How CAVA Cut False Positives to Zero - Upwind | Cloud & AI Security for the Realtime Era

CAVA Cut False Positives from 12 a Day to Zero with Upwind

Before Upwind, we were getting about 9 to 12 false positives a day. With Upwind, if there is an alert, we take it seriously because we don’t get false positives.

Eli EdelkindCISO of Infrastructure & Tech Operations, CAVA

About CAVA

CAVA is a fast-growing restaurant brand focused on modern Mediterranean food, powered by a highly dynamic cloud environment that supports everything from digital ordering to in-store operations.

As the business scales, their security team is responsible for protecting an API-driven infrastructure where services are constantly evolving. That requires more than knowing what exists. It requires understanding how systems behave in real time.

CAVA chose Upwind to move beyond static visibility and gain real-time context into how their environment actually runs.

Challenges

Too many false positives: Existing tools generated constant noise, with alerts that rarely led to real issues and slowed down the team.
Too many disconnected tools: Managing multiple panes of glass made it difficult to get a clear, unified view of the environment.
Limited visibility into runtime behavior: Tools showed what was exposed, but not what was actually happening inside the environment.
Incomplete API security context: API tools provided external discovery, but lacked insight into internal service interactions and data flow.

Solutions

Runtime visibility from the inside out: CAVA can now see how services, APIs, and systems actually behave in real time.
Unified API security: Upwind combines external exposure with internal runtime context to provide a complete view of API activity.
Clear, actionable signals: False positives dropped significantly, giving the team confidence that when an alert surfaces, it’s worth investigating.
Faster investigations: Engineers can understand service communication, network flows, and behavior without stitching together multiple tools.
Built for engineers: The platform is intuitive for both new and advanced users, from high-level views to deep technical detail.

Why CAVA Chose Upwind

CAVA didn’t adopt Upwind to add another security tool. They adopted it because their existing approach wasn’t giving them the context they needed to actually secure their environment. Like many teams, they were using multiple tools across cloud and API security, but those tools could only show inventory and external exposure. They couldn’t explain what was happening inside the environment or how services and APIs behaved in real time.

That gap made it difficult to understand what was actually running, what was communicating, and what was truly risky. At the same time, the volume of false positives was slowing the team down. They were dealing with 9 to 12 alerts a day that required investigation, but most didn’t lead to real issues.

During their evaluation, Upwind stood out by providing a level of visibility and clarity they hadn’t seen before. By bringing runtime context into a single platform, CAVA could finally see how their environment actually operated, from service-to-service communication to API behavior across internal and external traffic. Just as important, alerts became meaningful. Instead of chasing noise, the team could focus on what actually mattered with confidence.

Upwind

Uplift Your Cloud Security Today

Schedule a meeting with a cloud security experts today to secure your cloud, reduce friction between your teams and proactively protect your cloud infrastructure and applications.

Get a Demo

With Upwind, we are able to identify any vulnerabilities and can prioritize them for remediation — helping us operate more efficiently and securely.

Varun Brahmkshatriya

Cloud Engineer

Solutions

Upwind built support for gVisor, enabling Spacelift to gain process-level visibility into isolated containers from inside the platform, without an additional abstraction layer.
Upwind’s runtime-powered detection drastically reduced incident response times, allowing engineers to see exactly what happened inside containers and take quick action — whether that meant alerting the customer, killing a malicious process, or preventing future abuse.
Custom POC collaboration enabled rapid iteration, with Spacelift testing real-world attack patterns observed in wild malware samples, and Upwind delivering tailored features in record time.
Dynamic network graphs and runtime vulnerability prioritization allowed the team to track service communication patterns, identify drift, and focus on real exploitable risks — not just theoretical ones

Spacelift’s use of gVisor provided strong sandboxing and tenant isolation, but it came at the cost of visibility. The lack of runtime insight made it time-consuming to monitor network activity and understand events leading up to a security incident. Upwind’s gVisor feature solved this problem, providing Spacelift with full visibility into what was happening inside containers in real time. They could now trace every process, identify the actor behind it, and act decisively — all while preserving the container isolated gVisor was designed to enforce.

Visibility Inside Isolated Containers

Spacelift’s use of gVisor provided strong sandboxing and tenant isolation, but it came at the cost of visibility. The lack of runtime insight made it time-consuming to monitor network activity and understand events leading up to a security incident. Upwind’s gVisor feature solved this problem, providing Spacelift with full visibility into what was happening inside containers in real time. They could now trace every process, identify the actor behind it, and act decisively — all while preserving the container isolated gVisor was designed to enforce.

We tried reaching out to other vendors, but Upwind was the only one who moved fast, built what we needed, and treated us like a real partner. That’s rare — and it made all the difference.

Varun Brahmkshatriya

Cloud Engineer

Outcomes

Upwind built support for gVisor, enabling Spacelift to gain process-level visibility into isolated containers from inside the platform, without an additional abstraction layer.
Upwind’s runtime-powered detection drastically reduced incident response times, allowing engineers to see exactly what happened inside containers and take quick action — whether that meant alerting the customer, killing a malicious process, or preventing future abuse.
Custom POC collaboration enabled rapid iteration, with Spacelift testing real-world attack patterns observed in wild malware samples, and Upwind delivering tailored features in record time.
Dynamic network graphs and runtime vulnerability prioritization allowed the team to track service communication patterns, identify drift, and focus on real exploitable risks — not just theoretical ones

Upwind grants Petrofac the ability to instantly identify threats and eliminate malicious processes with the click of a button. It also creates prevention policies to block future malware from running in their environment.

CAVA

CAVA Cut False Positives from 12 a Day to Zero with Upwind

Challenges

Solutions

Why CAVA Chose Upwind

Uplift Your Cloud Security Today

With Upwind, we are able to identify any vulnerabilities and can prioritize them for remediation — helping us operate more efficiently and securely.

Solutions

Visibility Inside Isolated Containers

We tried reaching out to other vendors, but Upwind was the only one who moved fast, built what we needed, and treated us like a real partner. That’s rare — and it made all the difference.

Outcomes

Product

General

Social

Resources