Databricks permissions now trace to the cloud resources they actually reach.  Ask a Databricks admin who can read a given catalog and you'll get an answer. Ask what that access reaches in your cloud account and nobody can tell you, because Databricks doesn't track it. Unity Catalog ends at the storage credential, and what sits…

Introduction Teams are starting to let AI agents fix their cloud findings. What nobody has measured is whether those changes are safe to run. So we built a live AWS account, broke it on purpose in eighteen ways that chain into nine attack paths, and gave twelve AI models read-only access to it with one…

Upwind is partnering with Cursor Origin to secure every change pushed to the repository, whether a human or an agent wrote it. Upwind now scans code in Origin. Every pull request and every push to the default branch is checked automatically, with findings delivered as pull request comments, checks, and alerts in the Upwind console.…

A first look at 10,000 workstations We analyzed AI agent activity across 10,000 workstations at Upwind customers in the United States and Europe. This post is a sneak peek at the findings ahead of the full report. The short version: agent adoption has already moved past the point where an approval process can catch up…

On October 5, 2026, Atlassian issued an emergency out-of-band security advisory for CVE-2026-21589, a critical vulnerability impacting eight self-hosted Atlassian Data Center and Server product suites - including Jira Software, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Fisheye, and Crucible. The flaw allows an unauthenticated remote attacker to read sensitive internal files within the application's…

Reaching 100+ integrations with The Lineup at Upwind is a milestone I’m incredibly proud of. But when I think about what it took to get here, the number itself isn’t the most interesting part. The interesting part is what happens along the way. You start by building integrations. Then customers introduce new use cases. Partners…

Introduction In the first eight months of 2026, a Russian-speaking threat actor who had built a career on hotel-booking and fintech platforms turned to AI companies. The technique they used against one AI vendor did not involve any exploit. Like most AI vendors, the target ran an automated evaluation sandbox, an agent pipeline that reads…

Ask a security team where the company's most sensitive data lives and they'll say Snowflake without pausing. Ask who can reach it and the room goes quiet, because that answer belongs to the data team. It isn't negligence, it's vocabulary. Snowflake speaks in roles, grants, warehouses and schemas. Your cloud security program speaks in IAM,…

Every IAM policy you write depends on condition keys - they're the precision layer that turns "can call S3" into "can call S3 only from our VPC, using our identity, on resources we own." They're the backbone of least-privilege, data perimeters, and SCP guardrails. But here's the thing: for every request, the IAM engine assembles…

The management account is the most privileged account in any AWS Organization. It controls SCPs, creates and deletes member accounts, manages IAM Identity Center, and is itself exempt from SCPs. Getting its 12-digit account ID is the first step in targeting it. The documented way to get it is organizations:DescribeOrganization - but security-conscious environments restrict…

Compliance should not be a fire drill! Ask a security team how audit season goes and you will often hear a version of the same story. Someone pulls a list of cloud accounts. Someone else exports findings into a spreadsheet that is already outdated by the time it is shared. Screenshots get pasted into a…

In the previous post, we mapped 36 condition keys that the IAM engine evaluates but has never documented. The decomposition model, the service-specific resource identifiers, the organizational metadata - all of it sitting in the request context, invisible unless you probe for it. That post was about discovery. This one is about what you can…