Security risk has a new starting point. It is not a misconfigured cloud storage bucket. It is not an exposed API endpoint. Increasingly, it is a developer laptop running AI agents, connected to MCP servers, quietly executing actions across SaaS platforms and cloud infrastructure with permissions that most security teams cannot see.
Upwind Security has announced an AI Sensor for Endpoints designed to bring that activity into view. The new capability extends Upwind’s cloud and AI security platform to cover developer workstations and laptops, creating what the company describes as a unified view of AI activity from the endpoint to the cloud.
AI Has Moved the Perimeter
The conversation about AI security has largely focused on the cloud: securing AI workloads, protecting model APIs, monitoring inference pipelines. Those are legitimate concerns. But they describe only part of where AI actually runs in a modern enterprise.
Developers today build with AI tools locally. They run agents on their own machines. They connect those agents to MCP servers that reach into SaaS platforms, cloud services, and internal tooling. The laptop is no longer a passive device that occasionally connects to corporate resources. It is an active participant in workflows that span an organization’s entire technology stack.
When a device in that position is compromised, the damage is not localized. The attacker inherits whatever the device was connected to, whatever tokens it was holding, and whatever automated actions it was capable of initiating.
What Upwind Is Announcing
The AI Sensor for Endpoints gives security teams the ability to monitor MCP connections initiated from developer endpoints in real time. It correlates that endpoint activity with cloud identity and action data, and it detects anomalous AI-driven actions across SaaS and cloud platforms.
The result is that endpoint activity and cloud activity land in a single, unified view rather than being split across disconnected tools that security teams have to manually correlate. Identities, actions, prompts, and infrastructure context all appear together.
Upwind CEO Amiram Shachar described the shift in how cloud risk needs to be understood: “In the new world of AI Agents and MCP servers, the cloud risk extended to the edge, where tokens, permissions, and cloud actions are now taken automatically from the developers’ workstations. To truly protect the cloud, we must help security teams see the journey from the endpoint.”
The MCP Factor
Model Context Protocol connections are at the center of why this matters. MCP has become a standard integration layer for AI agents, allowing tools and models to reach across platforms and execute actions. It has also made the devices running those agents significantly more consequential from a security perspective.
A developer laptop connected to MCP servers is not just a workstation. It is a node in a distributed system that touches cloud infrastructure, SaaS applications, and potentially sensitive data across all of them. The permissions that laptop holds do not stay on the laptop. They extend into every platform the MCP connections reach.
Security teams with no visibility into those connections are operating with a significant blind spot, and one that grows more dangerous as AI adoption accelerates and more workflows move through agent-to-server architectures.
A Platform Response to a Platform Problem
Upwind built its platform around runtime-powered cloud security, using live behavioral data rather than static configuration analysis. The AI Sensor for Endpoints extends that approach to the device layer, pulling endpoint signals into the same platform that already covers cloud workloads.
The logic is straightforward: if the threat path now starts at the endpoint, security visibility needs to start there too. A cloud security platform that cannot see what developer laptops are doing cannot give security teams an accurate picture of their actual risk.
This is a structural change in how enterprise security coverage needs to be designed, and Upwind’s announcement is a direct response to it. The boundary between endpoint security and cloud security has been eroding for years. AI agents and MCP-connected workloads have made that boundary essentially meaningless as an operational concept.
For security teams still managing endpoint visibility and cloud visibility as separate concerns, the gap between what they can see and what is actually happening in their environment has never been larger. Closing that gap is what the AI Sensor for Endpoints is built to do.
