Label first. This is a reported deal, and it’s disputed. On October 22, The Information reported that Datadog offered nearly $4 billion to buy Upwind, the Israeli cloud security startup, and that Upwind didn’t accept. Hours later CTech said it had learned the reported offer was not made (CTech). Globes and ISMG ran the report too. Neither company commented. Treat everything below as analysis of a rumor, not a signed deal.
The market didn’t wait for clarity. Datadog stock fell $14.22, or 5.21%, to $258.87 on Thursday afternoon, per ISMG.
The numbers on the table. Upwind raised $250 million at a $1.5 billion valuation in January. It’s finalizing a $300 million round at $3.8 billion (CTech). The Information reported Upwind’s annual recurring revenue, or ARR, passed $50 million, up from about $20 million at the end of 2025 (via CTech). The two companies reportedly talked about a roughly $1 billion deal in July 2025 that never happened (ISMG).
Do the division. Nearly $4 billion over a bit more than $50 million of ARR is roughly 80 times recurring revenue. Dealroom ran the same math and noted that’s a higher multiple than Google paid for Wiz. For a company that would be Datadog’s largest deal by far (the previous biggest was Eppo at $220 million, per ISMG), that’s a lot of faith in one growth curve.
Here’s the part people miss. Upwind’s pitch is runtime security. That means watching what cloud workloads actually do while they run, not just scanning settings. It does that partly with eBPF, a way to read activity inside the Linux kernel without changing the kernel (SiliconANGLE). Datadog already has an agent sitting on customers’ hosts, collecting exactly this kind of signal for performance monitoring. It’s sold security on top of that since 2020: SIEM, then posture management, workload protection, app and API protection, and code security (ISMG).
So Datadog doesn’t need Upwind’s sensor. It owns the vantage point. What it would be paying for is everything around the sensor: a security team buyers already trust, the detections and attack-path analysis, AI and data security posture, and a brand the CISO picks on purpose. ISMG lists supply chain security, attack path analysis, container security and dynamic app testing as things Upwind adds.
That’s the real question. Can an observability company buy security credibility? Security tools get chosen by the security team. Observability tools get chosen by engineering. Datadog’s security products ride the engineering relationship. Upwind sells to the CISO. An 80x price only makes sense if Datadog can turn its engineering footprint into security budget fast, and keep Upwind’s security buyers from walking when the logo changes.
Why Upwind might say no. ISMG points out there’s no entrenched pure-play cloud security leader since Wiz sold to Google. That scarcity is worth something. A $3.8 billion private round with Bessemer and TCV keeps the founders’ option to be the independent CNAPP (cloud-native application protection platform, the all-in-one cloud security category). CEO Amiram Shachar told ISMG in January he thinks the company that builds the best CNAPP is a $100 billion company. A ~$4 billion offer barely above the private mark doesn’t pay for that dream.
Why Datadog might want it anyway. Datadog was worth $93.63 billion on Thursday, per ISMG. A ~$4 billion deal is about 4% of that. If security becomes the second engine of the platform, it’s a small price. If it doesn’t, it’s an expensive team hire. That’s why the stock dropped. Investors heard “premium multiple, unproven cross-sell.”
Our take. The valuation is defensible only as a distribution bet, not on today’s revenue. At around 80x ARR, the buyer is paying for what Upwind could become inside Datadog’s customer base. That can work. It also has a habit of not working when the security team and the engineering team don’t agree on who owns the tool.
What buyers should do now. If you run both, don’t panic and don’t consolidate early. Ask each vendor two questions. Who on your side owns detection quality after a deal? And will your runtime sensor stay separate from, or merge into, the monitoring agent? One agent is cheaper to run. Two agents means one outage doesn’t blind both your ops and your security views.