Three cloud security startups spent 2026 trying to answer the same question in three different ways: how do you catch an attacker who is already inside a running cloud workload, not just one who left a misconfigured S3 bucket open. Sweet Security, Upwind Security, and Lacework (now sold under Fortinet’s FortiCNAPP brand) all compete in the category analysts increasingly call Cloud Detection and Response, or CDR. The money chasing this bet is enormous: Upwind priced its January 2026 round at a $1.5 billion valuation, then reportedly saw investors line up for a follow-on round at $3.8 billion by September. Sweet Security raised $75 million the previous November. Fortinet, meanwhile, already owns a CDR platform outright after paying $152.3 million in cash for Lacework back in 2024. This comparison breaks down what each platform actually does, what it costs, how reviewers rate it, and which one fits which team.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is Cloud Detection and Response (CDR), and Why It Is Not Just CNAPP
Cloud Detection and Response describes tools that watch cloud workloads, containers, and identities while they are running, rather than only checking stored configuration files for mistakes. Managed detection and response firm Expel defines CDR as “a security approach that provides continuous monitoring, threat detection, and incident response specifically designed for cloud environments.” That is a meaningfully different job than Cloud Security Posture Management (CSPM), which scans snapshots of infrastructure-as-code and cloud account settings looking for drift from a secure baseline.
Gartner has not published a report with the exact title “Market Guide for Cloud Detection and Response.” What does exist, and what every CDR vendor cites, is the 2024 Gartner Market Guide for Cloud-Native Application Protection Platforms (CNAPP), the broader category that bundles posture management, workload scanning, and runtime detection into a single platform. CrowdStrike’s own breakdown of that guide describes CDR as encompassing “24/7 managed detection and response (MDR), 24/7 proactive threat hunting, specialized cloud services and a unified CNAPP to ensure complete cloud security coverage from prevention to detection to remediation.” In practice, most of today’s CDR vendors, including all three compared here, market themselves as a runtime layer that plugs into or sits alongside a broader CNAPP.
The practical distinction security teams care about is latency. A CSPM scan might run once a day and flag an overly permissive IAM role. A CDR sensor running inside the workload, often built on eBPF (extended Berkeley Packet Filter) kernel-level hooks, can flag the moment a process starts making outbound connections it has never made before, or when a container spawns a shell it should not have access to. That gap between “we found the misconfiguration this morning” and “we saw the attacker move laterally thirty seconds ago” is the entire pitch behind Sweet Security, Upwind, and Lacework’s FortiCNAPP runtime module. For a deeper look at how posture-focused platforms stack up against each other, see our earlier comparison of Wiz, Orca Security, and Prisma Cloud, three vendors that compete more directly in the CNAPP posture-management layer this article’s trio sits on top of.
Sweet Security: Runtime CNAPP Built on eBPF and a $120 Million War Chest
Sweet Security is a Tel Aviv-based startup founded in 2022 by Dror Kashti, Eyal Fisher, and Orel Ben Ishay. The company raised a $12 million seed round in August 2023, followed by a $33 million round in March 2024 led by Evolution Equity Partners. On November 12, 2025, Sweet announced a $75 million Series B, again led by Evolution Equity Partners, with Munich Re Ventures, Glilot Capital Partners, and Key1 Capital joining in. That round brought Sweet’s total disclosed funding to roughly $120 million.
Sweet calls its own product a “Runtime CNAPP,” a label that captures the company’s pitch directly: instead of treating runtime detection as a bolt-on feature, Sweet built its entire platform around eBPF-based sensors and what it describes as a patented deviation-detection engine that learns a workload’s normal behavior and flags departures from it. The November 2025 announcement bundled that runtime engine with a new AI security layer, extending detection to cover AI models and autonomous agents running inside customer environments, not just traditional containers and virtual machines. Sweet also markets identity-threat detection and behavioral analytics as part of the same platform, aiming to cover workload, application, and identity signals under one sensor architecture.
On the commercial side, Sweet told press that its enterprise customer count grew tenfold in the twelve months leading up to the Series B announcement, and that its customer base includes multiple Fortune 1000 companies. The company has not disclosed an absolute customer count or named specific enterprise accounts publicly, so that growth figure should be read as a company-reported metric rather than an independently audited one.
Upwind Security: From $100 Million to a Reported $3.8 Billion Valuation
Upwind Security’s funding trajectory is the steepest of the three. The Israeli-founded, San Francisco-headquartered company raised $100 million in December 2024 to fund global expansion, at the time planning to nearly double headcount to around 300 people across offices in Israel, San Francisco, the UK, and Iceland. Just over a year later, on January 26, 2026, Upwind announced a $250 million Series B led by Bessemer Venture Partners, with Salesforce Ventures and Picture Capital participating. That round, confirmed by the company’s own release and independent trade coverage, valued Upwind at approximately $1.5 billion and brought its cumulative funding to $430 million, officially making it a unicorn.
By September 2026, multiple outlets, including Bloomberg and Globes, reported that Upwind was closing or had closed an additional $300 million round led by Bessemer at a valuation near $3.8 billion, more than doubling its January figure in roughly eight months. Those September reports cite unnamed sources rather than an Upwind-issued press release available at the time of this comparison, so that later figure should be treated as reported rather than fully confirmed through an official company announcement.
Technically, Upwind pitches itself as “runtime-first”: sensors that observe what is actually happening inside a live cloud environment or AI workload, rather than relying solely on periodic scans of stored configuration. Upwind’s January 2026 funding announcement said the company planned to expand its AI-security capabilities and move further upstream toward developers, aiming to catch risky configurations before they ever reach production rather than only detecting them at runtime.
Lacework and FortiCNAPP: What Fortinet’s $152.3 Million Deal Bought
Lacework took a different path to 2026: it stopped being an independent company. Fortinet announced its intent to acquire Lacework on June 10, 2024, with financial terms undisclosed at the time. The deal closed on August 1, 2024, and Fortinet’s own 10-Q filing with the SEC later confirmed the acquisition price at $152.3 million in cash, a figure that is now the authoritative number on the deal rather than the “undisclosed” language used in the initial press release.
Fortinet’s stated goal was to offer Lacework’s CNAPP technology both as a standalone product and integrated into its broader security portfolio, which spans firewalls, SASE, and endpoint protection under the Fortinet Security Fabric. By 2025, the product had been rebranded as FortiCNAPP, retiring the Lacework name in Fortinet’s own marketing. In January 2026, Fortinet added native Data Security Posture Management (DSPM) capability to FortiCNAPP, folding data-classification and sensitive-data-discovery features into the same console that handles runtime workload detection.
What has not been independently reverified since the acquisition is a detailed technical breakdown of how Lacework’s original Polygraph anomaly-detection engine maps onto FortiCNAPP’s current architecture, or a published standalone price list. For organizations already running Fortinet firewalls and FortiSASE, the pitch is bundling and a single vendor relationship rather than a best-of-breed runtime sensor. For teams with no existing Fortinet footprint, the clearest comparison point is that a once fast-moving CDR startup is now a line item inside a much larger security conglomerate’s roadmap, with the product-velocity tradeoffs that typically come with that kind of integration.
Sweet Security vs Upwind vs Lacework FortiCNAPP: Full Specs Comparison
The table below lines up the three platforms across the dimensions that actually move a buying decision: company stage, funding, architecture, and where each one sits in the broader cloud security stack.
| Dimension | Sweet Security | Upwind Security | Lacework (FortiCNAPP) |
|---|---|---|---|
| Founded | 2022, Tel Aviv | 2022, Tel Aviv / San Francisco | 2015, originally San Jose |
| Independence | Independent, venture-backed | Independent, venture-backed | Wholly owned by Fortinet since Aug. 2024 |
| Total disclosed funding | ~$120 million (as of Nov. 2025) | $430 million confirmed (Jan. 2026); additional $300M reported Sept. 2026 | Acquired for $152.3 million cash (Fortinet 10-Q) |
| Latest confirmed valuation | Not publicly disclosed | ~$1.5 billion (Jan. 2026); ~$3.8 billion reported (Sept. 2026) | N/A — folded into Fortinet (NASDAQ: FTNT) |
| Core architecture | eBPF kernel-level sensors with patented deviation detection | Runtime sensors observing live cloud and AI workloads | Originally Polygraph anomaly-detection data lake; now part of FortiCNAPP |
| Category positioning | “Runtime CNAPP” — cloud + AI security | “Runtime-first” cloud and AI security platform | Full CNAPP with native DSPM (added Jan. 2026) |
| AI / agent monitoring | Yes — explicit AI model and agent behavior monitoring since Nov. 2025 | Expanding AI-security capabilities per Jan. 2026 announcement | Not detailed in available Fortinet materials |
| Identity threat detection | Yes, bundled with behavioral analytics | Not specifically detailed in public materials | Not specifically detailed in public materials |
| HQ / offices | Tel Aviv | Israel, San Francisco, UK, Iceland | Absorbed into Fortinet (Sunnyvale, Calif.) |
| Parent company ecosystem | None — standalone | None — standalone | Fortinet Security Fabric (firewalls, SASE, endpoint) |
| 2026 reported customer growth | 10x enterprise customers in 12 months (company-reported) | Not disclosed | Not disclosed post-acquisition |
| Public pricing | Quote-based, undisclosed | Quote-based, undisclosed | Quote-based, often bundled with Fortinet licensing |
Pricing and Licensing: Why None of the Three Publish a Price List
Anyone hoping for a per-workload dollar figure here is going to be disappointed, and that is true across the entire CDR category, not just these three vendors. Sweet Security, Upwind, and Lacework’s FortiCNAPP all sell through negotiated annual contracts rather than self-serve price lists. That is standard for enterprise runtime security tools, where pricing typically scales with the number of cloud accounts, workloads, or vCPU-hours monitored, and where procurement almost always goes through a sales-led proof-of-concept rather than a checkout page.
| Vendor | Pricing model | Published list price | What signals deal scale |
|---|---|---|---|
| Sweet Security | Quote-based annual contract, typically scoped by workload count | Not published | $120M total funding; reported Fortune 1000 customer base |
| Upwind Security | Quote-based annual contract, consumption-influenced | Not published | $430M total funding; $1.5B confirmed valuation |
| Lacework (FortiCNAPP) | Quote-based, frequently bundled into Fortinet Security Fabric licensing | Not published | $152.3M acquisition price; backed by FTNT’s public-company scale |
The practical takeaway for buyers: budget for a multi-week to multi-month sales cycle with all three, expect pricing conversations to start with your cloud footprint (number of accounts, clusters, and workloads) rather than a flat seat count, and push each vendor for a proof-of-concept against your own production traffic before signing anything multi-year. Teams that already run Fortinet hardware have real leverage to negotiate FortiCNAPP as part of a broader renewal; teams with no Fortinet footprint generally do not get that discount lever with Lacework’s successor product.
Benchmarks: What Three Independent Reviews Say About Detection Performance
Because none of the three vendors publish independent, third-party-audited detection benchmarks (no MITRE ATT&CK evaluation round currently covers the CDR category the way it covers EDR), the best available signal comes from review aggregators and independent trade coverage rather than a single definitive lab test. Three sources give a consistent-enough picture to be useful.
| Source | What it measured | Finding relevant to this comparison |
|---|---|---|
| PeerSpot CDR category rankings (Feb. 2026) | User-submitted ratings and “mindshare” across the Cloud Detection and Response category | Sweet Security ranked #4 in the category with an 8.6 average rating; Upwind ranked #8 with a 9.5 average rating among fewer total reviews. Wiz led the broader category with 30.5% mindshare. |
| GBHackers 2026 CDR scorecard | Independent editorial comparison across 12 CDR vendors on real-time detection, correlation, and response automation | Sysdig was rated strongest on raw real-time detection depth and CrowdStrike on response automation; Sweet Security was grouped among “purpose-built real-time specialists” alongside Stream.Security and Skyhawk. |
| DecryptionDigest CDR guide (2026) | Vendor-by-vendor capability comparison including Sysdig, Lacework, Orca, CrowdStrike, and Wiz Defend | Lacework was included in the core comparison set as a recognized CDR-capable platform, but the guide did not single it out as a category leader on any individual axis post-acquisition. |
Read across all three, the pattern is: Sweet and Upwind are both treated as newer, fast-moving specialists rather than incumbents, Wiz and Sysdig currently hold the strongest independent reputation for raw detection depth in the broader category, and Lacework’s FortiCNAPP is recognized as a legitimate player but is rarely singled out for a specific technical edge in post-acquisition coverage. None of this constitutes a controlled, apples-to-apples lab benchmark, and buyers should treat these as directional signals to shortlist vendors for a hands-on proof-of-concept, not as a final scoring system.
CDR vs CNAPP vs CSPM vs SIEM: How the Categories Actually Differ
It helps to place CDR on a timeline rather than a feature checklist. CSPM looks backward at configuration state, usually on a scan interval measured in hours. CNAPP is the umbrella category that bundles CSPM, container and workload scanning, and increasingly CDR-style runtime detection into one platform, which is exactly why Sweet Security and Upwind both describe themselves as “runtime CNAPP” rather than pure CDR point products. SIEM sits downstream of all of it, correlating logs and alerts from cloud workloads, endpoints, identity providers, and network devices into a single investigation pane, typically after the fact rather than in the moment an attack happens.
CDR’s reason to exist is the gap between CSPM’s scan interval and SIEM’s log-ingestion lag. A kernel-level eBPF sensor watching a running container can see a reverse shell spawn in real time; a CSPM scan running once a day will not see it until the next cycle, and a SIEM will only see it once the relevant logs are shipped, parsed, and correlated, which can be minutes to hours depending on pipeline design. For organizations building a security operations pipeline from source telemetry rather than a single packaged suite, this is the layer that needs to plug into the rest of the detection stack described in our guide to confidential computing options like Intel TDX, AMD SEV-SNP, and AWS Nitro Enclaves, since runtime attestation and runtime detection increasingly get evaluated by the same security architecture teams.
One more adjacent category worth separating out: Cloud Infrastructure Entitlement Management (CIEM), which focuses specifically on who has access to what in a cloud environment, frequently surfacing the fact that the overwhelming majority of granted permissions are never actually used. Our earlier coverage found that 95% of granted cloud access sits unused at a typical organization, which is a posture and entitlement problem, not a runtime detection problem. CDR tools like the three compared here generally do not replace a dedicated entitlement review; they catch what happens after an attacker has already abused an over-permissioned identity.
How CDR Fits Into the Rest of the 2026 Cloud Security Stack
Buying a CDR platform rarely happens in isolation. Most security teams evaluating Sweet Security, Upwind, or FortiCNAPP already run, or are in the process of buying, several adjacent tools, and understanding how those pieces fit together matters as much as the runtime sensor itself. Data Security Posture Management (DSPM) tools, for instance, answer a different question entirely: where does sensitive data actually live across a sprawling multi-cloud estate, and who can reach it. We compared the leading options in Varonis vs Cyera vs BigID, and the overlap with CDR is real but narrow. A DSPM tool tells you a database contains unencrypted customer records; a CDR sensor tells you the moment a process inside that same workload starts trying to exfiltrate them.
Cyber Asset Attack Surface Management (CAASM) is another adjacent category that frequently gets confused with CDR, mostly because both promise “visibility.” CAASM platforms, compared in our breakdown of Axonius, JupiterOne, and Sevco, build an inventory of every asset across cloud, on-prem, and SaaS environments so security teams know what exists in the first place. CDR assumes that inventory already exists and focuses on what those assets are doing right now. A mature cloud security program typically layers all of these together: CAASM for inventory, DSPM for data risk, CSPM or the posture half of a CNAPP for configuration drift, and CDR for runtime behavior, feeding everything into a SIEM for correlation and a case-management workflow for response.
Network Detection and Response (NDR) is the closest conceptual cousin to CDR, and the two categories are converging. NDR platforms, covered in our comparison of Darktrace, Vectra AI, and ExtraHop, watch network traffic patterns for anomalies, which historically meant on-premises east-west traffic between data center servers. CDR vendors are now building the cloud-native, workload-level equivalent of that same behavioral-anomaly approach, just scoped to containers, serverless functions, and cloud-native workloads instead of physical network segments. Teams that already run an NDR platform should expect some signal overlap with a new CDR deployment and plan their SIEM correlation rules accordingly, rather than treating the two alert streams as fully independent. For a broader view of how the cybersecurity industry frames all of these overlapping categories together, see Tech Insider’s ongoing cybersecurity threats coverage for 2026.
Real-World Scenarios Where Runtime Detection Earns Its Keep
None of the three vendors in this comparison has published a named, independently verifiable 2025-2026 customer case study for their CDR product specifically, so the examples below are representative scenarios drawn from how each platform is marketed and how the category is used in practice, not confirmed deployments at named companies.
- A multi-cloud fintech running containers at scale. A daily CSPM scan might flag a loosened network policy, but it will not catch a compromised dependency spawning an unexpected outbound connection at 2 a.m. An eBPF-based sensor, the kind both Sweet Security and Upwind rely on, can flag that connection attempt within seconds of it happening.
- An AI-native startup running autonomous agents in production. Sweet Security’s November 2025 platform update specifically targets this case: monitoring what an AI agent actually does at runtime, not just what permissions it was granted, becomes critical once agents can execute code or call internal APIs on their own.
- An enterprise already standardized on Fortinet hardware. For a security team with FortiGate firewalls and FortiSASE already in place, adding FortiCNAPP’s runtime module is primarily a licensing and integration decision rather than a new vendor relationship, which shortens procurement time considerably compared to onboarding an independent startup.
- A SaaS company migrating from a legacy, scan-only cloud security tool. Teams that built their cloud security program around periodic configuration scans alone often discover their blind spot the hard way, during an incident where the attacker was inside a workload for hours before any posture tool flagged anything.
- A regulated healthcare or financial services firm facing continuous-monitoring requirements. Increasingly, auditors and cyber insurers are asking for evidence of continuous, not periodic, monitoring of production cloud workloads, which is a direct match for what CDR platforms are built to provide as evidence.
5 Use Cases and Which Platform Fits Each One
- Fast-growing startup needing quick time-to-value. Sweet Security’s single-sensor, eBPF-first deployment model is built for teams without a large platform engineering staff to dedicate to rollout.
- Well-funded scale-up wanting the broadest roadmap commitment. Upwind’s funding trajectory, from $100 million to a reported $3.8 billion valuation inside roughly 21 months, signals aggressive reinvestment into AI-security and shift-left features, which matters if you are picking a five-year platform bet rather than a point solution.
- Existing Fortinet shop consolidating vendors. FortiCNAPP is the obvious default for organizations that want fewer vendor relationships and are comfortable trading some best-of-breed runtime depth for bundled licensing and a single support contract.
- Organization running AI agents or LLM-backed automation in production. Both Sweet Security and Upwind explicitly market AI workload and agent-behavior monitoring; this is a newer capability where a point-in-time CSPM scan offers almost no protection.
- Enterprise needing vendor-agnostic, multi-cloud runtime coverage without a single-vendor hardware dependency. Independent startups like Sweet and Upwind, rather than a hardware-vendor-owned product, tend to fit better where the cloud estate spans AWS, Azure, and GCP without a dominant on-prem Fortinet or Palo Alto footprint driving the decision.
Migration Guide: Moving From Posture-Only Tools to a Runtime CDR Stack
Teams moving off a CSPM-only or SIEM-only setup toward a dedicated CDR layer tend to follow a similar rollout pattern, regardless of which of the three vendors they pick. Here is the sequence that minimizes both alert fatigue and deployment risk.
- Inventory your current cloud security stack and map exactly which gaps are posture-only (CSPM), which are log-based (SIEM), and which have no runtime visibility at all today.
- Pick a representative subset of production workloads, ideally including at least one containerized microservice cluster and one workload with elevated IAM permissions, to run a vendor proof-of-concept against.
- Request sensor deployment documentation from each shortlisted vendor (Sweet Security, Upwind, or FortiCNAPP) and confirm the exact kernel versions, container runtimes, and cloud providers supported before scheduling a pilot.
- Deploy the eBPF or runtime sensor in monitor-only mode first. Do not enable automated blocking or remediation actions during the initial baseline period.
- Let the deviation-detection or behavioral baseline run for a minimum of two to four weeks to reduce false positives caused by normal, but previously unobserved, application behavior.
- Cross-reference the new runtime alerts against your existing CSPM findings for the same workloads to identify genuine net-new detections versus duplicate signal.
- Integrate the CDR platform’s alert stream into your existing SIEM or SOAR pipeline rather than running it as a fully separate console, so analysts are not context-switching between tools during an active incident.
- Define escalation paths and ownership before go-live: who gets paged for a runtime alert, and what is the expected response-time SLA.
- Run a tabletop exercise simulating a container compromise to validate that the new runtime alerts actually reach the right responder in time.
- Expand sensor coverage incrementally, cluster by cluster or account by account, rather than a single big-bang rollout across the entire cloud estate.
- Negotiate pricing based on your actual workload count from the pilot, not the vendor’s initial estimate, since quote-based pricing across all three vendors leaves real room for adjustment once usage data exists.
- Decommission any redundant point tools only after at least one full detection cycle confirms the new CDR platform is not missing coverage the old tool previously caught.
- Document the new runtime-detection capability for compliance and cyber-insurance purposes, since continuous monitoring evidence increasingly factors into both audit and underwriting conversations.
A simplified example of the kind of structured event a runtime sensor typically emits once a deviation is flagged looks something like this. The exact schema differs by vendor, but the underlying fields, process, workload identity, and network behavior, are consistent across the category.
{
"event_type": "runtime_deviation",
"severity": "high",
"workload": {
"cluster": "prod-us-east-1",
"pod": "payments-api-7f9c",
"container_image": "payments-api:2.14.1"
},
"process": {
"name": "sh",
"parent": "node",
"unexpected_child": true
},
"network": {
"outbound_connection": "203.0.113.42:4444",
"baseline_match": false
},
"detection_method": "ebpf_behavioral_baseline"
}Sweet Security: Pros and Cons
Sweet Security’s biggest advantage is focus. As a company built from day one around runtime detection, its eBPF sensor architecture and deviation-detection engine are the product, not a feature bolted onto an older posture-management tool. The explicit extension into AI agent and model monitoring in late 2025 also puts it ahead of most competitors on a capability that is about to matter a lot more. The tradeoffs: Sweet is still a relatively young, independent company with roughly $120 million in total funding, smaller than Upwind’s war chest, and it has not disclosed a current valuation, pricing structure, or a named enterprise reference customer, which makes it harder for risk-averse buyers to benchmark vendor stability during procurement.
Upwind Security: Pros and Cons
Upwind’s advantage is momentum and capital. Going from a $100 million raise in December 2024 to a confirmed $1.5 billion valuation thirteen months later, and reportedly to $3.8 billion eight months after that, signals investor conviction that is hard to ignore when evaluating long-term vendor viability. Backing from Bessemer Venture Partners and Salesforce Ventures also brings enterprise-sales relationships that smaller competitors lack. The downsides: that same rapid scaling raises the usual startup-growth questions about whether product depth and support quality are keeping pace with headcount and sales targets, and as with Sweet, Upwind has not published independent benchmark results or a transparent pricing model, so buyers are still negotiating from a position of limited public information.
Lacework FortiCNAPP: Pros and Cons
FortiCNAPP’s clearest advantage is stability and bundling. It is backed by a publicly traded, profitable cybersecurity company rather than a venture-funded startup still proving its business model, and organizations with existing Fortinet infrastructure can likely negotiate it into an existing renewal rather than running a brand-new procurement cycle. The January 2026 addition of native DSPM also shows Fortinet is still investing in the platform rather than letting it stagnate post-acquisition. The downside is the one that shows up in almost every big-vendor acquisition: independent trade coverage in 2026 rarely singles FortiCNAPP out for a specific technical edge the way it does for Wiz, Sysdig, or even the smaller independents in this comparison, and organizations with no existing Fortinet footprint get none of the bundling advantage that makes the product compelling in the first place.
Market Size and Why CDR Budgets Are Growing Faster Than Overall Cloud Security
The broader cloud security market is already large and growing at a double-digit clip, which is part of why investors are willing to fund CDR specialists at billion-dollar valuations. Mordor Intelligence sizes the global cloud security software market at $50.11 billion in 2025, growing to $56.83 billion in 2026 and reaching $106.6 billion by 2031, a 13.42% compound annual growth rate. Grand View Research puts the narrower cloud security market at $39.1 billion in 2025, rising to $43.8 billion in 2026 and $97.9 billion by 2033, a 12.2% CAGR. MarketsandMarkets, using a different methodology, estimates $34.37 billion in 2026 growing to $59.34 billion by 2031 at an 11.5% CAGR. The spread between those three figures underscores how inconsistently “cloud security” gets defined across research firms, which is exactly why this article avoids presenting a single CDR-specific dollar figure that no primary source has actually published.
The CNAPP sub-segment specifically, the umbrella category that includes all three vendors here, is estimated by Mordor Intelligence at roughly $10.9 billion in 2025, growing to $28.03 billion by 2030 at a 20.8% CAGR, nearly double the growth rate of the broader cloud security market. That faster growth rate is the financial backdrop explaining why Google paid $32 billion to acquire Wiz, why Upwind’s valuation nearly tripled within a single year, and why Fortinet moved quickly to fold Lacework’s technology into its own CNAPP offering rather than ceding the runtime-detection layer to a competitor entirely.
The Verdict: Which Cloud Detection and Response Platform Should You Pick
There is no single winner here, and the data backs that up rather than a marketing tagline. If detection depth built from the ground up for runtime, plus day-one support for monitoring AI agents, is the priority, Sweet Security’s purpose-built architecture and PeerSpot’s 8.6 average category rating make it a reasonable shortlist pick for teams willing to bet on a smaller, independent vendor. If capital strength and roadmap velocity matter more, Upwind’s jump from a $1.5 billion to a reported $3.8 billion valuation in under a year, backed by Bessemer and Salesforce Ventures, suggests a platform that is unlikely to run out of runway or get acquihired out of existence anytime soon. If vendor consolidation and negotiating leverage inside an existing Fortinet relationship matter most, FortiCNAPP’s $152.3 million acquisition price now looks cheap relative to what independent CDR vendors are raising, and it comes with the stability of a public-company balance sheet behind it.
The one point all three outcomes share: none of these vendors publish list pricing or independently audited detection benchmarks, so no comparison article, including this one, can substitute for running your own proof-of-concept against real production traffic before signing a multi-year contract.
Frequently Asked Questions
Is Cloud Detection and Response the same thing as CNAPP?
No. CNAPP is the broader umbrella category that typically bundles CSPM, workload and container scanning, and CDR-style runtime detection into one platform. Sweet Security and Upwind both market themselves as “runtime CNAPP” products, meaning runtime detection is their core strength within that larger category.
How much does Sweet Security cost?
Sweet Security does not publish list pricing. It sells through negotiated annual contracts scoped by workload count, consistent with how the rest of the CDR category prices enterprise deals.
How much is Upwind Security worth?
Upwind’s confirmed valuation as of its January 26, 2026 Series B announcement was approximately $1.5 billion. Multiple outlets, including Bloomberg and Globes, reported in September 2026 that Upwind was raising further capital at a roughly $3.8 billion valuation, though that later figure was reported via unnamed sources rather than confirmed in an official Upwind press release at the time of writing.
Did Fortinet rename Lacework?
Yes. Fortinet completed its acquisition of Lacework on August 1, 2024, for $152.3 million in cash, according to its SEC filing. The product was rebranded as FortiCNAPP in 2025, and the Lacework name is no longer used in Fortinet’s current marketing.
What is the difference between CDR and CSPM?
CSPM evaluates stored cloud configuration for drift from a secure baseline, typically on a scan interval measured in hours. CDR monitors workloads while they are actively running, using sensors (often eBPF-based) to flag behavioral deviations in near real time, catching active exploitation that a periodic configuration scan would miss entirely.
Does FortiCNAPP require existing Fortinet hardware?
No, FortiCNAPP can be deployed independently of Fortinet firewalls or FortiSASE. However, organizations that already run Fortinet infrastructure typically get better bundling and licensing terms, which is the main commercial advantage of choosing it over an independent CDR vendor.
Can Sweet Security or Upwind monitor AI agents, not just containers?
Yes. Sweet Security added explicit AI model and AI agent behavior monitoring to its runtime platform in its November 2025 announcement. Upwind’s January 2026 funding announcement said the company planned to expand its own AI-security capabilities, though it provided fewer technical specifics than Sweet at the time.
Is there an independent benchmark comparing Sweet Security, Upwind, and Lacework head-to-head?
No single, controlled, third-party lab benchmark currently compares all three directly. The best available signals come from review aggregators like PeerSpot and independent editorial comparisons like GBHackers’ 2026 CDR scorecard, both of which are directional rather than definitive, which is why a hands-on proof-of-concept against your own workloads remains the most reliable evaluation method.
