In surfing, the lineup is where it all starts. It's the place where surfers seize the next big wave, together! It’s where experience meets timing. Where trust, respect, and awareness matter as much as skill. That idea is exactly what inspired The Lineup: Upwind's Technology Alliances Program, and why we think it's the right model…

TL;DR: API security was designed for a world where APIs were stable, documented endpoints sitting in front of monolithic applications. In cloud-native environments, APIs are dynamic connective tissue between workloads, identities, and data stores and securing them requires runtime visibility across the full cloud stack, not endpoint-level controls alone. Introduction API security has received significant…

Continuous Compliance for Cloud Security Teams The AWS Well-Architected Framework is now available in Upwind. The framework helps organizations evaluate architectural decisions and align workloads with AWS best practices across 6 pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. The Well-Architected Framework was designed by AWS as a consistent way for teams…

Field CISO work is closer to courtship than sales. And what I mean by that is, by the time a CISO has an urgent project, the field of trusted vendors has already been chosen, which means the year before the buying moment is the entire game. The most underused word in cybersecurity is courtship. We…

Software supply chain attacks are no longer rare events that make headlines once a quarter. In 2026, significant attacks are landing every few days, and the pace is accelerating. AI-assisted code generation is lowering the barrier for attackers to craft sophisticated, obfuscated payloads and inject them into trusted open source packages at scale. The window…

For most of the last decade, cloud security teams have lived by a simple slogan: encrypt everything. Encrypt at rest. Encrypt in transit. Use customer-managed keys. Rotate them. Pass the audit. Move on. That slogan just expired. In August 2024, NIST finalized the first three post-quantum cryptography (PQC) standards and explicitly told organizations: start using…

Executive Summary On June 1, 2026, unauthorized commits were pushed to repositories in the RedHatInsights GitHub organization and used to publish malicious versions of 32 packages under the @redhat-cloud-services npm scope.The campaign, tracked as Miasma, executes a 4.2 MB obfuscated payload through an npm preinstall hook the moment any of these packages is installed, directly…

A few weeks ago, I wrote about Upwind becoming agentic, AI for Security. We put a fleet of Agents, Blue, Red, and Green, to work investigating threats, validating exposures, and remediating risk at machine speed. That was one half of the story. This is the other half. Security for AI. AI has rewired our known…

A novel Command-and-Control (C2) channel weaponizes legitimate AWS services to establish two data channels, successfully circumventing one of the cloud's strongest security defenses. Status: Infiltration Channel is FIXED, Exfiltration Channel is OPEN. TL;DR This research was presented at fwd:cloudsec North America 2026. Watch the full talk below. What Is the AWS Data Perimeter? For the…

We are thrilled to announce that Upwind has been selected as a launch partner for Cloud Control Studio, part of Cisco Cloud Control, bringing realtime intelligence on cloud and AI security into the platform. Unveiled at Cisco Live Las Vegas on June 2, 2026, Cisco Cloud Control is the unified platform for agentic IT operations. …

Key Takeaways We've spent the last decade hardening the perimeter. Using firewalls, Zero Trust and EDR on every endpoint. SOC analysts surviving on cold brew and adrenaline just to keep us safe.  And then GlassWorm walked straight through the front door. Like taking candy from a baby.  If you haven't been following this one, here's…

A new vulnerability enters the backlog. A workload is exposed. A misconfiguration affects production. An identity behaves unexpectedly. A customer asks for evidence. An audit or pentest is coming up. Each moment requires the same understanding of what is real, what is urgent, what is connected, and what should happen next. The Upwind MCP Server…