What kind of overhead does the runtime agent introduce?

The agent uses eBPF (Extended Berkeley Packet Filter) to hook into the kernel efficiently. It's designed for minimal performance impact, as highlighted by enterprise users handling high-scale infrastructure.

Is this suitable for a multi-cloud environment (AWS, Azure, GCP)?

Yes, multi-cloud visibility and management are core features. The platform provides a unified view across supported major cloud providers.

How quickly can we deploy and see value?

Multiple case studies highlight deployment and gaining actionable visibility within minutes. The agentless scan is immediate; agent deployment integrates into standard CI/CD pipelines.

Can it protect serverless functions and Kubernetes clusters?

Yes, specific solutions are offered for container, Kubernetes, and serverless security (e.g., ECS, EKS, Lambda). Protection extends to the orchestration layer and individual workload runtime.

What is the 'Agentic Pack'?

It's a feature that uses specialized AI agents to automate investigation, correlate data across sources, and assist analysts, aiming to cut investigation time from hours to minutes.

Does it support on-premises or hybrid cloud deployments?

The platform is strongly oriented towards public cloud and cloud-native (AWS, Azure, GCP) environments. Support for traditional on-prem infrastructure is not its primary focus.

Directory/Automation/Cloud Security/Upwind

Upwind

Upwind is a cloud and AI security platform that provides real-time visibility and protection for cloud-native applications and AI infrastructure. It combines agentless scanning with runtime sensors to create a live, unified operating picture for security, development, and DevOps teams. Its core capabilities include a continuously updated live inventory, high-signal exposure management that reduces alert noise by over 90%, and real-time detection and response to attacks as they happen. The platform integrates security across the entire cloud stack, including containers, serverless, APIs, and AI services, enabling teams to remediate actual risks and stop threats within seconds. Targeted at security engineers, cloud architects, and DevOps teams, Upwind is designed for enterprises managing complex, multi-cloud environments. It consolidates multiple security tools into a single platform, offering deep contextual analysis to prioritize and automate security workflows.

Automation

Visit website

Added on

Sep 21, 2026

CNAPP PlatformRuntime eBPF SensorsAgentless ScanningReal-time CDRAI Security PostureMulti-cloud

Product information

Everything worth knowing about Upwind

The complete picture — from everyday features to the technical detail builders and IT folks dig for.

Core features

What it actually does

Live Inventory & Real-time Visibility

Provides a continuously refreshed (every 30 seconds) map of your cloud assets, APIs, data flows, AI services, and identities. Know what's running, connected, and exposed across your environment without manual scans.

High-Signal Exposure Prioritization

Reduces alert noise by 93% by correlating vulnerabilities with runtime context (e.g., is the service running, reachable, exposed?). Directs remediation to risks that actually affect production.

Real-time Runtime Protection & Detection

Detects and stops active attacks within 15 seconds by monitoring workload runtime signals, abnormal processes, suspicious network activity, and unexpected identity actions.

Unified Cloud & AI Security Platform

Combines cloud security (CSPM, CIEM, DSPM, vulnerability management) with AI security (AI-SPM, AI Agentic Pack) in a single pane of glass, eliminating tool sprawl.

Technical capabilities

Agentless + Agent-Based Hybrid Deployment

Uses an efficient eBPF sensor for deep runtime visibility, combined with agentless scanning for comprehensive coverage without compromising performance.

Inside-Out Security Model

Links code context directly to production in real-time, providing a holistic view from the development pipeline (CI/CD) through to live infrastructure.

Must watch videos

Why Upwind Went All In on AI Security | Amiram Shachar

5:04

Tutorial5:04

Why Upwind Went All In on AI Security | Amiram Shachar

Upwind has gone all in on AI security, and CEO Amiram Shachar explains why. As AI accelerates across every enterprise, Upwind is building the security layer to match. Amiram Shachar, Co-Founder & CEO at Upwind, shares why Upwind made AI security its top priority and what that means for cloud security teams. With developers now 6 to 10x more productive using AI and some reporting they haven't written a single line of code in 6 months, AI is mass-producing the cloud security problem. Upwind's response: solve the three core AI security challenges end to end. Visibility into every agent, model, and pipeline across providers. Protection against a new class of attacks delivered in plain English. And validation through proactive red-teaming of AI agents before adversaries find weaknesses. Chapters 0:00 - Three Revolutions: Internet, Cloud, and AI 0:33 - Upwind Goes All In on AI 1:19 - AI Is Mass-Producing the Cloud Security Problem 1:52 - The Three AI Security Challenges 2:17 - Visibility: Agents, Models, Shadow AI, and Runtime Dynamics 3:20 - Protection: When Attacks Come in Plain English 4:04 - Validation: Red-Teaming AI Agents Before Attackers Do Key Takeaways 1. Upwind has gone all in on AI security, from internal productivity (developers 6 to 10x more productive) to building the security platform for the AI era 2. AI is mass-producing the cloud security problem: the attack surface scales at the same rate as developer productivity 3. Upwind is solving three AI security challenges end to end: visibility (inventorying agents, models, pipelines, and data stores across AWS, Azure, GCP, Anthropic, and OpenAI), protection (detecting attacks that arrive as natural language conversations with AI agents), and validation (proactively red-teaming AI agents handling payments, support, and customer data) 4. Traditional signatures and security policies don't apply to AI threats. Upwind is building a new protection layer for the AI era 5. Upwind's mission: help every enterprise in the world go all in on their AI journey, securely About Upwind Upwind is the runtime-powered cloud security platform that gives security teams real-time visibility and protection across cloud workloads, APIs, and AI infrastructure. Built on eBPF, Upwind detects threats as they happen, not after the fact. #cloudsecurity #aisecurity #cnapp

Upwind AI Detection and Response: Detect Compromised AI Agents in Real Time

1:07

Tutorial1:07

Upwind AI Detection and Response: Detect Compromised AI Agents in Real Time

Upwind AI Detection and Response is now generally available. AI governance starts with knowing which models, agents, tools, and MCP servers are running across your environment. But inventory is only the first step. Security teams also need to understand what those AI agents are doing in production right now. Chapters: 0:00 Upwind AI Detection and Response Is Generally Available 0:08 AI Governance Starts With Inventory 0:18 Moving From Visibility to Real-Time Protection 0:27 Detecting AI Agent Activity in Production 0:37 Runtime Intelligence Across the AI Stack 0:47 Identifying Out-of-Scope Agent Behavior 0:55 Attack Paths, Exposed Data, and Remediation Key Takeaways: 1. Upwind AI Detection and Response is now generally available, giving security teams real-time detection and response for AI agents running in production. 2. Good AI governance starts with inventory: knowing which models are deployed and which agents, tools, and MCP servers are operating across the AI stack. 3. AID goes beyond showing what is running. It helps security teams understand what AI agents are doing right now and whether their behavior matches their intended scope. 4. Upwind uses the runtime intelligence it already collects across workloads, network flows, identities, and data access, so no additional sensor is required. 5. AID tracks usage intent, maps agent-to-tool traffic, and flags the moment an agent acts outside its scope. When something goes wrong, teams get the attack path, exposed data, and exact remediation steps, not just an alert. About Upwind Upwind is the runtime-powered cloud security platform that gives security teams real-time visibility and protection across cloud workloads, APIs, and AI infrastructure. Built on eBPF, Upwind detects threats as they happen — not after the fact. #cnapp #cloudsecurity #cybersecurity #upwindsecurity #aidr

Upwind Threats Focus Mode: Cloud Threat Detection, Investigation & Response

4:26

Tutorial4:26

Upwind Threats Focus Mode: Cloud Threat Detection, Investigation & Response

Upwind Threats Focus Mode gives security teams one place to monitor, investigate, and respond to threats across their cloud environment. In this walkthrough, Omer from the Upwind Product team covers the Threat Feed, correlated Stories, threat hunting and investigations, customizable Rego detection rules, and upcoming AI-powered capabilities like Blue Agent and the AI Rule Builder. Threats Focus Mode brings together runtime events, cloud audit logs, Kubernetes activity, API telemetry, and other security data to help teams understand what happened, determine whether they’re affected, and respond faster. About Upwind Upwind is the runtime-powered cloud security platform that gives security teams real-time visibility and protection across cloud workloads, APIs, and AI infrastructure. Built on eBPF, Upwind detects threats as they happen — not after the fact. #UpwindSecurity #CloudSecurity #aisecurity #Cybersecurity #CNAPP

Who uses it

Real use cases, no hype

Cloud Security Posture Management (CSPM)

Continuously monitor cloud configurations to prevent misconfigurations and enforce compliance.

Runtime Threat Detection & Response

Detect and stop active attacks in real-time by analyzing workload behavior and process execution.

Identity & Entitlement Management (CIEM)

Visualize and reduce risky permissions across cloud IAM to minimize attack surface.

Vulnerability Management & Prioritization

Focus remediation on actively exploited, reachable vulnerabilities instead of theoretical scores.

Supply Chain & Dependency Security (SCA/SBOM)

Map and secure the software bill of materials for cloud applications.

Kubernetes & Container Security

Protect containerized workloads with admission control and runtime threat intelligence.

AI/ML Model & Data Security (AI-SPM)

Secure AI services, model endpoints, and sensitive data flows in cloud infrastructure.

What's great

Live, real-time inventory of cloud assets and attack paths.
Dramatically reduces alert fatigue by prioritizing high-signal exposures.
Combines agentless scanning and eBPF runtime sensors in one platform.
Rapid deployment provides comprehensive visibility within minutes.

Technical strengths

Seamlessly integrates infrastructure, workload, and API security.
Uses eBPF sensors for efficient, low-overhead runtime threat detection.
Provides end-to-end context from CI/CD pipeline to runtime for remediation.

Where it falls short

Agent-based deployment may require kernel-level access (eBPF), which can be a blocker in some environments.
Primarily focused on cloud-native (AWS, Azure, GCP) and container/serverless workloads.
Pricing is opaque; requires a demo for a quote, suggesting enterprise-focused cost.
Newer platform compared to established players, which may give pause to some enterprises.

Technical limitations

The 'Inside-Out' model's reliance on runtime context may have limitations with legacy on-prem systems.
Supports specific cloud providers and orchestration (ECS, EKS, GKE), but less documented for niche or hybrid cloud stacks.

For technical folks

The deep-dive specs

FAQ

Includes technical Q&A

It combines agentless posture scanning with real-time eBPF-based runtime telemetry. This 'Inside-Out' approach provides live attack path context that static scanners miss, drastically reducing false positives.