Feed
Upwind Feed
Feed
Grid
Thought Leadership
April 29, 2026
The exploit window didn’t shrink. It flipped.
TL;DR: Time-to-Exploit (TTE), the gap between vulnerability disclosure and first observed exploitation, has gone negative. Mandiant's M-Trends 2026 report shows attackers now exploit vulnerabilities, on average, before a patch is publicly available and we see the same in running environments. That breaks the foundational assumption every legacy CNAPP architecture was built on — that defenders…
April 27, 2026
For the first time in 30 years, cybersecurity defenders might actually be winning
Everyone is catastrophizing about AI-powered attacks. Here's the contrarian case, and why the window is narrower than it looks. TL;DR: The prevailing narrative at Black Hat 2025 was that AI has made attackers unstoppable. The most credentialed voice in the room said the opposite, and the data backs him up. The Mythos release through Project…
April 22, 2026
The Real Shift Underneath Mythos
Key Takeaways Anthropic's Mythos model has been called a cybersecurity watershed and a marketing stunt in the same week. Both camps have a point. Mythos appears to represent a real capability gain, and Anthropic deserves credit for releasing it through Project Glasswing rather than dropping it in the wild. At the same time, independent replication…
April 21, 2026
We’ve Been Here Before and We Knew It Was Coming
The AI security industry is calling 2025 the new 1990s. The uncomfortable truth is that we predicted every mistake we're making right now — and made them anyway. TL;DR: AI security in 2025 is repeating the same structural mistakes that made the early internet a golden age for hackers — not because the industry forgot…
April 13, 2026
RSAC 2026 from the floor: What an AE heard between the keynotes and the handshakes
RSAC 2026 drew 43,500 attendees, 600+ exhibitors, and enough AI announcements to fill a small data lake. But the conversations that mattered most didn't happen on the main stage. They happened in hallway pull-asides, over bad coffee, at HH and during blunt one-on-ones with security leaders who are done being marketed to and ready to…
April 10, 2026
Agentic Security Is Here — But Who Is Accountable When the AI Acts Alone?
TL;DR: Agentic security is the use of autonomous AI systems that detect, triage, and respond to threats without human intervention, which introduces a new category of operational risk. The most valuable security skill in 2026 is not prompt engineering or AI fluency. It’s consequence engineering: the ability to anticipate what happens when an autonomous system…
February 27, 2026
Why Context-First Data Is the Future of Cloud Security
The Problem Nobody Wants to Admit More data doesn’t automatically mean better security. It often means more homework. Anyone who has sat in a security engineering seat knows the drill: map private to public IPs, line up container IDs with hosts, connect GUIDs to service accounts, and reconcile correlation IDs across distributed apps. Each source…
January 22, 2026
An Engineer’s Journey from Heavy Runtime Agents to Agentless, and a Hybrid Future
Cloud security architecture rarely begins with a grand design. More often, it evolves through necessity, one decision at a time, shaped by scale, cost, and the operational realities of modern cloud environments. Looking back, that evolution follows a familiar path. It’s a journey many cloud security engineers have taken, divided into three distinct generations, each…
Introducing Upwind AI Security: One platform, built for the agentic era
Key takeaways: Cloud security and AI security stop being two things For the last couple of years, a lot of the security industry has been quietly insisting that AI security has to be its own thing. Keep tools, teams, budgets, and dashboards separate or else… Well, we disagree. We listened to our customers, and what…
The 5 Hidden Challenges of Securing Enterprise AI in 2026
Key takeaways: The CISO squeeze in 2026 If you’re a CISO right now, you already know the feeling. The board wants an AI strategy immediately. Engineering is already shipping copilots, agents, and Gen-AI workflows into production. Teams are connecting models to APIs, internal systems, SaaS platforms, and cloud infrastructure faster than governance can keep up.…
The AI Visibility Gap: Why You Can’t Secure What You Can’t See
Key Takeaways What "AI visibility gap" actually means I've spent most of my career running security at companies that were three steps behind their own infrastructure. No judgement because in many ways that's the job… you catch up, the platform team ships something new, you catch up again. You could consider it a treadmill to…
AI-BOM, AI-Inventory, AI-NHI: A Practitioner’s Field Guide
Key Takeaways Closing the gap, in practice The visibility gap post made the strategic case: cloud security tools were built for static infrastructure, AI workloads are runtime workloads, and the snapshot model can't see them. The three capabilities that actually close it are AI-Inventory, AI-BOM, and AI-NHI, and I'll walk through each one in order:…
Stop Prompt Injection at Runtime: Inside the Multi-Step AI Attack Chain
Key Takeaways Listen in on most security teams talking about prompt injection in 2026 and you'll hear something like, "it's a model problem, we have guardrails, we're fine." Three months later an attacker is exfiltrating customer records through that same model, and the SOC has no clue why their CDR didn't fire. Prompt injection is…
Silent Data Bleed: How Unsanctioned AI Egress Drains Your Cloud
Key Takeaways A silent data bleed looks like this. Somewhere in your cloud, an EC2 workload is making an HTTPS call to api.deepseek.com or api.openai.com or api.anthropic.com. The TLS handshake is identical to every other vendor API call in your environment, the destination is fronted by a CDN your monitoring already trusts, the payload is…
Why Testing AI Like Software Fails and What to Do Instead
Key Takeaways Allow me to let you in on a methodology secret Most security teams I talk to now have budget allocated for AI security testing in 2026. Most are spending it the same way they spent security budgets before AI existed: I’ve done the same thing myself more than once. It’s the path of…
Why Your AI Pen Test Lied to You
Key Takeaways The CISO bottleneck in 2026 If you're a CISO in 2026, you're probably the slowest part of your company's AI strategy. Not because you're slow, but because the rest of the org can stand up new AI features in days, while the security review cycle is still measured in weeks. Product is shipping…
Agentic Cloud Security Is Only as Smart as Its Runtime Context
Key Takeaways Agentic cloud security is everywhere. What's actually real? Every cloud security platform shipped AI agents this year, but the differentiator isn't the agents. It's the data architecture they reason on. Investigation agents, remediation agents, triage agents, copilots, analyst agents, workforce agents. Rest assured, most of these are real systems. But some are LLM…
The exploit window didn’t shrink. It flipped.
TL;DR: Time-to-Exploit (TTE), the gap between vulnerability disclosure and first observed exploitation, has gone negative. Mandiant's M-Trends 2026 report shows attackers now exploit vulnerabilities, on average, before a patch is publicly available and we see the same in running environments. That breaks the foundational assumption every legacy CNAPP architecture was built on — that defenders…
For the first time in 30 years, cybersecurity defenders might actually be winning
Everyone is catastrophizing about AI-powered attacks. Here's the contrarian case, and why the window is narrower than it looks. TL;DR: The prevailing narrative at Black Hat 2025 was that AI has made attackers unstoppable. The most credentialed voice in the room said the opposite, and the data backs him up. The Mythos release through Project…
The Real Shift Underneath Mythos
Key Takeaways Anthropic's Mythos model has been called a cybersecurity watershed and a marketing stunt in the same week. Both camps have a point. Mythos appears to represent a real capability gain, and Anthropic deserves credit for releasing it through Project Glasswing rather than dropping it in the wild. At the same time, independent replication…