Above + Upwind: Connecting Insider Risk to Cloud Runtime Security

Above and Upwind are partnering to connect two layers of security that have traditionally been analyzed in isolation: the human and identity layer, where insider risk begins, and the cloud runtime layer, where its impact plays out. The result is a fuller picture for security teams. You see not just who is behaving riskily, but what that identity actually did across your cloud workloads, APIs, and AI services.

Insider incidents rarely stop at the endpoint or the browser. A departing employee, a compromised account, or an over-permissioned engineer eventually touches something that matters: a production database, an object store, a secret, an AI model. Seeing the intent without the cloud impact leaves investigators guessing. Seeing the cloud activity without the human context leaves them chasing anomalies that may be perfectly legitimate. Together, Above and Upwind close that gap.

Why insider risk and cloud runtime belong together

Insider risk is a question of intent. Cloud runtime is a question of impact. You need both to make a confident decision. Above focuses on the human layer, understanding user behavior and intent in real time across identity, browser, and SaaS activity. Upwind focuses on the cloud layer, using a lightweight eBPF sensor to see what workloads, APIs, and AI services are actually doing in production.

On their own, each answers half the question:

• Above answers "who and why": which identity is acting outside its normal pattern, and whether the behavior looks like curiosity, negligence, or genuine malicious intent.
• Upwind answers "what and where": which cloud resources that identity reached, what data moved, and whether the runtime behavior deviates from the workload's baseline.

Correlated, they turn two ambiguous signals into one clear narrative.

What the integration brings together

The integration lets teams line up an insider-risk signal from Above with the corresponding cloud runtime context from Upwind. When Above surfaces a user whose behavior warrants a closer look, the team can view that alongside Upwind's runtime picture of the cloud resources involved, so an investigation reflects both the person and the infrastructure on one timeline.

• Human and identity context from Above, alongside cloud workload, API, and AI-service activity from Upwind.
• A shared view of an event that runs from the browser and SaaS layer through to the cloud runtime.
• Sharper prioritization: runtime findings carry the intent context that tells a team whether to act now or keep watching.

What a joint investigation looks like

Consider an engineer who is weeks from leaving and starts accessing systems outside their normal scope. Above recognizes the behavioral shift at the identity and SaaS layer and raises it as an insider-risk signal. With Upwind in the picture, the team can see whether that same identity reached sensitive cloud workloads, moved data out of an object store, or invoked an AI service in a way that breaks the workload's runtime baseline. The story assembles itself: intent from Above, impact from Upwind, one decision.

Who benefits

Security and insider-risk teams at cloud-heavy organizations get the most value, especially where sensitive data and AI workloads live in the cloud and identity is the real perimeter. Instead of stitching together endpoint, identity, and cloud telemetry by hand, teams get the human and runtime layers correlated for them.

Getting started

The Above and Upwind teams are working together to bring this to joint customers. If you use one platform and want to explore the combined workflow, explore the full set of Above integrations, or visit Upwind to learn more. You can also see how Above approaches malicious insider and agentic AI risk.

Frequently asked questions

What does the Above and Upwind integration do?

It connects Above's insider-risk and identity signals with Upwind's cloud runtime context, so security teams can see both who is behaving riskily and what that identity did across cloud workloads, APIs, and AI services.

How is this different from a cloud security tool on its own?

A cloud security platform sees runtime activity but not human intent. Above adds the identity and behavioral context that explains whether risky-looking cloud activity is malicious, negligent, or benign, so teams prioritize the right things.

Who should use it?

Security and insider-risk teams at organizations that run sensitive data and AI workloads in the cloud, where identity is the primary attack surface.

About Above

Above helps organizations get ahead of insider risk in the agentic era. It understands user intent in real time across identity, browser, and SaaS activity and turns it into proactive investigations. Learn more at above.security.

About Upwind

Upwind is a runtime-first cloud-native application protection platform (CNAPP) that uses live production data to help teams detect, investigate, and respond to cloud risks and threats in real time. Learn more at upwind.io.