Nine months of stealth. Ten people. Then an all-equity tuck-in that stands up an in-house AI Security Lab. That is the deal — not a CNAPP mega-merge.
On September 23, 2026, Upwind announced it is acquiring Israeli stealth AI-security startup Aegis and launching the Upwind AI Lab / AI Security Labs. The same day, Axios Pro published an exclusive with CEO Amiram Shachar (Chris Metinko). Official deal price from Upwind: Undisclosed. Structure: all-equity (Axios); stock-based (Ctech). Axios Pro, citing a source — not framed as Shachar’s number in the unlocked lede — reported the deal valued between $25 million and $50 million. Globes separately cited market sources estimating about $30 million in shares. Ctech called it “tens of millions.” Those are attributed estimates. Firm EV, cash mix, earnout, and share percentage are not disclosed.
Why Upwind would do this. The path was partnership first. Shachar told Axios the founders approached Upwind for a strategic partnership and investment; after several months, Upwind bought the ~10-person shop. Company messaging is blunt: AI security is moving too fast to wait on organic R&D alone. Shachar (Axios): “AI lives everywhere, including the cloud… We have to step up and meet the moment.” In vendor-aligned press he added that bringing co-founders Omri Limor and Saar Ankonina aboard builds a team that can move as quickly as the threat — with deep expertise securing agents, skills, and plugins — then combine that with Upwind’s existing platform so research becomes product faster. Limor’s framing: Aegis was built for the missing security layer around those components; months of partnership made acquisition plus Labs the shorter path. Ankonina: integrating into Upwind’s platform is an immediate path to scale. Buyer context: Shachar told Axios Upwind has more than 400 customers and “tens of millions of dollars” in revenue. Upwind’s own January 2026 blog covered a $250 million raise. Reported ~$300M / ~$3.8B marks circulating in Israeli tech press remain not an official Upwind announce on deal day — Axios itself hedges those figures. They are not company-confirmed.
What Aegis was really good at. Sourced positioning only. Aegis operated in stealth (Globes) from early 2026 — roughly nine months before the announce. Focus: security for AI agents, skills, and plugins. Threat language across Axios and deal-day press: stopping AI-generated / AI-powered attacks, including autonomous exploitation pipelines and large-scale credential harvesting. Globes describes technology that identifies characteristics of attacks involving AI agents — hard to spot with existing CISO tooling. Post-deal lab emphasis from Upwind messaging (via TNW/wire): scanning, attack detection, AI security capabilities, with particular callout on secret scanning in transit and at rest (API keys / session tokens harvested at scale). Founders are Unit 8200 alumni. No public commercial product brand name or SaaS SKU turned up in research. This Israeli stealth is not connected to the unrelated “Aegis” / AegisAI projects. Globes places Aegis in a similar space to Onyx and Noma, per Globes. Globes also “reportedly” said Aegis had no customers or revenue; that is not confirmed by Upwind; it is attributed caution, not hard fact. Aegis venture raise amount and investors: Undisclosed in reviewed primaries (Globes floated “several million” during a financing process when Upwind offered to acquire — unconfirmed).
Core IP Upwind is getting. Read the IP as a research-to-product lane, not a named SKU. Strongest sourced claims: (1) the agent / skills / plugins attack surface as the missing control layer; (2) defense framing against AI-generated attacks — autonomous exploit pipelines and credential harvesting; (3) detection language around AI-agent-involved attack characteristics; (4) lab-side push into scanning and secrets in transit and at rest. CNAPP adjacency is indirect: Aegis was not sold as a standalone CNAPP displacing Wiz or peers — no such claim is sourced. Runtime is Upwind’s own platform thesis (“understanding risk starts with understanding what is actually happening at runtime,” per the AI Lab post). The combination story is Aegis expertise on Upwind’s runtime platform, not Aegis-as-CNAPP. Lab sizing from company statements via press: about 12 developers/researchers from both companies at launch, aiming toward roughly 25 in ~3 months and potentially ~35 — press-relayed company plans, not a CyberMerge forecast. Limor and Ankonina co-lead the Labs; team and tech integrate into Upwind.
How it expands the portfolio. Trace the arc with primaries only. Upwind markets a runtime-powered CNAPP — application security, posture, real-time protection; agentless scanners plus runtime sensors; AI Security already called out on the product page. First acquisition: Nyx Security, closed/announced April 28, 2025 — application-layer runtime / ADR (function-level execution, behavioral anomalies). Aegis is the next tuck-in: from cloud infrastructure and application runtime into a dedicated AI-agent / skills / plugins / AI-generated-attack lane inside AI Security Labs. The AI Lab post lists initial focus areas: Security for AI (full stack at runtime), Agentic Security, frontier models/research/benchmarks, and advanced AI systems. Existing Upwind Agentic Pack is referenced in that post — security itself becoming agentic. Shachar told Axios Upwind will remain aggressive on M&A, bought Nyx last year, has one more deal “on the radar,” and that “Doing a deal like Aegis every quarter would be ideal.” That is appetite language — not a pipeline list. Next target: Undisclosed.
POV. This is an acquihire-plus-IP signal dressed as category theater — and that is not a diss. A nine-month-old stealth with no public product brand does not rewrite the CNAPP leaderboard overnight. It does buy Upwind a founder-led Lab that maps the buyer anxiety every desk is already pricing: agents with tools, skills, and plugins moving faster than classical CNAPP and standing secrets. Partnership → join → formal acquire is the sequencing (founder LinkedIn Labs posts preceded the Sep 23 announce by weeks, per Globes timing). Underwrite the Labs against shipped capabilities on the runtime platform, not against an Aegis ARR multiple. Price stays Undisclosed officially; the Axios source range is the attributable band.
Underwrite sheet — sourced only: Upwind acquires Aegis + launches Upwind AI Lab / AI Security Labs (Upwind blog Sep 23, 2026); Axios Pro exclusive same day (Metinko / Shachar); all-equity (Axios) / stock-based (Ctech); official price Undisclosed; Axios source estimate $25–50M; Globes market estimate ~$30M in shares (secondary); Ctech “tens of millions”; ~10 people (Shachar via Axios); founded early 2026 / ~9 months; Limor & Ankonina (8200) lead Labs; agents/skills/plugins + AI-generated attacks / autonomous exploit pipelines / credential harvesting; secret scanning in transit/at rest (vendor messaging); no public Aegis product brand name; Globes: similar space to Onyx and Noma; Globes “reportedly” no customers/revenue — attributed, not Upwind-confirmed; Nyx ADR acq Apr 28, 2025; Upwind runtime CNAPP; Upwind >400 customers + “tens of millions” revenue (Shachar to Axios); Upwind $250M raise Jan 2026 (vendor); ~$300M/$3.8B marks not treated as official Upwind announce; cash/earnout/share% Undisclosed; Aegis raise/investors Undisclosed. Labs are the product. Sources: the primaries.