Thought Leadership

TL;DR Kubernetes has taken on a second job. Clusters still run the applications they always ran, but now they also run AI agents, model-serving workloads, and MCP servers alongside the applications those agents work on. These workloads do not behave like the applications Kubernetes was built to run. They call tools, reach external services, and…

Reaching 100+ integrations with The Lineup at Upwind is a milestone I’m incredibly proud of. But when I think about what it took to get here, the number itself isn’t the most interesting part. The interesting part is what happens along the way. You start by building integrations. Then customers introduce new use cases. Partners…

Introduction In the first eight months of 2026, a Russian-speaking threat actor who had built a career on hotel-booking and fintech platforms turned to AI companies. The technique they used against one AI vendor did not involve any exploit. Like most AI vendors, the target ran an automated evaluation sandbox, an agent pipeline that reads…

Back to school season is here, which makes this a good moment to look at what changed in the threat landscape over the summer. AI-assisted attackers haven't climbed toward the top of the field so much as filled in the middle of it and the middle is the population almost no security program was designed…

The department model of dividing companies into groups earned its place. Finance gets the finance applications, engineering gets the repositories, HR gets the HRIS, and the boundaries hold because software was bought per function and used per function. Identity and access management platforms, such as Active Directory and Okta, were built around exactly that. Groups…

Bug bounty programs were built on a single assumption: that finding a vulnerability was the hard, scarce, expensive part worth paying for. That assumption held for about a decade, then AI erased it. When anyone can point a model at your code and receive a plausible-looking finding back in seconds, a crowd of finders stops…

I believe AI is going to make us much more secure. But probably not tomorrow. In fact, I think the next two years may be exactly the opposite: attackers will have the upper hand before defenders eventually turn the economics of cybersecurity in their favor. For decades, we have built software with vulnerabilities and then…

Key Takeaways I recently sat down with Upwind Solutions Architect, Evan Grace to learn more about his process. After some intros, he told me about his new hobby, hydroponics. For those who don’t know, hydroponics is a method of growing plants without soil. This was unbelievable to me but after Evan explained his deep dive…

Key Takeaways Autonomous AI agents can now break out of a sandbox, cross an internal network, and breach a production system with no human at the keyboard. OpenAI's evaluation that hacked Hugging Face this month is the clearest proof on record. Most of the coverage read it as a story about a model turning dangerous.…

Key Takeaways: Agentic AI security is an architecture problem, not a policy problem. Most organizations have adopted AI agents in the form of coding assistants, autonomous workflow tools, internal chatbots connected to production systems, but without establishing the foundational security frameworks those systems require. The adoption pressure is real. Telling your engineering team to stop…

Let this sink in: finding security vulnerabilities was never the bottleneck, vulnerability prioritization was. AI-scale discovery is about to make that impossible to ignore, and the teams that see it coming will pull ahead of the rest. Here's what kept me up this week. Anthropic ran a frontier model against some of the world's most…

If you follow AI at all, you know the leaderboards. Every few weeks a model takes the top spot, and we all check where our favorite landed. But a leaderboard only tells you who's ahead, and it stays quiet about where any of those models still come up short. Which, conveniently, is the part that…