Petrofac

Petrofac

Customer
Petrofac logo
Industry
Use Case
Contents
Customer
Industry
Use Case

How Petrofac uses Upwind for real-time AKS protection

Upwind was incredibly easy to get up and running, within the first few hours of connecting to the Platform, we already had an actionable list of recommendations to strengthen our AKS security.

Shahab Siddiqui
Shahab SiddiquiGlobal Head of Cyber Security, Petrofac

How Petrofac Leverages Upwind


In today’s evolving world of cloud security, knowing how to comprehensively secure cloud infrastructure and applications can be challenging. Providing agile, complete protection that identifies critical risks and proactively remediates them is even more difficult. That’s where Upwind comes in.

The Upwind Cloud Security Platform defines the speed, visibility, and actionability of an Azure customer’s cloud security to identify critical risks instantly, get to the root cause faster, and halt attacks in real-time. In a multi-cloud and hybrid-cloud reality, Upwind provides comprehensive cloud security to accelerate productivity and empower their development, security and DevOps teams to innovate within a secure and efficient environment, including managed Kubernetes services like Microsoft’s AKS (Azure Kubernetes Service).

Providing Petrofac with innovative AKS protection

Petrofac is a leading energy services company that helps its clients meet the world’s evolving energy needs. Petrofac’s sophisticated Azure infrastructure allows it to adopt agile cloud practices and establish an extensive AKS environment. However, to ensure that their AKS clusters were protected in real-time, while also working to reduce the attack surface, they found a solution with Upwind.

Petrofac was able to quickly and easily deploy the Upwind platform, providing them with instant insights into their Azure inventory and real-time recommendations to further secure their AKS environment.

Upwind was incredibly easy to get up and running, within the first few hours of connecting to the Platform, we already had an actionable list of recommendations to strengthen our AKS security, as well as real-time visibility into our containerized resource communication.

Shahab Siddiqui
Shahab SiddiquiGlobal Head of Cyber Security, Petrofac

Real-time AKS threat detection and response

Petrofac’s AKS protection utilizes Upwind to discover its containerized resources, identify any vulnerabilities, and collect real-time insights through Upwind’s eBPF-based sensor. Petrofac’s security team was able to gain a comprehensive view of their AKS environment and start proactively protecting against Kubernetes threats.

Diagram showing a Kubernetes system network with kube-system components like connectivity-agent and cloud-node-manager. A side panel details kube-proxy traffic insights, including traffic by process, ports, and protocol, with a flowchart layout.
View real-time network communication and insights for Azure Kubernetes Service workloads

Upwind grants Petrofac the ability to instantly identify threats and eliminate malicious processes with the click of a button. It also creates prevention policies to block future malware from running in their environment.

Upwind’s ability to monitor our infra 24/7 to proactively find threats has shown us just how much organizations are missing when they rely on static tools for protection. Being able to receive detections in real time has given us an additional layer of protection that is crucial for our organization and helped us significantly strengthen our cloud security practice.

Leon Colaco
Leon ColacoCyber Security Analyst, Petrofac
Screenshot of a dashboard displaying a prevention status as Active. It shows a countdown timer with 5 hours and 58 minutes remaining. A graph tracks response over time, and a table lists process details, IDs, and status updates as Success.
Stop threats in real-time and create prevention policies to prevent future malicious processes from running

Cutting 98% of noise to focus on real risk

In addition to real-time AKS protection, Upwind also gives Petrofac the ability to easily identify critical risks and vulnerabilities and rapidly remediate them. The Upwind platform helps Petrofac focus on actual risks rather than theoretical ones by looking at ingress traffic, in-use packages, and build-time data. This is paired with root cause analysis that goes down to the level of the developer responsible for pushing the code that caused the vulnerability.

By leveraging both runtime and build-time data, Upwind cut 98% of alert noise for Petrofac, allowing their team to focus and prioritize their most critical issues.

Funnel
Upwind filters your vulnerabilities, cutting down alert noise and helping you focus on your most critical risks based on real environmental factors

Using Upwind has completely changed the way we protect our AKS clusters. Upwind’s real-time container security has cut 98% of our alert noise, making it easy for us to quickly find and fix risks, stop threats and ensure that our containerized environment is secure.

Kalim Aziz
Kalim AzizCyber Security Leader, Petrofac

Pairing AKS agility with real-time security

By implementing the Upwind Cloud Security Platform, Petrofac has been able to leverage the best of both worlds—marrying Azure’s rapid building capabilities in Azure Kubernetes Service with Upwind’s real-time protection. This has helped Petrofac take advantage of:

  • Complete AKS visibility: Upwind allows Petrofac to view resource communication and identify all communication within clusters, within accounts, and to the internet.
  • Real-time AKS security: Petrofac can use Upwind’s threat detection and response to detect threats and stop them at the packet and process level.
  • Prioritized AKS risk analysis: Upwind has reduced 98% of Petrofac’s alerts, helping them focus on their most critical risks and proactively reduce their attack surface.
  • AKS identity awareness: Upwind gives Petrofac visibility into all of its running user identities, including viewing identity risk by resource, and identifying all users and their permissions that have access to AKS resources.

Microsoft and Upwind have established a strong technological and business alliance that shows how innovative technology can foster growth and solve problems. Petrofac’s use of Azure and Upwind is a prime example of how strongly this alliance can bring increased value to customers.

Tom Davis
Tom DavisSenior Director, Microsoft for Startups

Just as Petrofac has harnessed the power of AKS and Upwind’s Cloud Security Platform to rapidly and securely build in Azure, all Azure customers can utilize Upwind’s AKS protection to ensure rapid and thorough cloud security.

Upwind

Uplift Your Cloud Security Today

Schedule a meeting with a cloud security experts today to secure your cloud, reduce friction between your teams and proactively protect your cloud infrastructure and applications.

Get a Demo
Screenshot 2026-10-13 at 5.29.46 PM

With Upwind, we are able to identify any vulnerabilities and can prioritize them for remediation — helping us operate more efficiently and securely.

Varun Brahmkshatriya
Cloud Engineer

Solutions

  • Upwind built support for gVisor, enabling Spacelift to gain process-level visibility into isolated containers from inside the platform, without an additional abstraction layer.
  • Upwind’s runtime-powered detection drastically reduced incident response times, allowing engineers to see exactly what happened inside containers and take quick action — whether that meant alerting the customer, killing a malicious process, or preventing future abuse.
  • Custom POC collaboration enabled rapid iteration, with Spacelift testing real-world attack patterns observed in wild malware samples, and Upwind delivering tailored features in record time.
  • Dynamic network graphs and runtime vulnerability prioritization allowed the team to track service communication patterns, identify drift, and focus on real exploitable risks — not just theoretical ones
Spacelift’s use of gVisor provided strong sandboxing and tenant isolation, but it came at the cost of visibility. The lack of runtime insight made it time-consuming to monitor network activity and understand events leading up to a security incident. Upwind’s gVisor feature solved this problem, providing Spacelift with full visibility into what was happening inside containers in real time. They could now trace every process, identify the actor behind it, and act decisively — all while preserving the container isolated gVisor was designed to enforce.

Visibility Inside Isolated Containers

Spacelift’s use of gVisor provided strong sandboxing and tenant isolation, but it came at the cost of visibility. The lack of runtime insight made it time-consuming to monitor network activity and understand events leading up to a security incident. Upwind’s gVisor feature solved this problem, providing Spacelift with full visibility into what was happening inside containers in real time. They could now trace every process, identify the actor behind it, and act decisively — all while preserving the container isolated gVisor was designed to enforce.

We tried reaching out to other vendors, but Upwind was the only one who moved fast, built what we needed, and treated us like a real partner. That’s rare — and it made all the difference.

Varun Brahmkshatriya
Cloud Engineer

Outcomes

  • Upwind built support for gVisor, enabling Spacelift to gain process-level visibility into isolated containers from inside the platform, without an additional abstraction layer.
  • Upwind’s runtime-powered detection drastically reduced incident response times, allowing engineers to see exactly what happened inside containers and take quick action — whether that meant alerting the customer, killing a malicious process, or preventing future abuse.
  • Custom POC collaboration enabled rapid iteration, with Spacelift testing real-world attack patterns observed in wild malware samples, and Upwind delivering tailored features in record time.
  • Dynamic network graphs and runtime vulnerability prioritization allowed the team to track service communication patterns, identify drift, and focus on real exploitable risks — not just theoretical ones
Upwind grants Petrofac the ability to instantly identify threats and eliminate malicious processes with the click of a button. It also creates prevention policies to block future malware from running in their environment.
Contents
Add the Upwind RSS Feed to Slack
Connect the Upwind RSS Feed to your Slack.
Follow the how-to here.
Threat RSS
Add the Upwind RSS Feed to Slack
Connect the Upwind RSS Feed to your Slack.
Follow the how-to here.
Main RSS