https://cybertoolchain.io/tools/upwind New releases and features in Upwind, tracked by The Cyber Toolchain. en Wed, 21 Oct 2026 22:07:37 GMT https://www.upwind.io/feed/upwind-story-replay-watch-the-attack-unfold https://www.upwind.io/feed/upwind-story-replay-watch-the-attack-unfold Wed, 21 Oct 2026 22:07:37 GMT Upwind adds Story Replay: a visual MITRE-mapped timeline letting analysts watch multi-stage attacks unfold step by step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Upwind Story Replay, a visual timeline inside the Upwind console that renders every detection contributing to a threat in chronological order, annotated with MITRE tactics and associated resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Story Replay surfaces the order, timing, and blast radius of multi-stage attacks across workloads and identities, replacing manual alert-list reconstruction with a single visual attack path. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/upwind https://www.upwind.io/feed/runtime-first-agentless-everywhere https://www.upwind.io/feed/runtime-first-agentless-everywhere Mon, 19 Oct 2026 23:48:38 GMT Upwind adds a Kubernetes Agentless Scanner and a three-layer security model for clusters where a node sensor cannot be deployed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the Kubernetes Agentless Scanner — connects to a cluster without a DaemonSet or node install, builds a full inventory (Deployments, DaemonSets, StatefulSets, services), extracts SBOMs from deployed images, and surfaces vulnerabilities on the workload that runs each image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Agentless image scans also detect exposed secrets and malicious files in image contents, surfaced in Threats alongside other detections. • Surfaces Kubernetes agentless inventory under dedicated resource kinds in Inventory (Deployments, DaemonSets, StatefulSets, services) alongside the rest of the estate, covering both public and private clusters from a single view. • Introduces a three-layer security model — Upwind Sensor (node-level runtime), Kubernetes Agentless Scanner (inside the cluster), and Cloud Scanners (outside the cluster) — all feeding the same inventory, security graph, and Containers & Kubernetes Focus Mode. • Cloud Scanners now surface the Kubernetes cluster's external footprint — managed cluster resources, node VMs and their OSes, load balancers, IAM roles, and network paths — enabling discovery of unknown clusters and converting them into agentless scanner candidates. • Runtime detection identifies AI-agent activity — unexpected shells, previously unseen processes, cloud metadata service calls, and uncharted service-to-service traffic — that manifests only at runtime and is invisible to manifest or image scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/upwind https://www.upwind.io/feed/upwind-launches-databricks-security https://www.upwind.io/feed/upwind-launches-databricks-security Mon, 19 Oct 2026 16:38:38 GMT Upwind launches Databricks Security, adding lakehouse asset inventory, posture checks, and graph coverage across Unity Catalog and cloud resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Databricks Security integration via `Components > Integrations`, covering asset inventory for workspaces, metastores, catalogs, schemas, grants, storage credentials, external locations, Delta Sharing shares and recipients, model serving endpoints, vector search indexes, and registered models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Connects Databricks Unity Catalog grants to underlying cloud resources — mapping storage credentials to IAM roles, clusters to compute resources, network configuration to VPCs and security groups, and encryption configuration to KMS keys — in a single traversable graph. • Surfaces Databricks-specific security findings (overly broad data grants, non-expiring access tokens, publicly exposed workspaces and clusters, universally readable secrets, long-lived Delta Sharing credentials) in the same severity queue, framework reports, and workflows as existing cloud findings. • Ranks Databricks risk by runtime exposure, so live model serving endpoints taking traffic are prioritized over registered-but-idle ones. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/upwind https://www.upwind.io/feed/upwind-x-cursor-origin-securing-software-factories https://www.upwind.io/feed/upwind-x-cursor-origin-securing-software-factories Tue, 13 Oct 2026 18:54:01 GMT Upwind integrates with Cursor Origin to scan every pull request and branch push, delivering findings as PR comments, checks, and console alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Installs the Upwind app from the Upwind console under `Components > Integrations > Origin` to connect to Cursor Origin and begin repository scanning in seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Scans every pull request on open, reopen, or update, and every push to a branch in Cursor Origin, with no pipeline changes required. • Delivers findings in three places: inline pull request comments, the PR `Checks` tab, and the Upwind console — enabling agents to read and act on results in the same pass. • Supports blocking merges via Upwind checks, stopping risky agent-written code at the gate and telling the agent what to change. • Available on the Origin Marketplace as an installable app, with Upwind discovering repositories automatically after installation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/upwind https://www.upwind.io/feed/upwind-now-secures-snowflake-from-ai-down-to-the-storage-underneath-it https://www.upwind.io/feed/upwind-now-secures-snowflake-from-ai-down-to-the-storage-underneath-it Thu, 01 Oct 2026 20:59:04 GMT Upwind adds Snowflake Security: asset inventory, CIS Snowflake Benchmark posture checks, and graph traversal from roles to cloud storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Snowflake Security integration under `Data sources` in the Upwind console, covering account-level asset inventory across warehouses, compute pools, users, account roles, network policies, database roles, secrets, network rules, stages, and external volumes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds AI asset inventory within Snowflake schemas, covering foundation and custom models, agents, Cortex Search services, dynamic tables, notebooks, and MCP servers, nested by schema with role and user resolution. • Adds posture checks mapped to the CIS Snowflake Benchmark, covering privileges on account and database roles, authentication and network posture, AI asset access, and storage behind stages and external volumes. • Adds cross-environment graph traversal that resolves Snowflake stages and external volumes to backing object storage buckets, storage integrations to assumed cloud roles, and network policies to cloud network topology — tracing a database role grant all the way to the bucket it exposes. • Adds continuous monitoring for account-level token policy changes that remove the network-policy requirement from programmatic access tokens, reported at the moment the setting changes rather than at audit time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/upwind https://www.upwind.io/feed/introducing-the-new-configurations-experience-in-upwind https://www.upwind.io/feed/introducing-the-new-configurations-experience-in-upwind Thu, 24 Sep 2026 21:38:56 GMT Upwind rebuilds its Configurations experience with live compliance scoring, per-account breakdowns, and a Score Journey to prioritize fixes by impact.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds continuous, live compliance scoring evaluated against multiple frameworks simultaneously, including CIS, NIST, ISO, EU AI Act, and ISO/IEC 42001, across AWS, Azure, Google Cloud, Oracle Cloud, Kubernetes, and on-premises environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces Score Journey, which shows for each finding how much remediating it would improve the overall compliance score, how many resources it affects, and a difficulty rating from Easy to Hard. • Scores each cloud account separately so every compliance gap is connected to a specific environment and responsible team rather than surfaced only as an organization-wide number. • Separates configuration findings from security issues so teams can distinguish policy gaps from active risks. • Maintains a versioned, continuously updated framework library — including recent additions such as ISO/IEC 42001 and the EU AI Act — displaying each framework's version and latest update date. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/upwind https://www.upwind.io/feed/upwind-code-expands-enterprise-coverage-to-azure-devops-and-bitbucket-cloud https://www.upwind.io/feed/upwind-code-expands-enterprise-coverage-to-azure-devops-and-bitbucket-cloud Mon, 14 Sep 2026 19:02:49 GMT Upwind Code now supports Azure DevOps and Bitbucket Cloud, completing coverage across all four major version control providers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Azure DevOps integration, connecting at the organization level through Microsoft Entra ID to discover repositories and surface findings on pull requests without modifying existing CI/CD pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Bitbucket Cloud integration, connecting at the workspace level to automatically include new repositories and surface findings within pull request review workflows. • Enables reporting scan results from any version control provider to Upwind through the API, for teams not using GitHub, GitLab, Azure DevOps, or Bitbucket Cloud. • Adds an 'Organizations & Repositories' page in the Upwind console to centrally manage which organizations and repositories are scanned, keeping access and scan scope separate. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/upwind