Sweet Security Brings Runtime-CNAPP Power to Windows

Sweet Security has extended its Runtime CNAPP sensor to Windows, bringing the same deep visibility, real-time detection, risk prioritisation, and automated investigation from Linux to one of the most widely used enterprise operating systems.

The Windows sensor was developed in Rust to minimise resource footprint and covers common attack vectors such as DLL injection, registry manipulation, and PowerShell scripting, while also inspecting Layer 7 application data and correlating it with cloud audit logs and cloud identities (CDR and ITDR).

According to CyberNewsWire, in a recent customer evaluation the Windows sensor identified a credential-dumping attempt within seconds, linking PowerShell execution, registry export, and file-creation anomalies that other sensors missed, with the full investigation from detection to resolution taking under two minutes.

Sweet says the Windows extension maintains its behavioural baselining and LLM-powered correlation to provide rapid, context-rich insights across all cloud workloads, enabling faster threat detection and response. The release adds full CNAPP coverage including CADR, CSPM, KSPM, CIEM, API Security, and ITDR among others, reinforcing Sweet’s aim of universal runtime protection across cloud environments. According to CyberNewsWire.