Sprinklr

Customer
Industry
Software & SaaS
Use Case
Contents
Customer
Industry
Software & SaaS
Use Case

Sprinklr Gains Runtime Visibility into Application-Layer Threats

One of the differentiators for me was Upwind’s ability to look at things across the full stack, including the application layer, and build those stories.

Eli Erlikhman
Eli ErlikhmanVP Product Security, Sprinklr
Sprinklr Logo

About Sprinklr

Founded in 2009, Sprinklr is the AI-native platform for Unified Customer Experience Management, helping large organizations unify teams, tools, and data across customer-facing functions. Today, Sprinklr empowers enterprises to engage, listen, and respond across 30+ digital channels from one platform.

As a global, publicly traded company serving top enterprises, Sprinklr’s product security team is responsible for protecting a complex, rapidly evolving software environment.

Sprinklr uses Upwind to understand cloud, application, and API activity at runtime, detect application-layer threats, and turn disconnected signals into clearer stories for investigation.

Challenges

  • Keeping pace with rapid development: As engineering velocity increased, Sprinklr’s product security team needed deeper runtime visibility to keep security aligned with how applications were changing in production.
  • Limited visibility into runtime behavior: Their existing approach provided posture visibility, but needed deeper context into how applications were actually running, communicating, and behaving at runtime.
  • Detecting application-layer and API threats: The team needed visibility into API activity and application-layer attacks, not just cloud, network, or file-level activity.
  • Managing alert complexity: As runtime detection surfaced more signals, Sprinklr needed a way to connect alerts into a clear story for investigation.
  • Understanding APIs and sensitive data flows: The team needed to inventory APIs across environments and understand where sensitive data, including PII, was moving between components and applications.
  • Gaining visibility into AI adoption: As AI capabilities expanded, Sprinklr needed a way to understand what AI agents and capabilities existed across the environment before they could secure them.

Solutions

  • Runtime visibility across applications: Shows how workloads and applications behave at runtime, helping the team validate what is actually happening in production.
  • Application-layer threat detection: Detects threats at the application-layer, where cloud, network, and file-level tools can miss important context.
  • API and sensitive data visibility: Inventories APIs across environments, shows how they are used, and identifies where sensitive data, including PII, moves between components.
  • Correlated investigation stories: Connects related signals across the full stack into clearer investigation stories, helping the response team understand what happened, what was affected, and where to act faster.
  • AI observability: Provides the visibility needed to understand what AI agents and AI capabilities exist across the environment, including how they run and behave, helping the team understand and secure AI adoption in context.

Upwind’s rate of delivery for new capabilities was very impressive, and that’s what made me and everyone else feel comfortable.

Feature parity is not very important in your case because we’ve seen how fast you deliver.

Eli Erlikhman
Eli ErlikhmanVP Product Security, Sprinklr

Why Sprinklr Chose Upwind

Sprinklr’s product security team was looking for a partner that could help address the next layer of complexity by showing what was actually happening across applications and APIs at runtime. With eBPF-powered runtime visibility, Upwind surfaces application-layer activity, API behavior, and cross-stack signals that are difficult to capture with traditional cloud security approaches.

As development velocity increased, visibility into posture alone was not enough. The team needed to detect application-layer threats, understand API activity, and make sense of the growing volume of security signals generated across their environment.

Upwind stood out for its runtime visibility, application-layer detection, and ability to correlate signals into a clearer picture of exploitable risk. Rather than force teams to investigate individual alerts in isolation, Upwind connects activity across the stack for faster investigations and clearer next steps.

Upwind

Uplift Your Cloud Security Today

Schedule a meeting with a cloud security experts today to secure your cloud, reduce friction between your teams and proactively protect your cloud infrastructure and applications.

Get a Demo
Screenshot 2026-10-13 at 5.29.46 PM

With Upwind, we are able to identify any vulnerabilities and can prioritize them for remediation — helping us operate more efficiently and securely.

Varun Brahmkshatriya
Cloud Engineer

Solutions

  • Upwind built support for gVisor, enabling Spacelift to gain process-level visibility into isolated containers from inside the platform, without an additional abstraction layer.
  • Upwind’s runtime-powered detection drastically reduced incident response times, allowing engineers to see exactly what happened inside containers and take quick action — whether that meant alerting the customer, killing a malicious process, or preventing future abuse.
  • Custom POC collaboration enabled rapid iteration, with Spacelift testing real-world attack patterns observed in wild malware samples, and Upwind delivering tailored features in record time.
  • Dynamic network graphs and runtime vulnerability prioritization allowed the team to track service communication patterns, identify drift, and focus on real exploitable risks — not just theoretical ones
Spacelift’s use of gVisor provided strong sandboxing and tenant isolation, but it came at the cost of visibility. The lack of runtime insight made it time-consuming to monitor network activity and understand events leading up to a security incident. Upwind’s gVisor feature solved this problem, providing Spacelift with full visibility into what was happening inside containers in real time. They could now trace every process, identify the actor behind it, and act decisively — all while preserving the container isolated gVisor was designed to enforce.

Visibility Inside Isolated Containers

Spacelift’s use of gVisor provided strong sandboxing and tenant isolation, but it came at the cost of visibility. The lack of runtime insight made it time-consuming to monitor network activity and understand events leading up to a security incident. Upwind’s gVisor feature solved this problem, providing Spacelift with full visibility into what was happening inside containers in real time. They could now trace every process, identify the actor behind it, and act decisively — all while preserving the container isolated gVisor was designed to enforce.

We tried reaching out to other vendors, but Upwind was the only one who moved fast, built what we needed, and treated us like a real partner. That’s rare — and it made all the difference.

Varun Brahmkshatriya
Cloud Engineer

Outcomes

  • Upwind built support for gVisor, enabling Spacelift to gain process-level visibility into isolated containers from inside the platform, without an additional abstraction layer.
  • Upwind’s runtime-powered detection drastically reduced incident response times, allowing engineers to see exactly what happened inside containers and take quick action — whether that meant alerting the customer, killing a malicious process, or preventing future abuse.
  • Custom POC collaboration enabled rapid iteration, with Spacelift testing real-world attack patterns observed in wild malware samples, and Upwind delivering tailored features in record time.
  • Dynamic network graphs and runtime vulnerability prioritization allowed the team to track service communication patterns, identify drift, and focus on real exploitable risks — not just theoretical ones
Upwind grants Petrofac the ability to instantly identify threats and eliminate malicious processes with the click of a button. It also creates prevention policies to block future malware from running in their environment.
Contents
Add the Upwind RSS Feed to Slack
Connect the Upwind RSS Feed to your Slack.
Follow the how-to here.
Threat RSS
Link Copied
Add the Upwind RSS Feed to Slack
Connect the Upwind RSS Feed to your Slack.
Follow the how-to here.
Main RSS
Link Copied