s Calcalist, published a different account. It said it had learned that the offer described in The Information’s report “was not made”. Stocktwits reported that Upwind declined to comment to The Information and that Datadog did not immediately respond to the outlet’s request for comment.

Upwind raised $250m at a $1.5bn valuation in January 2026 and is now raising at more than double that figure. According to The Information’s figures, cited by both CTech and TIKR, Upwind’s annual recurring revenue has passed $50m, up from about $20m at the end of 2025. TIKR, also citing the report, says the two companies discussed a deal worth about $1bn last year that fell apart.

Datadog’s shares fell 5.62% on 22 October, though TIKR notes that reports differed on how much of the drop was due to the bid story. They recovered 4.62% the following day. Datadog, worth roughly $90bn according to CTech, reports third-quarter results on 4 November.

The detail

Upwind sells runtime security for cloud-hosted applications. It watches workloads and infrastructure as they run, flags risk and responds to attacks, and it now covers the AI agents that organisations are deploying inside those environments. Its named customers include Roku and the Brazilian digital bank Nubank. In September 2026 it bought Aegis for shares, in a deal CTech puts in the tens of millions of dollars, and launched Upwind AI Labs to focus on securing AI systems and agents.

The fit with Datadog is easy to see. Datadog already collects large volumes of telemetry from the same cloud workloads Upwind protects, and it already sells security products alongside its monitoring. Adding a runtime protection engine would let it pitch one agent, one data pipeline and one console for both operations and security teams.

The numbers are less tidy. TIKR estimates that close to $4bn for just over $50m of recurring revenue is a multiple of up to about 80 times. That compares with forward revenue multiples of roughly 19 times for Datadog and 22 times for Palo Alto Networks, though TIKR says the gap overstates the premium given Upwind’s growth. Paying cash would use roughly all of Datadog’s $3.71bn net cash as of 30 June 2026, while paying in shares would dilute existing holders by about 4%.

There is also an awkward quote on the record. Speaking at a Goldman Sachs conference in September, Datadog’s chief financial officer, David Obstler, said competitors that had tried to assemble monitoring platforms through acquisitions “have not succeeded”, because customers want products knitted together. That standard would apply to any Datadog purchase of Upwind.

Timeline showing Upwind's 2026 funding and acquisition, the reported Datadog bid on 22 October, CTech's denial and Datadog's 4 November results date.

Why it matters for UK organisations

Few UK organisations deal with Upwind directly, but many run Datadog, and most buy some form of cloud workload or posture protection. The story matters less for whether this deal happens than for what it shows about the market. Big platform vendors want to own the runtime layer of cloud security, and well-funded specialists are now valued highly enough to reportedly turn down offers.

That affects UK buyers in three ways. First, contract risk. If a point product you rely on is acquired, roadmaps, pricing models and support arrangements can change quickly, and the buyer’s priority becomes migrating customers onto its own platform. Second, concentration risk. Putting monitoring, logging and runtime protection with one supplier simplifies operations, but one outage, compromised agent update or pricing decision then hits visibility and defence together. UK regulated firms that already have to map material third parties for operational resilience will recognise that problem.

Third, data handling. A runtime security tool sees a great deal: process activity, network flows, sometimes secrets and payloads. When ownership changes, the sub-processor list, hosting regions and data retention terms can change too. Under UK GDPR, those changes need checking, not assuming.

Expert view

I would not read too much into the headline number while the two published accounts contradict each other so directly. Deal reporting in this sector often mixes genuine talks, early approaches and positioning ahead of a funding round, and outsiders rarely know which.

What I would read into it is the direction of travel. When we test cloud estates, the gap is rarely a lack of tools. It is more often that the alerts from the security tool and the telemetry from the monitoring tool never meet, so an attacker’s activity shows up in both places and is investigated in neither. Vendors know this, and merging the two layers is the obvious commercial answer. Done well, it helps. Done badly, with two products under one logo and two agents on every host, it adds cost and attack surface without adding insight.

In my experience, the organisations that come through vendor consolidation well are the ones that wrote down, before signing, what they would do if the product changed hands. A rumour like this is a cheap prompt to do so.

What to do now

  1. Inventory your cloud security dependencies. List every runtime, posture and workload protection product, who owns the vendor today, and which teams rely on its output.
  2. Check change-of-control terms. Review contracts for termination rights, price protection and data return obligations if a supplier is acquired, and add them at renewal if they are missing.
  3. Review data flows and sub-processors. Confirm what each agent collects, where it is stored and for how long, and require notice of any change in ownership or hosting.
  4. Control agent sprawl. Treat every security and monitoring agent as privileged software: restrict who can change its configuration and track its updates. This maps to the Cyber Essentials controls on secure configuration, user access control and security update management.
  5. Test your exit. Make sure detections, logs and alert routing can be exported in usable formats so a forced migration does not leave you blind.
  6. Ask your vendors directly. At your next review, ask Datadog and your cloud security supplier how their roadmap handles runtime protection and AI agent workloads, and get the answers in writing.

Bottom line

Whether Datadog bid nearly $4bn for Upwind depends on whose reporting you believe, and neither company has commented publicly. The trend behind the story is not in doubt: cloud runtime security is being pulled into large platforms, and specialist suppliers are valuable acquisition targets. UK organisations should plan for their security vendors changing hands before it happens, not after.

Sources

Related Posts