Security teams aren’t short on data. But they’re often short on context and time.
The average vulnerability management program is buried in alerts, running on scan results that are hours or days old, and facing both savvy and unskilled attackers that can leverage AI to develop sophisticated exploits in minutes. That combination is why backlogs keep growing even as teams work harder to clear them.
The National Vulnerability Database (NVD) published over 42,000 CVEs in 2025 (NIST), 45% more than any prior year. Zero-days and supply chain attacks like LiteLLM, Telnyx, and Shai-Hulud have moved from quarterly events to near-daily ones. And frontier AI models are making things worse on two fronts: they’re generating more noise by accelerating vulnerability discovery, and they’re lowering the skill barrier for attackers while raising the sophistication of what they can actually pull off.
A periodic scan, run once or twice daily, can’t keep pace with any of that. By the time results land in a dashboard, the environment has already moved on. New workloads have spun up. Old ones have disappeared. What was reachable yesterday might not be today, and vice versa.
Vulnerability management needs to catch up to the pace of the environment it’s protecting. That means real-time, not periodic. Continuous, not a snapshot.
Buried in alerts, lacking context
Talk to anyone running a vulnerability management program and the complaint is consistent, there are too many findings, and not enough signal on what to prioritize
CVSS and EPSS scores tell you how severe a CVE could be in theory. They don’t tell you whether the vulnerable package is actually loaded into memory on a running workload, or whether that workload is exposed to the internet. Without that context, every critical finding looks the same on paper, whether it’s sitting untouched in a dormant image or actively executing on a production system that’s one hop from the internet.
That’s how teams end up with backlogs measured in the thousands. A Fortune 2000 CISO told Upwind they’re seeing 500% more vulnerabilities this year. Scanner output from traditional vulnerability management and cloud security posture management tools pile up faster than any team can triage it manually, and don’t provide the context necessary to help security teams work effectively with development teams.
Frontier AI is changing the math on both sides
Frontier AI models are compressing the timeline between a vulnerability existing and someone weaponizing it. Discovery that used to take a skilled researcher days can now happen automatically. That doesn’t just mean more attacks. It means more capable ones, executed by people who wouldn’t have had the technical depth to pull them off a few years ago.
For defenders, that shows up as more noise on top of an already packed queue. Vulnerability discovery tools are surfacing findings faster than security teams can validate them, and attackers are exploiting the ones that matter faster than teams can patch. The gap between “here’s a list of CVEs” and “here’s what’s actually dangerous right now” is where risk lives.
Closing that gap requires visibility into what’s happening in the environment as it happens, not a reconstruction of what was true at the last scan.
What real-time vulnerability management actually looks like
Upwind takes a hybrid approach: agentless scanners for fast, broad coverage, paired with runtime sensors that provide continuous, live insight into what’s actually running, exposed, and reachable.
That combination changes what a critical finding means. Instead of ranking CVEs by theoretical severity alone, Upwind correlates them against what’s happening in the environment right now:
- Is the vulnerable function actually loaded and executing, not just sitting in an unused image
- Is the workload exposed to the internet
- Is there a known, confirmed exploit in the wild
- Is a fix available
- What’s the CVSS severity and EPSS probability of exploitation
Function-in-Use detection is the piece that makes this real-time rather than retrospective. A vulnerable package that’s present in an image but never called is a different risk profile than one being actively executed in production. Static scans can’t tell the difference. Continuous runtime visibility can, and it updates as workloads change, not on the next scheduled scan.
The result is a funnel that goes from tens of thousands of CVEs down to a handful that genuinely need attention today. Up to 95% fewer alerts overall, driven by correlating vulnerabilities against real-time insights, behavioral baselining, and functions in use.
Validation is a critical component
Prioritization is only half the job. Someone still has to prove a finding is exploitable, find the fix, and get a resource owner to act on it. That process has historically been manual, and manual doesn’t scale against today’s threat landscape.
Choppy, Upwind’s conversational control plane, orchestrates a set of purpose-built agents to keep validation moving at the same pace as detection:
- Red Agent validates which risks are actually exploitable, removing the manual proof-of-concept work
- Blue Agent investigates and responds to active incidents as they surface
- Green Agent turns validated findings into implementation-ready fixes, grouping related issues so a single change can close multiple findings at once
A finance customer in the LATAM region had been running a manually built vulnerability funnel stitched together from AWS-native tools and Qualys, with no runtime truth about what was actually live or exploitable. Moving to a continuous, runtime-informed model changed that. As one security lead put it, runtime visibility let the team identify the process behind an alert, show proof, and decide what to do next without guesswork or delay.
Getting ahead of what hasn’t been disclosed yet
Real-time visibility isn’t only about triaging known CVEs faster. It also means catching threats before they have a CVE number at all.
Behavioral baselining, built on continuous observation of what’s normal for a given workload, surfaces anomalies tied to emerging zero-days and supply chain attacks before they’re formally disclosed. Early CVE advisories give teams a head start instead of a scramble, which matters when the gap between disclosure and exploitation keeps shrinking.
One continuous view, not three disconnected tools
Fragmented tooling makes real-time visibility harder to achieve, not easier. Running CSPM, software composition analysis (SCA), and vulnerability management as three separate products means three separate views of the environment, updating on three separate schedules.
Upwind consolidates that into a single platform and a single SKU, with a Focus Mode built specifically for vulnerability use cases across cloud, AI, and shift-left security. One continuous funnel, one source of truth, and no reconciling conflicting outputs from point solutions.
As one customer summarized: “Upwind saves us a significant amount of time, helping our team focus on the truly critical alerts while disregarding low-priority findings.” — Sardorbek Pulatov, VP Engineering (Security), Vestiaire Collective.
Snapshots and daily scans can’t keep up with an environment that changes by the minute, or attackers whose tools are getting faster too. Real-time context is what closes that gap.
