diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index cc6abb7ae3e64..0f40abded6f50 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -585,6 +585,7 @@
 /test/new-e2e/tests/orchestrator              @DataDog/container-app
 /test/new-e2e/tests/process                   @DataDog/processes
 /test/new-e2e/tests/sysprobe-functional     @DataDog/windows-kernel-integrations
+/test/new-e2e/tests/security-agent-functional     @DataDog/windows-kernel-integrations
 /test/new-e2e/tests/cws                       @DataDog/agent-security
 /test/new-e2e/tests/agent-metrics-logs   @DataDog/agent-metrics-logs
 /test/new-e2e/tests/windows                   @DataDog/windows-agent @DataDog/windows-kernel-integrations
diff --git a/test/new-e2e/tests/security-agent-functional/security_agent_test.go b/test/new-e2e/tests/security-agent-functional/security_agent_test.go
new file mode 100644
index 0000000000000..283e622f4c913
--- /dev/null
+++ b/test/new-e2e/tests/security-agent-functional/security_agent_test.go
@@ -0,0 +1,98 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+package secagentfunctional
+
+import (
+	"flag"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/DataDog/datadog-agent/test/new-e2e/pkg/e2e"
+	"github.com/DataDog/datadog-agent/test/new-e2e/pkg/environments"
+	awshost "github.com/DataDog/datadog-agent/test/new-e2e/pkg/environments/aws/host"
+	"github.com/DataDog/datadog-agent/test/new-e2e/tests/windows"
+	windowsCommon "github.com/DataDog/datadog-agent/test/new-e2e/tests/windows/common"
+	windowsAgent "github.com/DataDog/datadog-agent/test/new-e2e/tests/windows/common/agent"
+	componentsos "github.com/DataDog/test-infra-definitions/components/os"
+	"github.com/DataDog/test-infra-definitions/scenarios/aws/ec2"
+	"github.com/stretchr/testify/require"
+)
+
+type vmSuite struct {
+	e2e.BaseSuite[environments.Host]
+
+	testspath string
+}
+
+var (
+	devMode = flag.Bool("devmode", false, "run tests in dev mode")
+)
+
+func TestVMSuite(t *testing.T) {
+	suiteParams := []e2e.SuiteOption{e2e.WithProvisioner(awshost.ProvisionerNoAgentNoFakeIntake(awshost.WithEC2InstanceOptions(ec2.WithOS(componentsos.WindowsDefault))))}
+	if *devMode {
+		suiteParams = append(suiteParams, e2e.WithDevMode())
+	}
+
+	e2e.Run(t, &vmSuite{}, suiteParams...)
+}
+
+func (v *vmSuite) SetupSuite() {
+	t := v.T()
+
+	// Get the absolute path to the test assets directory
+	currDir, err := os.Getwd()
+	require.NoError(t, err)
+
+	reporoot, _ := filepath.Abs(filepath.Join(currDir, "..", "..", "..", ".."))
+	kitchenDir := filepath.Join(reporoot, "test", "kitchen", "site-cookbooks")
+	v.testspath = filepath.Join(kitchenDir, "dd-security-agent-check", "files", "tests")
+}
+
+func (v *vmSuite) TestSystemProbeCWSSuite() {
+	v.BaseSuite.SetupSuite()
+	t := v.T()
+	// get the remote host
+	vm := v.Env().RemoteHost
+
+	rs := windows.NewRemoteExecutable(vm, t, "testsuite.exe", v.testspath)
+	err := rs.FindTestPrograms()
+	require.NoError(t, err)
+
+	err = rs.CreateRemotePaths()
+	require.NoError(t, err)
+
+	err = rs.CopyFiles()
+	require.NoError(t, err)
+
+	// install the agent (just so we can get the driver(s) installed)
+	agentPackage, err := windowsAgent.GetPackageFromEnv()
+	require.NoError(t, err)
+	remoteMSIPath, err := windowsCommon.GetTemporaryFile(vm)
+	require.NoError(t, err)
+	t.Logf("Getting install package %s...", agentPackage.URL)
+	err = windowsCommon.PutOrDownloadFile(vm, agentPackage.URL, remoteMSIPath)
+	require.NoError(t, err)
+
+	err = windowsCommon.InstallMSI(vm, remoteMSIPath, "", "")
+	t.Log("Install complete")
+	require.NoError(t, err)
+
+	time.Sleep(30 * time.Second)
+	// disable the agent, and enable the drivers for testing
+	_, err = vm.Execute("stop-service -force datadogagent")
+	require.NoError(t, err)
+	_, err = vm.Execute("sc.exe config datadogagent start= disabled")
+	require.NoError(t, err)
+	_, err = vm.Execute("sc.exe config ddnpm start= demand")
+	require.NoError(t, err)
+	_, err = vm.Execute("start-service ddnpm")
+	require.NoError(t, err)
+
+	rs.RunTests("5m") // security agent tests can take a while waiting for ETW to start.
+}
diff --git a/test/new-e2e/tests/sysprobe-functional/sysprobe_test.go b/test/new-e2e/tests/sysprobe-functional/sysprobe_test.go
index 12b0790ff9110..190e2cfffa937 100644
--- a/test/new-e2e/tests/sysprobe-functional/sysprobe_test.go
+++ b/test/new-e2e/tests/sysprobe-functional/sysprobe_test.go
@@ -56,7 +56,7 @@ func (v *vmSuite) SetupSuite() {
 	v.testspath = filepath.Join(kitchenDir, "dd-system-probe-check", "files", "default", "tests")
 }
 
-func (v *vmSuite) TestSystemProbeSuite() {
+func (v *vmSuite) TestSystemProbeNPMSuite() {
 	v.BaseSuite.SetupSuite()
 	t := v.T()
 	// get the remote host
@@ -127,5 +127,5 @@ func (v *vmSuite) TestSystemProbeSuite() {
 	_, err = vm.Execute("start-service ddnpm")
 	require.NoError(t, err)
 
-	rs.RunTests()
+	rs.RunTests("")
 }
diff --git a/test/new-e2e/tests/windows/remoteexecutable.go b/test/new-e2e/tests/windows/remoteexecutable.go
index 1873cac3c2de3..680dea998e3cb 100644
--- a/test/new-e2e/tests/windows/remoteexecutable.go
+++ b/test/new-e2e/tests/windows/remoteexecutable.go
@@ -115,7 +115,12 @@ func (rs *RemoteExecutable) CopyFiles() error {
 
 // RunTests iterates through all of the tests that were copied and executes them one by one.
 // it captures the output, and logs it.
-func (rs *RemoteExecutable) RunTests() error {
+func (rs *RemoteExecutable) RunTests(timeoutarg string) error {
+
+	if timeoutarg == "" {
+		timeoutarg = "2m"
+	}
+	tmo := "\"-test.timeout=" + timeoutarg + "\""
 
 	for _, testsuite := range rs.testfiles {
 		rs.t.Logf("Running testsuite: %s", testsuite)
@@ -123,7 +128,7 @@ func (rs *RemoteExecutable) RunTests() error {
 
 		// google test programs compiled in this way run with no timeout by default.
 		// don't allow an individual test to take too long
-		executeAndLogOutput(rs.t, rs.vm, remotePath, "\"-test.v\"", "\"-test.timeout=2m\"")
+		executeAndLogOutput(rs.t, rs.vm, remotePath, "\"-test.v\"", tmo)
 	}
 	return nil
 }