Palo Alto Networks Cortex Cloud API Security vs Upwind CNAPP
Palo Alto Networks Cortex Cloud API Security
paloaltonetworks.com
Upwind CNAPP
upwind.ioSide by side
| Figure | Palo Alto Networks Cortex Cloud API Security | Upwind CNAPP |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | Yes |
| Plans published | 0 | 0 |
| Spec score · Cloud-Native Application Protection Platforms | 7.3 (#10) | 7.0 (#12) |
| Deployment | The product offers agentless gateway integrations and agent-based protection through the Cortex XDR agent for Linux workloads. | The Outpost deployment model runs cloud scanners inside the customer’s AWS environment. |
| Founded | 2005 | 2022 |
| Headquarters | Santa Clara, California, USA | San Francisco, California, United States |
| Intended users | The documentation identifies SOC analysts, security practitioners, and workload owners as roles involved in API security. | Upwind describes the platform as serving security teams across development, cloud, runtime, and SOC workflows. |
In their own words
Palo Alto Networks Cortex Cloud API Security
Palo Alto Networks Cortex Cloud API Security discovers, ranks, and protects APIs across cloud environments. It can find and validate APIs across gateways, workloads, and cloud environments, including shadow, zombie, and unmanaged APIs. Configuration and traffic context inform risk rankings based on severity and potential business impact. Risk insights cover internet exposure, sensitive data transmission, weak authentication, missing encryption, and specification drift. The product describes real-time protection against OWASP API Top 10 threats, including injection, authentication bypass, and data exposure; teams can use monitor or blocking modes. Agentless integrations are listed for AWS API Gateway, Azure APIM, GCP Apigee, and Kong. Linux workload protection uses an agent and is marked Beta. Teams can import OpenAPI specifications to check live traffic for deviations and scan for misconfigurations or vulnerabilities. Azure APIM integration requires the Data Collection add-on and a running Azure APIM service. Cortex CLI scans require an OpenAPI file and Java 11 or later, while Web and API Security requires the Runtime Security add-on. Pricing is on request; the product page offers a demo request.
Upwind CNAPP
Upwind CNAPP brings application security, cloud security posture, and real-time protection together across the cloud lifecycle, from development through production. Agentless cloud scanners and runtime sensors build live inventory, identify exposures, and protect workloads as they run. Listed capabilities include CSPM, CIEM, DSPM, AI-SPM, attack path analysis, vulnerability management, Kubernetes and serverless security, API security, DAST, and cloud detection and response. Upwind describes live inventory and high-signal exposure prioritization as ways to focus on exposures. The platform supports AWS, Google Cloud, Microsoft Azure, and Oracle Cloud, and is available through web and API. Its integrations directory includes tools such as Jira, Slack, GitHub Actions, GitLab, and Argo CD, as well as ChatGPT, xAI Grok, OpenAI Enterprise, Anthropic Enterprise, and Claude. Upwind says stored data is protected with encryption, access controls, and authentication, and data in transit with TLS and HSTS. The Trust Center lists SOC 2 Type 2, ISO/IEC 27001:2022, and GDPR. Pricing is on request; the CNAPP page invites prospective customers to request a demo.