Upwind Cloud & AI Security Platform

Maps the effective access of human and machine identities to compute, storage and data resources across AWS, Azure and GCP as an access relationship graph, surfacing over-permissioned roles, unused permissions, cross-account trust and toxic combinations of administrator permissions, and remediating them toward least privilege, including automatic revocation of excessive roles.

Monitors running pod and container behavior against policy, detecting unexpected process execution, network connections, and privilege escalation at runtime rather than at image scan time.

Reads cloud volume snapshots out-of-band to assess workloads for vulnerabilities, malware, exposed secrets and misconfigurations without installing agents or touching running instances, on a configurable scan schedule. Coverage of Windows threat detection and file integrity checks in agentless mode varies across products.

Enforces a single policy definition across AWS, Azure, and GCP resource types, translating to provider-native configurations rather than requiring separate policy sets per cloud.

Correlates individual misconfigurations, CVEs and excessive entitlements into chained attack scenarios showing lateral movement paths from an exposed entry point to a target asset, visualized on the resource graph. Produces a prioritized list of attack paths rather than a flat CVE inventory. Products differ in whether they show only possible paths derived from posture data or also actual paths confirmed from runtime and log telemetry.

Delivers scan results inside developer IDEs and pipeline stages so developers receive findings before code merges, reducing the cost and cycle time of remediation.

Exports compliance evidence pre-mapped to framework control requirements (SOC 2, ISO 27001, PCI DSS), in formats auditors can consume directly: not raw CSV exports requiring manual assembly.

Enriches cloud misconfigurations, vulnerable workloads, and runtime detections with threat intelligence on active exploitation, prioritizing exposures attackers use over theoretical severity alone.

Instruments workload behavior at the kernel level via eBPF without a traditional user-space agent. Provides syscall-level visibility into process execution, network connections, and file access in running containers and VMs.

Discovers and classifies sensitive data in IaaS and PaaS stores such as object storage, databases, and data warehouses, surfacing data exposure risk alongside infrastructure findings.

Analyzes container images and dependencies for CVEs, malicious or compromised packages, and SBOM generation across the build pipeline.

Continuously audits cloud and Kubernetes configuration across AWS, Azure, and GCP against security benchmarks, flagging misconfigurations and identity-permission gaps that create exploitable exposures.

Scans infrastructure-as-code templates (Terraform, CloudFormation, Kubernetes manifests and Helm charts) for misconfigurations, policy violations and embedded secrets before deployment, gates CI/CD pipelines on the resulting risk, and detects drift between the IaC definition and the deployed resource. Depth of productized pipeline integration and drift remediation varies across products.

Assesses the configuration of Kubernetes clusters and managed orchestrators (EKS, AKS, GKE, ECS, Fargate, OpenShift) against best-practice templates, surfacing cluster misconfigurations, weak RBAC, exposed control planes and configuration drift, and driving their remediation. Distinct from runtime workload monitoring: this is the posture of the orchestrator itself.

Provides AI copilots or agents inside the platform that search product documentation, triage and investigate alerts with plain-language explanations, discover threats and indicators of attack from telemetry, and generate remediation steps, policies and playbooks. Products differ in which of these tasks the copilot performs and how much of the investigation it completes on its own.

Pushes findings into help-desk ticketing, SIEM and security analytics, SOAR, asset management and application security tools and pulls status back, so remediation ownership, closure and exceptions stay synchronized between the platform and the SOC or developer workflow instead of being re-keyed. Productized, bidirectional depth of these integrations varies across products.