Feed
Grid
Introducing the Upwind Blue Agent: Autonomous Threat Investigation for the SOC
We’re excited to announce that the Upwind Blue Agent is now available in Beta. The Blue Agent is an AI-powered SOC investigator that autonomously investigates Upwind Threat Stories end to end. It gathers and correlates security context across the customer environment, evaluates the available evidence, and delivers one of three clear verdicts: Each verdict includes…
AI Will Make Software More Secure. The Transition Won’t Be Pretty
I believe AI is going to make us much more secure. But probably not tomorrow. In fact, I think the next two years may be exactly the opposite: attackers will have the upper hand before defenders eventually turn the economics of cybersecurity in their favor. For decades, we have built software with vulnerabilities and then…
Vulnerability Management Requires Real-Time Intelligence
Security teams aren't short on data. But they’re often short on context and time. The average vulnerability management program is buried in alerts, running on scan results that are hours or days old, and facing both savvy and unskilled attackers that can leverage AI to develop sophisticated exploits in minutes. That combination is why backlogs…
Upwind Launches Malware Scanning for Cloud Storage Across AWS, Azure, and GCP
Cloud object storage plays a central role in modern applications. Buckets are used to store application assets, exchange files, manage backups, build data pipelines, and share information across services and teams. That flexibility also makes object storage an attractive attack vector. A malicious file uploaded to a bucket can introduce risk into downstream applications, workloads,…
Validate the Real-World Exposure of Your APIs with Upwind Attack Surface Management
Your APIs are probably the least-monitored component of your attack surface. They multiply faster than any team can document, and most scanners only ever pick up the ones you already know about. But that gap just got smaller. Upwind’s Attack Surface Management capabilities now provide a unified view of cloud and API exposure, helping security…
Metabase Instances Actively Exploited: Unauthenticated Admin Takeover via BI Layer Reset Password SQL Injection (CVE-2026-72898)
Executive Summary Upwind recently observed multiple Advanced Persistent Threat (APT) groups actively exploiting CVE-2026-72898. This vulnerability - an unauthenticated SQL injection in the Metabase password reset endpoint carrying a critical CVSS score of 10.0, was actively exploited as a zero-day before a patch became available. An unauthenticated remote attacker can craft a malicious SQL injection…
Why Buyers Remember Solving a Demo, Not Watching One
Key Takeaways I recently sat down with Upwind Solutions Architect, Evan Grace to learn more about his process. After some intros, he told me about his new hobby, hydroponics. For those who don’t know, hydroponics is a method of growing plants without soil. This was unbelievable to me but after Evan explained his deep dive…
Upwind Integrates with PagerDuty for Instant Incident Response
Upwind now integrates with PagerDuty, enabling security teams to create workflows that automatically route Upwind findings and detections to the appropriate on-call team based on existing incident management workflows. This integration expands Upwind's growing library of native workflow integrations, giving security and platform teams even more ways to turn real-time detections into immediate action. What's…
Everyone Read the OpenAI Breach as a Model Story, But It Was a Runtime Story
Key Takeaways Autonomous AI agents can now break out of a sandbox, cross an internal network, and breach a production system with no human at the keyboard. OpenAI's evaluation that hacked Hugging Face this month is the clearest proof on record. Most of the coverage read it as a story about a model turning dangerous.…
Introducing the Upwind Identity Graph: End-to-End Identity Security
Identity used to be treated as a directory problem: find the user, inspect the groups, review the assigned roles, and decide whether the account has too much access. That model no longer matches the cloud. A single person may authenticate through Okta, inherit permissions from multiple groups, receive role assignments in more than one cloud,…
Introducing the Upwind AI Graph: Extending AI Inventory Beyond Cloud Infrastructure
As enterprise adoption of artificial intelligence accelerates, modern AI infrastructure has expanded far beyond traditional cloud perimeters. Securing enterprise AI today requires complete visibility across four distinct operational layers: Traditional cloud security tools stop at the cloud provider boundary. When enterprise teams connect directly to external AI Providers, security teams lose sight of access paths,…
Keyv Supply Chain Compromise: An npm Worm That Takes Its Orders From an Ethereum Smart Contract
Executive Summary On August 4, 2026 at 09:35 UTC, [email protected] was published to npm carrying a credential stealer, an npm worm, and a persistence mechanism designed to detonate during incident response. Keyv ranks #274 by npm reach and is present in 84,759 customer environments, and the release shipped with valid GitHub OIDC provenance and a…
Introducing the Upwind Blue Agent: Autonomous Threat Investigation for the SOC
We’re excited to announce that the Upwind Blue Agent is now available in Beta. The Blue Agent is an AI-powered SOC investigator that autonomously investigates Upwind Threat Stories end to end. It gathers and correlates security context across the customer environment, evaluates the available evidence, and delivers one of three clear verdicts: Each verdict includes…
Latest
AI Will Make Software More Secure. The Transition Won’t Be Pretty
I believe AI is going to make us much more secure. But probably not tomorrow. In fact, I think the next two years may be exactly the opposite: attackers will have the upper hand before defenders eventually turn the economics of cybersecurity in their favor. For decades, we have built software with vulnerabilities and then…
Vulnerability Management Requires Real-Time Intelligence
Security teams aren't short on data. But they’re often short on context and time. The average vulnerability management program is buried in alerts, running on scan results that are hours or days old, and facing both savvy and unskilled attackers that can leverage AI to develop sophisticated exploits in minutes. That combination is why backlogs…
Upwind Launches Malware Scanning for Cloud Storage Across AWS, Azure, and GCP
Cloud object storage plays a central role in modern applications. Buckets are used to store application assets, exchange files, manage backups, build data pipelines, and share information across services and teams. That flexibility also makes object storage an attractive attack vector. A malicious file uploaded to a bucket can introduce risk into downstream applications, workloads,…
Validate the Real-World Exposure of Your APIs with Upwind Attack Surface Management
Your APIs are probably the least-monitored component of your attack surface. They multiply faster than any team can document, and most scanners only ever pick up the ones you already know about. But that gap just got smaller. Upwind’s Attack Surface Management capabilities now provide a unified view of cloud and API exposure, helping security…
Metabase Instances Actively Exploited: Unauthenticated Admin Takeover via BI Layer Reset Password SQL Injection (CVE-2026-72898)
Executive Summary Upwind recently observed multiple Advanced Persistent Threat (APT) groups actively exploiting CVE-2026-72898. This vulnerability - an unauthenticated SQL injection in the Metabase password reset endpoint carrying a critical CVSS score of 10.0, was actively exploited as a zero-day before a patch became available. An unauthenticated remote attacker can craft a malicious SQL injection…
Why Buyers Remember Solving a Demo, Not Watching One
Key Takeaways I recently sat down with Upwind Solutions Architect, Evan Grace to learn more about his process. After some intros, he told me about his new hobby, hydroponics. For those who don’t know, hydroponics is a method of growing plants without soil. This was unbelievable to me but after Evan explained his deep dive…
Upwind Integrates with PagerDuty for Instant Incident Response
Upwind now integrates with PagerDuty, enabling security teams to create workflows that automatically route Upwind findings and detections to the appropriate on-call team based on existing incident management workflows. This integration expands Upwind's growing library of native workflow integrations, giving security and platform teams even more ways to turn real-time detections into immediate action. What's…
Everyone Read the OpenAI Breach as a Model Story, But It Was a Runtime Story
Key Takeaways Autonomous AI agents can now break out of a sandbox, cross an internal network, and breach a production system with no human at the keyboard. OpenAI's evaluation that hacked Hugging Face this month is the clearest proof on record. Most of the coverage read it as a story about a model turning dangerous.…
Introducing the Upwind Identity Graph: End-to-End Identity Security
Identity used to be treated as a directory problem: find the user, inspect the groups, review the assigned roles, and decide whether the account has too much access. That model no longer matches the cloud. A single person may authenticate through Okta, inherit permissions from multiple groups, receive role assignments in more than one cloud,…
Introducing the Upwind AI Graph: Extending AI Inventory Beyond Cloud Infrastructure
As enterprise adoption of artificial intelligence accelerates, modern AI infrastructure has expanded far beyond traditional cloud perimeters. Securing enterprise AI today requires complete visibility across four distinct operational layers: Traditional cloud security tools stop at the cloud provider boundary. When enterprise teams connect directly to external AI Providers, security teams lose sight of access paths,…
Keyv Supply Chain Compromise: An npm Worm That Takes Its Orders From an Ethereum Smart Contract
Executive Summary On August 4, 2026 at 09:35 UTC, [email protected] was published to npm carrying a credential stealer, an npm worm, and a persistence mechanism designed to detonate during incident response. Keyv ranks #274 by npm reach and is present in 84,759 customer environments, and the release shipped with valid GitHub OIDC provenance and a…
Upwind Code Brings Cloud Security Into the Development Control Plane
Cloud applications begin long before they reach the cloud. Source code, open-source dependencies, infrastructure definitions, container images and pull requests all shape what will eventually run in production. Yet these layers are often secured separately. Software Composition Analysis (SCA) tools inspect dependencies, Infrastructure as Code (IaC) scanners inspect configuration files, container scanners inspect artifacts and…