Upwind expands cloud sensor into AI control

Diving deeper into

Upwind

Company Report
Upwind described plans to add AI sensors for endpoints, scanners for agents and their skills, and a broader inventory graph connecting cloud and AI activity.
Analyzed 5 sources

Upwind is trying to turn a cloud workload sensor into a control point for the whole AI stack. Today its core value is seeing what code is actually running in cloud workloads, then ranking risk by real exposure. The planned endpoint sensors, agent scanners, and shared inventory graph would extend that same runtime logic into laptops, AI agents, models, tools, and data paths, so one investigation can follow an attack from an employee device into a cloud service and then into an agent action.1 2 3 4

  • The product direction follows the same pattern as Upwind's current platform. It already combines cloud account scans with lightweight runtime sensors, and its AI Detection & Response product maps agent activity and flags unusual behavior. The new pieces fill obvious blind spots, especially endpoint activity and a fuller catalog of what each agent can access and do.1 2
  • The inventory graph matters because AI security breaks when teams only see static setup, not live behavior. Wiz positions its AI security around a security graph that links infrastructure, identity, models, data, and applications, while Obsidian emphasizes runtime mapping of agents, permissions, tool calls, and MCP servers. Upwind is moving toward that same graph based control plane, but from a cloud runtime starting point.3 4 5
  • That expansion also changes what budget Upwind can chase. Instead of only helping cloud security teams cut alert noise on vulnerable workloads, it can sell into AI governance and incident response workflows where security teams need a single record of which agent used which credential, called which tool, touched which data, and ran on which system.1 2 4

The next step is a broader security platform that treats AI agents like new workload identities sitting on top of cloud and endpoint infrastructure. If Upwind executes, it can compete less as a point CNAPP and more as a shared investigation layer for cloud, AI, and security operations, which is where larger and stickier enterprise contracts tend to form.1 2 3 4