When a high-severity alert appears in a cloud console, responders need to verify whether the affected workload is actively running in memory and whether it holds an open execution path to sensitive data assets.
Infrastructure execution and data visibility often exist in separate systems. Upwind operates as a Cloud-Native Application Protection Platform (CNAPP) monitoring running containers, kernel syscalls, process trees, identities, and network paths at runtime. Matters.AI operates as a Data Detection and Response (DDR) platform that covers data discovery, DSPM, and Database Activity Monitoring (DAM) to discover file inventories, datastore schemas, object lineage, and user permissions. When these systems operate independently, engineers spend critical incident response time acting as manual middleware while cross-referencing separate dashboards to determine if an infrastructure vulnerability actually exposes regulated records.
Upwind and Matters.AI developed a native API integration to bridge runtime execution directly with semantic data classification. By combining workload context with data protection, this integration creates a unified control plane across the cloud environment.
Correlating Active Workload Execution with Sensitive Asset Inventories
Upwind continuously monitors cloud infrastructure and workloads at the kernel level using lightweight eBPF sensors. It tracks processes, network sockets, syscalls, and active attack paths to establish baselines and identify vulnerabilities that are actively executing in production.
At the same time, Matters.AI operates to discover, classify, and track data assets across cloud object stores, SaaS applications, databases, and endpoints. Its five-layer classification pipeline extracts readable content, detects sensitive entities, validates each entity in context, and classifies documents with 95%+ accuracy and an MTTR of 4 minutes. The platform maps object lineage, query-level activity, and record sensitivity for assets including PII, health records, proprietary source code, and customer IP.
Through this API connector, runtime security findings flagged by Upwind automatically map directly to data classification outputs inside Matters.AI. The joint solution links infrastructure findings to business impact, allowing security teams to confirm whether an exposed container holds an active execution path to a database containing regulated records.
Technical Capabilities and Joint Mechanics
- Exploit-Aware Data Prioritization: Upwind’s eBPF telemetry tracks running container states, process executions, and open network sockets. Matters.AI joins those runtime execution paths onto its five-layer classification pipeline. Detections are prioritized when an actively executing, internet-exposed workload holds live permissions to a database containing classified business data.
- Reduction of Non-Executable Alerts: Integrating build-time configurations, live kernel syscalls, and data valuation filters out non-running CVEs, dormant configuration anomalies, and unexploited misconfigurations on idle systems.
- Streamlined Triage and Blast Radius Mapping: When Upwind flags anomalous process behavior or an unauthorized network socket on a workload, Matters.AI’s Database Activity Monitoring provides query-level visibility into who touched regulated data. The system traces the full path from the initial application threat vector down to the targeted database ARN, allowing responders to execute targeted containment.
- Bidirectional Posture Convergence: When Matters.AI identifies a newly created or unencrypted datastore, Upwind references its live runtime topology map to locate every workload currently holding open handles or active socket connections to that resource.
- Single Exposure Queue: Matters.AI ingests Upwind configuration findings on a 24-hour cycle, maps them to its own misconfiguration taxonomy, and joins each finding to classification output for the affected datastore. Where Upwind is authoritative for an account, Matters.AI suppresses its native posture results so security teams work off one exposure queue ranked by record count and real blast radius.
- Consolidated Compliance Evidence: Upwind maps infrastructure controls to frameworks like PCI DSS and NIST SP 800-53, while Matters.AI adds real classification output, consent records, and access history. This produces a unified evidence set covering infrastructure and data controls for DPDPA, PCI DSS, SOC 2, HIPAA, and GDPR.
Deployment Architecture and Cloud Connector
The integration runs without secondary cloud account onboarding or second agent rollouts. Customers connect their Upwind organization to Matters.AI by supplying Client ID, Client Secret, and Org ID inside the Upwind console.
Matters.AI ingests the posture and configuration data Upwind has already computed rather than requiring AWS, GCP, and Azure accounts to be connected to a second scanner. All scanning and classification within Matters.AI happens locally inside the customer’s infrastructure, ensuring raw data never leaves the customer environment while operational metadata is exchanged via secure API connections.
