AWS has added Upwind’s eBPF‑based runtime security solution to the Security Hub Extended catalog, making it available through the same pay‑as‑you‑go billing model used for other Hub services. Engineers and security teams can now ingest real‑time workload behavior data alongside existing posture and vulnerability findings without building custom integrations.
What Changed in Security Hub Extended
Upwind, a cloud security vendor trusted by several large enterprises, is now a listed partner in Security Hub Extended. The integration includes a private‑offer option for committed‑pricing agreements as well as the standard on‑demand pricing that appears on a single AWS bill. The partnership is commercial as well as technical: AWS and Upwind have closed multi‑million‑dollar deals together, and Upwind’s solution is positioned to be the fastest‑engaging partner in the program.
Why Runtime Visibility Matters for Engineers
Most cloud security tools evaluate configuration snapshots and generate risk scores based on static posture. Upwind’s approach differs by deploying an eBPF sensor inside the Linux kernel, continuously observing process activity, network connections, API calls, and container interactions. This real‑time view lets teams see which workloads are actively exposed, cutting down on false‑positive alerts and focusing effort on genuine threats.
Architectural and Operational Implications
Findings from Upwind are emitted in the Open Cybersecurity Schema Framework (OCSF) and flow into Security Hub where they are correlated with other partner data, such as Chainguard’s supply‑chain checks or Splunk’s SIEM dashboards. Because the data is already normalized, operators do not need to write glue code to combine sources. The single‑bill model removes the need for separate contracts or billing pipelines, and the private‑offer path allows enterprises to aggregate spend across multiple Extended partners.
From an implementation perspective, teams should provision the Upwind sensor on Linux workloads that run in AWS (EC2, ECS, EKS, etc.). The sensor runs in kernel space via eBPF, so standard IAM permissions for installing agents still apply, but no additional network or proxy configuration is required to forward findings to Security Hub. Operationally, the continuous stream of events may increase the volume of data ingested by Hub, so monitoring Hub’s ingestion limits and OCSF processing capacity is advisable.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
Practitioners should evaluate whether their current security stack already includes static posture tools and whether adding real‑time runtime data would close observable gaps. If so, enable the Upwind integration through the Security Hub console, choose the appropriate pricing model, and verify that the OCSF schema version matches downstream consumers (e.g., Splunk or custom dashboards). Consider testing the sensor on a non‑production workload first to gauge event volume and alert relevance. Finally, review the joint billing and private‑offer options to ensure they align with your organization’s procurement policies.