A high-severity cloud alert tells a security team that something is wrong. It rarely tells them what is at stake. A misconfigured storage bucket and a bucket full of customer records produce the same infrastructure finding. Only one of them is a breach waiting to happen. That difference is the whole point of cloud data security.
Two vendors moved to close it on 5 October 2026. Matters.AI, a Bangalore-based data security firm, announced a native API integration with Upwind, a cloud and AI security company. Upwind is valued at roughly $3.8bn.
Both are joining cloud exposures to the sensitivity of the data behind them. The announcement is modest. The trend behind it is not.
What the integration actually does
Upwind supplies context on running workloads, processes, identities, and network paths. Matters.AI adds what it knows about the data in those environments: its sensitivity, its access permissions, and its activity. The integration maps Upwind findings to Matters.AI’s classification of the affected datastore. Security teams then get an exposure queue ranked by both cloud context and data sensitivity. Database Activity Monitoring adds query-level detail for investigation.
Two design choices stand out. Customers connect their existing Upwind organisation through the native API connector. They do not onboard the same cloud accounts to a second posture scanner. Where Upwind is the authoritative posture source for an account, Matters.AI suppresses its own posture results.
Why cloud data security is converging
That second choice is the interesting one. Matters.AI is ceding the infrastructure-posture layer to Upwind and keeping the data layer for itself. That is a deliberate division of labour, and it mirrors a much larger shift in cloud data security.
CSPM secures the cloud an organisation runs in. DSPM secures the data inside it. The two answer different questions, and buyers increasingly want them answered together. Gartner’s 2025 DSPM Market Guide called the category “an essential foundation” of enterprise data protection. It predicted that DSPM, data governance, and AI governance platforms would coalesce around common APIs into unified control planes.
The market is already consolidating. Veeam closed its acquisition of Securiti at about $1.725bn in December 2025. Google closed Wiz at $32bn in early 2026.
Palo Alto Networks absorbed Dig Security, Proofpoint absorbed Normalyze, and Rubrik absorbed Laminar. Cyera, a pure-play, quadrupled its valuation to $9bn. The standalone DSPM vendor is becoming a feature of something larger.
The 24-hour caveat
The integration has a limit worth naming. Matters.AI ingests posture and configuration findings on a 24-hour cycle. Upwind’s runtime telemetry is closer to real time, which is the part the vendor quotes emphasise. The two are not the same thing.
That matters for prioritisation. A misconfiguration caught at runtime will reach the combined view quickly. A posture drift may take a day.
Security teams reading “real-time” as a property of the whole integration should read the release more carefully. The runtime layer is live. The posture layer is daily.
Who this is really about
What matters most is the asymmetry between the two companies. Upwind was founded in 2022 by the team behind Spot.io, which NetApp bought for about $450m in 2020. It raised $250m at a $1.5bn valuation in January 2026. In September it raised roughly $300m more, at $3.8bn. Its customers include Siemens, Peloton, Roku, Wix, and Nubank.
Matters.AI is far smaller. Two former Observe.AI engineers founded it in 2023. It has raised about $6.25m, most recently a Rs 55 crore seed round co-led by Kalaari Capital and Endiya Partners.
In the US it competes with Cyera, which is valued at $9bn. For a company of that size, an integration with a $3.8bn platform is distribution. Distribution is the scarce resource in a consolidating market.
What to watch
The integration does not include joint customers, published benchmarks, or pricing. Those are the things that would turn a connector into evidence. The more useful signal is strategic. If standalone data security vendors keep ceding the posture layer to cloud platforms, the boundary between DSPM and CNAPP will keep blurring. Buyers should weigh that before signing a multi-year contract with a specialist.
The question for a CISO is no longer whether cloud posture and data risk belong in one view. It is who will own that view in three years, and whether the vendor selling it today will still be independent.
Editor’s Note
This analysis draws on the 5 October 2026 Matters.AI announcement, independent funding and market reporting, and Gartner‘s published guidance on DSPM. Company valuations and funding figures are as reported by those sources. Where a claim comes from a vendor, we say so.