Defender for Cloud vs Upwind: cloud security facts side by side
How do their category maps compare?
- Described on the vendor's pages we read
- Not in our sources (it may exist; we did not find it on the pages we read)
What are the facts, side by side?
| Fact | Defender for Cloud | Upwind |
|---|---|---|
| Positioning | Microsoft's cloud security product: a free posture tier, paid posture and server plans billed per resource, across Azure, AWS and Google Cloud. | A cloud security platform that combines agentless scanning with eBPF runtime sensors, from a company founded in October 2022. |
| Agent approach | Agentless parts, agent for depth Agentless VM, secrets and Kubernetes scanning exist, but only in the paid Defender CSPM plan and Defender for Servers Plan 2. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Agentless parts, agent for depth Agentless scanning plus eBPF runtime sensors; the design centers on the runtime sensor. Source: Upwind homepage, read . |
| Runtime sensor | Defender for Servers Plan 1 and Plan 2 bring Microsoft Defender for Endpoint EDR to servers. Source: Microsoft Learn: Defender for Servers overview, read . | eBPF sensors that baseline cloud activity, network and application flows, with forensic event timelines. Source: Upwind CDR, read . |
| Clouds namedDiffers | Azure, AWS, GCP Azure, AWS and Google Cloud, plus on-premises machines through Azure Arc. Source: Microsoft Learn: Defender for Servers overview, read . | AWS, Azure, GCP, OCI AWS, Google Cloud, Azure and OCI are named as partnerships. Source: Upwind homepage, read . |
| CNAPP | Described Posture (Defender CSPM) and workload protection (Defender for Servers) are separate plans in one product; the full set needs paid plans. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described Lists posture, identity, data, workload, code, API and detection modules on one platform. Source: Upwind homepage, read . |
| CSPM | Described Foundational CSPM is free; Defender CSPM adds attack path analysis and the cloud security explorer. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described CSPM is listed. Source: Upwind homepage, read . |
| CWPP | Described Defender for Servers Plan 1 and Plan 2, with file integrity monitoring and just-in-time access in Plan 2. Source: Microsoft Learn: Defender for Servers overview, read . | Described Container and Kubernetes, serverless, and CDR modules, with eBPF sensors. Source: Upwind homepage, read . |
| CIEM | Described Defender for Cloud includes native CIEM, supporting Microsoft Entra ID, AWS IAM and Google Cloud IAM. Source: Microsoft Learn: CIEM in Defender for Cloud, read . | Described CIEM is listed. Source: Upwind homepage, read . |
| DSPM | Described DSPM is part of the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described DSPM is listed. Source: Upwind homepage, read . |
| Vulnerability management | Described Agentless VM vulnerability scanning is in the paid Defender CSPM plan and Defender for Servers Plan 2. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Described Vulnerability management and attack path analysis are listed. Source: Upwind homepage, read . |
| Code securityDiffers | Code-to-cloud mapping in the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | IaC security, SCA and SBOM, DAST and a container admission controller; SAST is not among its listed modules. Source: Upwind homepage, read . |
| AI securityDiffers | AI-SPM in the paid Defender CSPM plan; Defender for AI Services is billed per 1,000 tokens. Source: Azure: Defender for Cloud pricing, read . | AI inventory, AI-BOM, AI-SPM, an AI sensor, AI detection and response, and offensive testing for models, agents and MCP servers. Source: Upwind AI security platform, read . |
| Kubernetes runtimeDiffers | Agentless Kubernetes discovery in the paid Defender CSPM plan. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Container and Kubernetes security is listed, with eBPF sensors. Source: Upwind homepage, read . |
| Private cloud or on-premisesDiffers | On-premises machines through Azure Arc. Source: Microsoft Learn: Defender for Servers overview, read . | Not in our sources |
| Disconnected environments | Not in our sources | Not in our sources |
| Compliance reporting | Compliance standards include CIS, PCI DSS v4.0.1, HIPAA, ISO/IEC 27001:2022, SOC 2023, NIST CSF v2.0 and NIST SP 800-53, assignable to Azure subscriptions, AWS accounts and GCP projects. Source: Microsoft Learn: regulatory compliance standards, read . | Supports CIS benchmarks, HIPAA, ISO 27001, NIST, PCI and SOC 2 compliance with 13-month data lookback. Source: AWS Marketplace: Upwind Cloud Security Platform, read . |
| Public-sector authorizationDiffers | Microsoft lists Defender for Cloud in FedRAMP High audit scope for Azure and Azure Government. Source: Azure and other Microsoft cloud services compliance scope, read . | Upwind says it is pursuing FedRAMP Moderate Equivalency; no authorization is stated. Source: Upwind pursues FedRAMP certification to power trusted federal cloud solutions, read . |
| PriceDiffers | Foundational CSPM is free. Defender CSPM is $5.11 per billable resource per month (8 functions or web apps count as 1 resource). Defender for Servers is $4.906 per server per month for Plan 1 and $14.60 for Plan 2. Defender for Containers is $6.8693 per vCore per month. USD list prices, East and Central US; free for the first 30 days. Source: Azure: Defender for Cloud pricing (re-read), read . | Not published No price on upwind.io. AWS Marketplace, 12-month contract: Upwind Cloud Security Platform $30,000.00 and Upwind Managed Detection and Response 24/7 Service $6,000.00; the unit basis is not described in our notes. 24-month and 36-month contracts are listed as saving up to 8% and 11%. Source: AWS Marketplace: Upwind Cloud Security Platform, read . |
| Open source | None named | None named |
| Ownership | Microsoft. Source: Microsoft Learn: Defender for Cloud CSPM plans, read . | Standalone vendor, founded October 2022 in San Francisco; CEO Amiram Shachar. $250 million Series B announced 26 January 2026. Source: Upwind newsroom, read . |
Where do they differ?
- Clouds named: Defender for Cloud names Azure, AWS and GCP; Upwind names AWS, Azure, GCP and OCI.
- Code security: Defender for Cloud partly matches; Upwind matches.
- AI security: Defender for Cloud partly matches; Upwind matches.
- Kubernetes runtime: Defender for Cloud partly matches; Upwind matches.
- Private cloud or on-premises: Defender for Cloud matches; Upwind is not in our sources.
- Public-sector authorization: Defender for Cloud matches; Upwind partly matches.
- Price: Defender for Cloud matches; Upwind partly matches.
Choose Defender for Cloud if
- Most of your estate is on Azure and you already use Microsoft security products.
- You need to model cost from public prices before talking to anyone.
Choose Upwind if
- Runtime detection is your first requirement and you will deploy a sensor.
- You want DAST, API security and AI detection in the same platform.
Which limits should you check?
Defender for Cloud
- Agentless scanning, attack paths, DSPM and AI-SPM sit in the paid Defender CSPM plan ($5.11 per billable resource per month), not the free tier.
- Oracle Cloud and Alibaba Cloud are not named, and from 27 October 2026 the free tier becomes opt-in for new Azure subscriptions.
Upwind
- No price on upwind.io; the AWS Marketplace 12-month contract of $30,000 does not state its unit basis in our notes.
- A younger company (founded October 2022; 150+ customers per its newsroom), and Upwind says it is pursuing FedRAMP Moderate Equivalency; no authorization is stated.
- SAST is not among its listed code modules.
Frequently asked questions
How do Defender for Cloud and Upwind differ?
Neither is scored on this site. Defender for Cloud describes 6 of six categories and Upwind 6 on the pages we read, and they differ on 7 recorded facts. Which fits depends on your clouds, agent tolerance and existing tools; the finder checks those.
Which of the two needs an agent?
Defender for Cloud: Agentless parts, agent for depth. Upwind: Agentless parts, agent for depth.
Do Defender for Cloud or Upwind publish prices?
Defender for Cloud: Foundational CSPM is free. Defender CSPM is $5.11 per billable resource per month (8 functions or web apps count as 1 resource). Defender for Servers is $4.906 per server per month for Plan 1 and $14.60 for Plan 2. Defender for Containers is $6.8693 per vCore per month. USD list prices, East and Central US; free for the first 30 days. Upwind: No price on upwind.io. AWS Marketplace, 12-month contract: Upwind Cloud Security Platform $30,000.00 and Upwind Managed Detection and Response 24/7 Service $6,000.00; the unit basis is not described in our notes. 24-month and 36-month contracts are listed as saving up to 8% and 11%.