Upwind

No entries match these filters. Clear filters

1. Upwind Story Replay: Watch the Attack Unfold (2026-10-21) Oct 21, 2026 · issue 116

   Upwind Story Replay delivers a visual, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.-annotated attack timeline so analysts and CISOs can follow multi-stage threats from first detection to remediation at a glance.

   • Adds Upwind Story Replay, a visual timeline inside the Upwind console that renders every detection contributing to a threat in chronological order, annotated with MITRE tactics and associated resources.
   • Story Replay surfaces the order, timing, and blast radius of multi-stage attacks across workloads and identities, replacing manual alert-list reconstruction with a single visual attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..

   2 details in Everything

   • New vulnerability check PHP core unauthenticated RCE detection rules (CVE-2026-109618, CVE-2026-109619)
   • New detection eMudhra intermediate CA key exposure detection
   • New detection LiteLLM 1.107.0 poisoned PyPI backdoor detection
   • New vulnerability check GitLab integer overflow RCE behavioral detections (CVE-2026-110264)
2. Runtime First, Agentless Everywhere (2026-10-19) Oct 19, 2026 · issue 114

   Upwind adds a Kubernetes Agentless Scanner and a three-layer security model for clusters where a node sensor cannot be deployed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢

   ⤢
   • Adds the Kubernetes Agentless Scanner — connects to a cluster without a DaemonSet or node install, builds a full inventory (Deployments, DaemonSets, StatefulSets, services), extracts SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from deployed images, and surfaces vulnerabilities on the workload that runs each image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Agentless image scans also detect exposed secrets and malicious files in image contents, surfaced in Threats alongside other detections.
   • Surfaces Kubernetes agentless inventory under dedicated resource kinds in Inventory (Deployments, DaemonSets, StatefulSets, services) alongside the rest of the estate, covering both public and private clusters from a single view.
   • Introduces a three-layer security model — Upwind Sensor (node-level runtime), Kubernetes Agentless Scanner (inside the cluster), and Cloud Scanners (outside the cluster) — all feeding the same inventory, security graph, and Containers & Kubernetes Focus Mode.
   • Cloud Scanners now surface the Kubernetes cluster's external footprint — managed cluster resources, node VMs and their OSes, load balancers, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, and network paths — enabling discovery of unknown clusters and converting them into agentless scanner candidates.

   +1 more show less

   • Runtime detection identifies AI-agent activity — unexpected shells, previously unseen processes, cloud metadata service calls, and uncharted service-to-service traffic — that manifests only at runtime and is invisible to manifest or image scans.
   • Adds the Kubernetes Agentless Scanner — connects to a cluster without a DaemonSet or node install, builds a full inventory (Deployments, DaemonSets, StatefulSets, services), extracts SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from deployed images, and surfaces vulnerabilities on the workload that runs each image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Agentless image scans also detect exposed secrets and malicious files in image contents, surfaced in Threats alongside other detections.
   • Surfaces Kubernetes agentless inventory under dedicated resource kinds in Inventory (Deployments, DaemonSets, StatefulSets, services) alongside the rest of the estate, covering both public and private clusters from a single view.
   • Introduces a three-layer security model — Upwind Sensor (node-level runtime), Kubernetes Agentless Scanner (inside the cluster), and Cloud Scanners (outside the cluster) — all feeding the same inventory, security graph, and Containers & Kubernetes Focus Mode.

   2 more in Everything

3. Upwind Launches Databricks Security for Lakehouse Data and AI (2026-10-19) Oct 19, 2026 · issue 114

   Upwind launches Databricks Security, adding lakehouse asset inventory, posture checks, and graph coverage across Unity Catalog and cloud resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   Connect a Databricks account to Upwind so that Unity Catalog grants, storage credentials, and AI assets appear in your unified cloud security inventory.
   📍In the Upwind console, go to Components › Integrations, add your Databricks account, grant Upwind read access, then choose the workspaces and metastores in scope to begin inventory collection.
   • Adds Databricks Security integration via Components > Integrations, covering asset inventory for workspaces, metastores, catalogs, schemas, grants, storage credentials, external locations, Delta Sharing shares and recipients, model serving endpoints, vector search indexes, and registered models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Connects Databricks Unity Catalog grants to underlying cloud resources — mapping storage credentials to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, clusters to compute resources, network configuration to VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. and security groups, and encryption configuration to KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. keys — in a single traversable graph.
   • Surfaces Databricks-specific security findings (overly broad data grants, non-expiring access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., publicly exposed workspaces and clusters, universally readable secrets, long-lived Delta Sharing credentials) in the same severity queue, framework reports, and workflows as existing cloud findings.
   • Ranks Databricks risk by runtime exposure, so live model serving endpoints taking traffic are prioritized over registered-but-idle ones.

   4 details in Everything

4. Upwind x Cursor Origin – Securing Software Factories (2026-10-13) Oct 13, 2026 · issue 108

   Upwind now scans Cursor Origin repositories on every PR and branch push, delivering findings as inline comments, PR checks, and console alerts, with merge-blocking support.

   • Installs via Components > Integrations > Origin in the Upwind console; repositories are discovered automatically within seconds.
   • Scans trigger on PR open, reopen, or update, and on every branch push — no developer or agent action required.
   • Findings surface in the Upwind console, as inline PR comments, and in the PR Checks tab, so agents can resolve issues in the same pass.
   • Upwind checks can block a merge, stopping risky agent-written code at the gate and instructing the agent on what to change.

   4 details in Everything

   • New integration Cursor Origin integration
5. announced Oct 13, 2026 · issue 108

   Upwind adds a Cursor Origin integration that auto-scans every PR and branch push, delivering findings as PR comments, checks, and console alerts, with merge-blocking support.

   • New integrationInstalls from Components > Integrations > Origin in the Upwind console with no pipeline changes required.
   • Scans PRs on open, reopen, and update, and every branch push, without manual triggering.
   • Findings surface as inline PR comments, PR Checks tab entries, and Upwind console alerts.
   • Merge-blocking checks stop risky agent-written code and tell the authoring agent what to fix.

   4 details in Everything

6. Upwind Now Secures Snowflake from AI Down to the Storage Underneath It (2026-10-01) Oct 1, 2026 · issue 092

   Upwind adds Snowflake Security: asset inventory, CIS Snowflake BenchmarkCIS Snowflake BenchmarkA configuration baseline published by the Center for Internet Security that specifies hardening settings for Snowflake cloud data warehouse environments, giving cyber tools a vetted standard to audit against. posture checks, and graph traversal from roles to cloud storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Connect a Snowflake account to start receiving posture findings and AI asset inventory in the Upwind console.
   📍In the Upwind console, go to Data sources › Snowflake and add your Snowflake account to begin asset discovery and posture checks.
   • Adds Snowflake Security integration under Data sources in the Upwind console, covering account-level asset inventory across warehouses, compute pools, users, account roles, network policies, database roles, secrets, network rules, stages, and external volumes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds AI asset inventory within Snowflake schemas, covering foundation and custom models, agents, Cortex Search services, dynamic tables, notebooks, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, nested by schema with role and user resolution.
   • Adds posture checks mapped to the CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Snowflake Benchmark, covering privileges on account and database roles, authentication and network posture, AI asset access, and storage behind stages and external volumes.
   • Adds cross-environment graph traversal that resolves Snowflake stages and external volumes to backing object storage buckets, storage integrations to assumed cloud roles, and network policies to cloud network topology — tracing a database role grant all the way to the bucket it exposes.
   • Adds continuous monitoring for account-level token policy changes that remove the network-policy requirement from programmatic access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., reported at the moment the setting changes rather than at audit time.

   5 details in Everything

7. Introducing the new Configurations experience in Upwind (2026-09-24) Sep 24, 2026 · issue 085

   Upwind rebuilds its Configurations experience with live compliance scoring, per-account breakdowns, and a Score Journey to prioritize fixes by impact.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   When preparing for an ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. audit, navigate to the Configurations experience to view a live compliance score filtered to your ISO framework and share the view directly with auditors without exporting a spreadsheet.
   📍In Upwind, go to Configurations › select the ISO framework › filter by the relevant cloud account › share the view with stakeholders.
   Use Score Journey to identify the highest-impact, lowest-effort fixes before a compliance review — sort findings by potential score improvement and difficulty to build a defensible remediation plan.
   📍In Upwind, go to Configurations › Score Journey › sort findings by Score Impact descending, then filter by difficulty Easy to identify quick wins.
   • Adds continuous, live compliance scoring evaluated against multiple frameworks simultaneously, including CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline., NIST, ISO, EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., and ISO/IEC 42001, across AWS, Azure, Google Cloud, Oracle Cloud, Kubernetes, and on-premises environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Score Journey, which shows for each finding how much remediating it would improve the overall compliance score, how many resources it affects, and a difficulty rating from Easy to Hard.
   • Scores each cloud account separately so every compliance gap is connected to a specific environment and responsible team rather than surfaced only as an organization-wide number.
   • Separates configuration findings from security issues so teams can distinguish policy gaps from active risks.
   • Maintains a versioned, continuously updated framework library — including recent additions such as ISO/IEC 42001 and the EU AI Act — displaying each framework's version and latest update date.
   • Adds continuous, live compliance scoring evaluated against multiple frameworks simultaneously, including CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline., NIST, ISO, EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., and ISO/IEC 42001, across AWS, Azure, Google Cloud, Oracle Cloud, Kubernetes, and on-premises environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Score Journey, which shows for each finding how much remediating it would improve the overall compliance score, how many resources it affects, and a difficulty rating from Easy to Hard.
   • Scores each cloud account separately so every compliance gap is connected to a specific environment and responsible team rather than surfaced only as an organization-wide number.
   • Separates configuration findings from security issues so teams can distinguish policy gaps from active risks.

   1 more in Everything

8. Upwind Code Expands Enterprise Coverage to Azure DevOps and Bitbucket Cloud (2026-09-14) Sep 14, 2026 · issue 076

   Upwind Code now supports Azure DevOps and Bitbucket Cloud, completing coverage across all four major version control providers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Connect an Azure DevOps or Bitbucket Cloud environment to begin repository discovery and pull request scanning.
   📍In the Upwind console, go to Components → Integrations and select Azure DevOps or Bitbucket Cloud to connect your organization or workspace.
   Control which organizations and repositories are actively scanned after connecting a version control provider.
   📍In the Upwind console, go to Organizations & Repositories to select which connected organizations and repositories are in scope for scanning.
   • Adds Azure DevOps integration, connecting at the organization level through Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. to discover repositories and surface findings on pull requests without modifying existing CI/CD pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Bitbucket Cloud integration, connecting at the workspace level to automatically include new repositories and surface findings within pull request review workflows.
   • Enables reporting scan results from any version control provider to Upwind through the API, for teams not using GitHub, GitLab, Azure DevOps, or Bitbucket Cloud.
   • Adds an Organizations & Repositories page in the Upwind console to centrally manage which organizations and repositories are scanned, keeping access and scan scope separate.

   4 details in Everything

9. Upwind Blue Agent – Increasing the Scope and tooling to a new level of incident response (2026-09-08) Sep 8, 2026 · release notes

   Upwind Blue Agent adds auto-generated threat story investigations with event-driven triggering and expanded evidence domains.

   └──▷ HOW TO FIND IT
   View the correlated incident timeline, evidence, and verdict generated by the Blue Agent after an auto-triggered investigation completes.
   📍Navigate to the Investigation view to review the verdict, confidence level, and supporting evidence.
   Leverage cross-domain telemetry to trace a cloud attack sequence from initial execution to lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access..
   📍Review the unified incident narrative connecting Runtime Events, Network Events, and Kubernetes Audit Logs.
   • Adds Auto-Generated Threat Story Investigations that correlate detections into a unified incident narrative with verdicts and confidence levels.
   • Adds Event-Driven Auto-Triggering (beta) to initiate Blue Agent investigations automatically when a Story is created or updated.
   • Extends evidence foundation with Runtime Events (process, file, syscalls), Network Events (ingress/egress/internal/cloud-service flows), Kubernetes Audit Logs (EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves./GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.), and API Security metadata.

   3 details in Everything

10. Upwind for Microsoft Sentinel – Available on Marketplace and Security Store (2026-09-03) Sep 3, 2026 · release notes

    Upwind for Microsoft Sentinel integrates six security datasets into Log Analytics via a new ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. template deployment.

    • Adds upwind data ingestion into Microsoft Sentinel via Microsoft Marketplace and Security Store
    • Ingests six Upwind datasets (Inventory, Vulnerability findings, Threat detections, Threat events, Threat stories, Configuration and posture findings) into separate Log Analytics custom tables
    • Provides a single ARM template to provision the Azure Function App, Data Collection Endpoint, Data Collection Rules, and required role assignments
    • Configures a timer-triggered Azure Function with OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. authentication that synchronizes data via six Upwind API endpoints
    • Allows configurable synchronization schedule (default: every hour) and independent dataset processing with a default 90-minute lookback window for Threat and posture datasets

    5 details in Everything

11. Security Reporting Built Around Your Program (2026-08-21) Aug 21, 2026 · release notes

    Upwind introduces Custom Reporting with Summary (PDF) and Operational Data reports accessible from any view.

    • Adds Save as Report button in every table and board view to convert existing filtered views into reusable saved reports
    • Enables Summary Reports that export custom boards as PDFs with trend data and risk summaries for executive audiences
    • Allows Sync board changes to future reports option so report content automatically reflects latest board configuration updates
    • Supports relative time range selection (last 24 hours, 7 days, 30 days, or 90 days) for time-sensitive components in Summary Reports
    • Introduces Operational Data Reports allowing users to select specific fields and define their order from any security module

    +3 more show less

    • Makes all reports manageable via the Components > Reports page with search, filter, and on-demand download capabilities
    • Adds organization-level sharing controls for reports while maintaining personal visibility by default
    • Implements RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. on report creation, editing, and deletion actions with audit log capture for every change

    8 details in Everything

12. Introducing the Upwind Blue Agent: Autonomous Threat Investigation for the SOC (2026-08-20) Aug 20, 2026 · release notes

    Upwind adds Blue Agent, an autonomous threat investigation capability with dedicated Investigation tabs on Threat Stories.

    └──▷ HOW TO FIND IT
    Review the autonomous verdict and confidence level directly on the Threat Story page without leaving the console.
    📍In the Threat Stories list, click a story to open its dedicated Investigation tab.
    Deep dive into specific evidence items referenced in the investigation report.
    📍Click on an IP address or file hash within the Investigation tab to view its context in the side panel.
    Query the AI agent for clarification on the verdict reasoning directly from the investigation report.
    📍Type a question like 'Which evidence most strongly supports the verdict?' in the chat box at the bottom of the Investigation tab.
    • Adds a dedicated Investigation tab to every Threat Story containing the Blue Agent's complete findings, verdict, and evidence list.
    • Enables automatic initiation of Blue Agent investigations when a Threat Story is created or meaningfully updated, with a grace period for related events to accumulate.
    • Provides interactive indicators in investigation reports, allowing analysts to select IPs, domains, hashes, or workloads to view context in the Upwind side panel.
    • Adds a conversational interface from any completed investigation, allowing analysts to ask follow-up questions about evidence and reasoning via chat.

    4 details in Everything

13. Upwind Launches Malware Scanning for Cloud Storage Across AWS, Azure, and GCP (2026-08-14) Aug 14, 2026 · release notes

    Upwind adds multi-cloud malware scanning for AWS S3, Azure Blob, and GCP Cloud Storage buckets.

    • Adds Malware Scanning for Buckets as a new capability across AWS (Amazon S3), Azure (Blob Storage), and Google Cloud (Cloud Storage) to identify malicious files in cloud object storage
    • Automatically surfaces detected malware findings with a malware tag within the existing Upwind threat detection workflows for unified risk context

    2 details in Everything

14. Validate the Real-World Exposure of Your APIs with Upwind Attack Surface Management (2026-08-13) Aug 13, 2026 · release notes

    Upwind adds unified API attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. dashboard, vulnerability findings with AI summaries, and on-demand scan scoping

    • Adds a Unified Attack Surface Dashboard that displays API vulnerability findings alongside cloud exposure findings in a single view
    • Introduces API Vulnerability Findings featuring AI-generated summaries, evidence, remediation guidance, and attack surface context with flexible filtering
    • Enables on-demand API scans scoped to specific cloud accounts, organizational units, or Kubernetes namespaces via runtime API security testing

    3 details in Everything