Product

Every API has a different risk profile. An internal billing endpoint and a public-facing authorization endpoint don't fail the same way. They don't get attacked the same way either. A generic ruleset can't account for that. Custom rules can, and now those rules can see sensitive data too. This new release brings two things together…

Kubernetes environments move fast. Workloads appear and disappear, container images change continuously, services are exposed, permissions evolve, and development teams deploy updates throughout the day. But most cloud security platforms force practitioners to investigate Kubernetes risk through interfaces designed for the broader cloud, leaving teams to manually filter the noise before they can begin investigating…

Frontier AI models combined with a rampant rate of new critical vulnerabilities mean speed and context are everything. When a critical production service starts behaving suspiciously, every second spent jumping between different tools and dashboards is a second lost to a potential attacker. At Upwind, we are excited to introduce a game-changer for security teams:…

Software supply chain risk doesn't stop at the container boundary. Most organizations still run a meaningful share of production workloads on virtual machines across legacy services, data pipelines, and infrastructure that was never containerized. The Upwind Platform creates SBOMs at runtime, delivering greater accuracy than build-time tools by continuously monitoring your live environment. Format adds…

Focus Mode is now available in the Upwind platform, giving security teams a faster, more focused way to work. Instead of navigating across the platform, you can switch to Focus Mode to slice and dice the Upwind platform by Vulnerability Management, Cloud Security Posture, Attack Surface Management, Administration, or Threats, and starting next week, AI…

We’re excited to introduce Early Advisories as part of the Upwind platform. Powered by Upwind's security research team, Early Advisories notify customers about emerging threats, including zero-days and supply chain attacks, before they receive a CVE identifier. Early Advisories are published directly into the Vulnerabilities module alongside CVE-based findings and automatically correlated with your live…

Windows workloads remain a critical part of modern cloud environments. From business applications and identity services to databases and internal tooling, Windows Server hosts often support some of the most important pieces of the enterprise stack.  Upwind is extending runtime protection and visibility to Windows Server hosts running in private cloud and on-premises environments, including…

If you asked most security leaders where all of their data is flowing, which workloads and AI services are accessing it, and whether it's exposed, only a few could answer with confidence, and almost none would have the answer in real time.Not because that data is not available, but because it's scattered across multiple cloud…

Today, we are excited to announce the Upwind AI Sensor for Endpoints! In the world we've known until now, the threat model was familiar. A developer accidentally commits a secret to a repository. A DevOps engineer exposes sensitive data to the internet. Someone deploys a workload carrying a critical vulnerability. To deal with these risks,…

Cloud security teams do not have a visibility problem anymore. They have a context problem. Modern cloud environments generate endless findings across vulnerabilities, identities, APIs, data, configurations, threats, workloads, and exposure. The challenge is not just knowing what exists. It is understanding what matters, why it matters, and what to do next. That is where…

We’re excited to announce Upwind Attack Surface Management (ASM), a new way for security teams to discover unknown attack surfaces, understand risk exposure, and prioritize the issues that matter most. Security teams have spent years improving visibility across their environments. They use scanners, asset inventories, vulnerability management platforms, CSPM tools, and attack surface management solutions…

The moment an attacker initiates access to your network, evidence starts to appear, and in that moment, detections start to fire. That’s the moment you just start the hard part of investigating and discovering the true attack chain. Our goal shifts from monitoring to investigating - What was this workload actually doing? What happened before…