Two mechanisms carry this, and they have little to do with each other.
The commercial one is a meter. Upwind brought its full portfolio into Extended with aggressive pay-as-you-go pricing from day one and aligned its field organisation on joint deal flow [3], and Upwind co-founder and CEO Amiram Shachar describes the customer-side payoff as billing, support and operations that match what customers already know from AWS [8]. Pay-as-you-go against an account you already own changes what you are approving: a meter, sitting on top of billing you already have. The post does not say who owns the ticket when a sensor misbehaves, and "same support path" can mean AWS triages it, or it can mean AWS routes you to Upwind with an account manager attached. Those are different operational models, and the difference is worth pinning down before the meter starts.
The technical one is a schema. Findings arrive in Security Hub as OCSF records and are correlated and prioritised there before routing to downstream tools [6], and that is the entire basis for AWS saying these solutions work together without you building the integrations [7]. For that to hold in your environment, the fields your downstream rules key on have to survive normalisation. Runtime evidence is the awkward case, because process ancestry and container identity are the parts most likely to land in an extension the receiving rule never reads. One finding and one query settles it, and I would settle it before believing the build-to-runtime-to-triage example the post walks through with Chainguard, Upwind and Splunk [5].
Then the ranking. AWS says Upwind has driven more customer activity and closed deals than any other partner [2], engaged faster than any other partner in the program [4], and that the joint deals are multi-million dollar, with one enterprise customer recently replacing its incumbent CNAPP with Upwind [9]. There is no deal count and no partner list [10]. Counting the vendors the post itself places inside Extended gets to four: Upwind, Chainguard, Splunk and 7AI [11][12]. First place in a field you cannot enumerate is a softer number than it looks.
The two products also do not adopt the same way. Security Hub Essentials covers posture management and vulnerability scanning [13]; Upwind's stated differentiator is an eBPF sensor in the Linux kernel that watches process behaviour, network connections, API calls and container interactions continuously [14]. Posture reads APIs and lands per account. A kernel sensor lands per host, so the unit of work is node coverage and kernel compatibility. Pay-as-you-go removes the purchase order. The rollout still has to happen. AWS also says the runtime view cuts alert noise dramatically [15]. That is a claim about someone else's alert volume, and it transfers only if your noise comes from vulnerabilities in code that never gets loaded, rather than from misconfiguration you have already decided to live with.
What I take at face value is the invitation. A vendor that overlaps AWS's own capabilities brought its own pricing and its own pipeline into the program [1][3], and AWS published that it out-closed everyone else [2]. That is an expensive thing to write down if the channel is not working.
