Upwind Modernizes PCI-DSS for Cloud-Native Security

We’re introducing the Upwind Framework for PCI-DSS to help organizations meet one of the most widely adopted security standards. This release is part of Upwind’s broader mission to make compliance continuous and directly tied to runtime environments.

In this blog, we will explain what PCI-DSS is and why it matters, highlight the growing challenges of applying PCI-DSS in modern cloud-native environments, and show how our new Upwind Framework addresses those challenges. We will also explore how Upwind makes it easier for teams to both maintain compliance and respond to real-time risks.

What Is PCI-DSS and Why Does It Matter?

The Payment Card Industry Data Security Standard (PCI-DSS) is a global standard that ensures organizations that process, store, or transmit credit card data do so securely. It was created to reduce the risk of payment data breaches and is now a critical requirement for nearly every business that handles cardholder information.

The standard outlines six overarching goals and twelve specific requirements. These include implementing access controls, encrypting sensitive data, maintaining secure systems, and conducting regular testing. Compliance helps businesses protect sensitive data, avoid regulatory penalties, and preserve customer trust. But the infrastructure where PCI-DSS must be applied has changed dramatically.

Why Traditional PCI-DSS Frameworks Are No Longer Sufficient

PCI-DSS was originally developed for static IT environments such as physical servers and manually managed networks. In these environments, scheduled audits and periodic compliance checks could provide reasonable coverage. Today’s cloud-native infrastructure operates in fundamentally different ways. Organizations rely on ephemeral compute, containers, Kubernetes, microservices, and dynamic networking. Workloads and data paths may appear and vanish within seconds. In this environment, legacy compliance tools cannot provide the real-time visibility required to maintain a secure posture.

PCI-DSS remains essential, but the approach to enforcing it must evolve to match the reality of modern infrastructure.

Introducing the Upwind PCI-DSS Framework

The Upwind PCI-DSS Framework is available today for all customers and is designed to address the challenges of configuration compliance in cloud-native environments. Rather than only relying on point-in-time audits or static scanning tools, the framework takes into account real-time activity from runtime environments. It continuously monitors compliance across compute, storage, network, and identity layers, covering critical areas such as:

• Secure storage of PAN (Primary Account Numbers)
• Cryptography checks during PAN transmission over public networks
• Identity and access monitoring to ensure only authorized access to cardholder data
• Configuration checks on cloud storage and compute resources to prevent misconfigurations
• Malware and threat protection across workloads
• Logging and audit trails to support continuous monitoring and audit readiness

Key Benefits

With the Upwind PCI-DSS Framework, organizations can:

• Gain real-time visibility into violations and misconfigurations
• Prioritize issues based on runtime exposure and actual risk
• Receive actionable insights to guide remediation efforts
• Stay audit-ready with historical evidence of continuous compliance

By combining PCI-DSS requirements with cloud-specific rules, the framework provides more precise and relevant detection of violations and misconfigurations.

We use Upwind’s real-time insights to prioritize vulnerabilities effectively across various layers. This ensures our response is quick and well-informed, aligning with our operational priorities and threat landscape.

– Roy Halevi, CTO, Intezer

Developed in collaboration with customers and informed by Upwind’s in-house security research, the framework is built to reflect real-world risks and modern architectural patterns.

We don’t just want to tick compliance boxes. We want to build real security for the specific risks our business faces. Upwind makes that possible.

– Wojciech Syrkiewicz-Trepiak, VP Security, Spacelift

The Runtime Difference – From Reactive Audits to Proactive Compliance

Traditional compliance workflows rely on periodic reviews that often identify risks after the fact. The Upwind PCI-DSS Framework enables organizations to detect violations as they happen and respond in real time. This improves both audit outcomes and day-to-day security.

For example, if a misconfigured container spins up with open network access, Upwind flags it instantly and provides clear remediation steps.

By embedding into runtime, Upwind allows teams to:

• Proactively defend against real attack paths
• Strengthen security controls without slowing down development
• Align compliance with DevOps workflows
• Respond to changes in posture as they occur

This approach supports continuous compliance and reduces the gap between risk identification and resolution.

Final Thoughts

As organizations adopt more dynamic, cloud-native environments, the limitations of traditional compliance approaches are clear. PCI-DSS remains one of the most critical security standards, but achieving compliance today requires a smarter, more integrated approach.

The Upwind PCI-DSS Framework helps organizations stay compliant in real time. By tying compliance directly to runtime activity and everyday workflows, it transforms PCI-DSS from a periodic exercise into a core component of security strategy.

Learn More

With real-time visibility, actionable insights, and adaptive enforcement, Upwind helps teams stay compliant and strengthen their security posture. See how Upwind brings PCI-DSS into the runtime era. Schedule a customized demo or reach out at [email protected].