Uptycs is a security company for organisations running large hybrid cloud estates, where virtual machines, containers, Kubernetes, cloud services and laptops all need watching at once. It collects deep system telemetry from all of them into one queryable data layer, then uses that data for cloud posture, workload protection, detection and response, and AI-assisted investigation.
The company started from osquery, the open source endpoint telemetry framework, and still builds on it.
At A Glance
| Vendor | Uptycs |
|---|---|
| Category | Endpoint Security; Cloud Security |
| Deployment | Agentless cloud scanning, eBPF runtime insights, osquery-based endpoint telemetry |
| Agentic AI | Juno AI Analyst and Juno AI Connectors |
| Customers | Lookout, Wix, Nutanix, SAP, Circle |
| Founded | 2016 |
| Market classification | Endpoint Security; also Cloud Security |
What Uptycs Does
Security teams in hybrid environments usually stitch together separate tools for cloud posture, container security and endpoint detection, each with its own data. Uptycs takes the opposite approach and puts one telemetry base underneath everything. System data from endpoints and workloads is made queryable with SQL at enterprise scale, so the same records serve compliance checks, threat hunting and incident response. The CNAPP handles cloud risk from build time to runtime, XDR handles detection and response across cloud, endpoint and identity signals, Nexus holds and enriches the data, and Juno investigates over it.
Products
CNAPP
The CNAPP is the cloud security product. It brings together workload protection, posture management, risk and compliance, vulnerability management, container and Kubernetes security, cloud detection and response and data security posture management. It suits cloud and platform teams who need to know which workloads carry the most risk and why.
- Agentless scanning with eBPF-based runtime insights
- Unified risk scoring per workload and attack-path mapping to critical assets
- Build-to-runtime provenance that traces a runtime threat back to committed code or a third-party dependency
- Build-time scanning of AMIs, container images, infrastructure as code and code repositories
XDR
XDR is detection and response for endpoints and cloud workloads, aimed at security operations teams that want to hunt and contain threats without a second agent estate. It ships with behavioural detections that teams can tune, and can block malicious binaries and suspicious domain requests or run remediation scripts automatically.
- File integrity monitoring, YARA rule support and forensic investigation
- Continuous vulnerability scanning and device risk scoring
- A managed detection and response (MDR) service
Juno AI Analyst
Juno plans and runs investigations from start to finish on the unified data, and returns answers an analyst can check.
Nexus And Osquery Fleet Management
Nexus is the telemetry layer that normalises, enriches and queries security data from many sources at cloud scale. Osquery Fleet Management gives operations teams distributed system monitoring and real-time querying across their osquery fleet.
How It Works
| Component | What it does |
|---|---|
| Telemetry foundation | Endpoints and workloads report system data through osquery, and that data can be queried with SQL. |
| Cloud workloads | Cloud environments on AWS, Microsoft Azure, Google Cloud and IBM Cloud are covered by agentless scanning, with eBPF-based runtime insights for continuous workload visibility. |
| Endpoints | macOS, Windows and Linux endpoints are supported, along with IBM Power, Linux on Z, LinuxONE and AIX systems. |
| Data and investigation | Nexus normalises and enriches the telemetry and Juno investigates over it. The design is API-first and standards-based so it can sit alongside an existing toolchain. |
Agentic AI Capabilities
Verifiable Investigations
Juno shows the SQL queries it ran and the raw log data it examined for each answer, so analysts can review the evidence rather than trust a summary. Given a CVE or a package list, Juno can build and run the queries that identify exposure across the estate. It reasons across roughly 3,000 tables and 150,000 columns of telemetry and runs on Anthropic’s Claude through AWS Bedrock, with customer telemetry kept out of model training.
Juno AI Connectors
Juno AI Connectors link other security tools into Juno so that one investigation can draw evidence from several sources. Ask Uptycs adds a question-driven investigation aid inside the CNAPP.
Company Background
| Founded | 2016 |
|---|---|
| Headquarters | Lexington, Massachusetts, with offices in Bengaluru and Pune, India |
| Founders | Ganesh Pai (Founder and CEO), Uma Reddy (Founder and Chief Product Officer) and Mike Hluchyj (Founder and Board Member) |
| Leadership | Kevin Durkin (CFO) |
| Funding | Has raised a reported $93 million; investors include Sapphire Ventures, Norwest Venture Partners, ServiceNow Ventures, Comcast Ventures and ForgePoint Capital, and Comcast was an early investor and customer |
| Recognition | Included in the EDR Telemetry Project comparison |
Note: This overview is compiled from Uptycs’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.