SECURITY ATLAS / EVALUATION BRIEF Upwind Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/upwind/ THE ATLAS TAKE Upwind’s appeal is a runtime-led explanation of cloud risk: connect what is deployed to what an application actually does, then use that context to investigate and prioritize. Its public documentation distinguishes agentless cloud scanners from the runtime Sensor, which is a useful starting point for an honest evaluation. Atlas would verify both layers on one representative application before extending the platform’s broad CNAPP claims across an estate. Sensor coverage, application identity, scanner permissions, and a reproducible owner handoff matter more than a visually rich topology. Runtime context should refine a risk judgment, not make unobserved workloads disappear from consideration. SCOPE This profile covers the documented CNAPP approach, including agentless assessment and separately deployed runtime sensors. Verify platform and workload support in a lab; marketing claims about detection speed or reduced noise are not independent performance evidence. WORTH A LOOK WHEN Cloud-native teams able to operate workload sensors and in-account scanners while using application behavior to prioritize cloud remediation. THINK TWICE WHEN The organization cannot deploy the required runtime components or expects an agentless assessment to establish continuous execution visibility. IMPLEMENTATION 1. Map one application’s evidence paths List its cloud resources, workload nodes, scanner coverage, Sensor placement, and responsible application team. 2. Deploy with controlled credentials Follow the documented secret-handling and installation path; restrict access to deployment credentials and verify outbound connectivity. 3. Test change and collection failure Repeat the investigation after a workload rollout and a deliberate disconnected component, preserving the resulting visibility gaps. OPERATING REALITY Platform engineers own Sensor deployment, credentials, connectivity, and updates; cloud owners maintain scanner resources and permissions; security teams govern response and exceptions. Atlas would track sensor and scanner coverage separately. An application that appears in a cloud inventory may still lack the runtime evidence needed to justify a particular prioritization or response decision. COMMERCIAL CONSIDERATIONS Obtain a quote that names the required platform modules, protected populations, runtime components, and cloud-scanner deployment. Public technical documentation does not establish a complete price or universal counting rule. - Quoted cloud and workload populations plus selected capabilities - In-account scanner infrastructure and runtime component resources - Deployment engineering, support, investigation retention, and policy maintenance EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Join static and runtime evidence Acceptance evidence: Use a harmless vulnerable lab component and a legitimate application request; trace both to the same workload and owner without assuming observation proves exploitation. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Verify Sensor coverage after rollout Acceptance evidence: Compare Kubernetes node and workload inventory with Sensor health before and after a deployment change. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Demonstrate a collection gap Acceptance evidence: Disconnect a lab Sensor or scanner and show the health signal, missing evidence, investigation limitations, and recovery after reconnection. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which kernels, workload types and managed services support the required runtime behavior? - How is an absent or unhealthy sensor distinguished from an application with no detected activity? - Which AI inventory or posture functions are actually available, and do they inspect behavior or only describe deployed resources? EVIDENCE GAPS - No independent detection, noise-reduction, sensor-overhead, or prioritization benchmark was conducted. - Exact provider and workload support, response behavior, entitlements, and data-retention terms must be validated for the proposed deployment. SOURCES Upwind CNAPP architecture and collection layers (Documentation) https://docs.upwind.io/public/introduction/concepts/upwind-cnapp Upwind Cloud Scanners architecture (Documentation) https://docs.upwind.io/public/introduction/concepts/upwind-architecture/cloud-scanners Upwind Kubernetes Sensor installation (Documentation) https://docs.upwind.io/public/getting-started/install-sensor/kubernetes/install Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.