A public proof-of-concept for NetScaler ADC and Gateway flaw CVE-2026-88771 has turned targeted zero-day attacks into internet-wide exploitation. CISA’s deadline was 30 September. Patch, then hunt for web shells.
Upwind buys Israeli AI security start-up Aegis and opens an AI lab
EditorialBy TrustList Editorial
No price, closing date or headcount is given. The new Upwind AI Lab will work on agent security, security benchmarks for frontier models and GPU protection.
- Israel
- Cloud Security
- Cybersecurity
- Cybersecurity Software
About Upwind buys Israeli AI security start-up Aegis and opens an AI lab
Upwind buys Israeli AI security start-up Aegis and opens an AI lab
23 September 2026: Upwind, the cloud security vendor known for runtime monitoring of cloud workloads, is acquiring Aegis, an Israeli start-up working on AI security, and using the team to set up a research unit called the Upwind AI Lab. Upwind announced both steps in a blog post by its leadership team. The post does not give a price, a closing date or the number of people joining.
Not yet independently verified. Neither party states a price, closing date or headcount, and we found no statement from Aegis itself. We will update this when it can be confirmed, and remove this note.
What Upwind says it is buying
Upwind describes the Aegis team as a cultural match and says its researchers, engineers and product people will form the base of the new lab. The post is written as a personal note from the company's leadership rather than a deal memo, so it names no financial terms, no Aegis products and no customers. Taiwanese outlet iThome, which reported the story on 13 October, describes Aegis as an Israeli start-up focused on AI security and says its research team and technology will be combined with Upwind's existing cloud security capabilities.
The four research areas
Upwind lists four areas for the lab.
- Security for AI: protecting models, agents, GPUs, identities, APIs, data, SaaS services and cloud infrastructure, with the same approach Upwind takes to cloud security, which is to look at what is running, what it can reach and how it behaves.
- Agentic security: building agents that can investigate, correlate and validate security findings and, with guardrails, eventually act on them. Upwind points to its Agentic Pack, which it said in May 2026 had become generally available, as the first step.
- Frontier models, research and benchmarks: new datasets, benchmarks and evaluations based on real security scenarios, aimed at testing how well frontier models reason about attack paths and exploitability.
- Advanced AI systems: work ahead of the current roadmap, including retrieval architectures, security decision models, context and memory systems, and GPU security.
Upwind says some of the output will become product, some will be published as research or benchmarks, and some will stay internal learning. It gives no dates for any of it.
What existing customers can ask
The company launched its AI Security Platform in May 2026, organised around viewing, protecting and validating AI workloads on the same runtime fabric as its cloud product, sold as one SKU. For existing Upwind customers, the practical open questions are whether Aegis technology will be folded into that SKU or priced separately, and when. The announcement answers neither. Customers of Aegis should ask for confirmation of contract terms, data handling and support continuity once the deal closes.
Company profile on TrustList: Upwind
Sources
- Upwind: Building the Future, Introducing the Upwind AI Security Lab, 23 September 2026
- Upwind: Introducing Upwind AI Security, 12 May 2026
- iThome: Upwind acquires AI security start-up Aegis, 13 October 2026
Categories & features
- Israel
- Cloud Security
- Cybersecurity
- Cybersecurity Software
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
Kiteworks said on 27 September 2026 that its weekend shutdown recommendation is lifted for all customers and systems can be restarted on version 9.5.1. Customers with self-hosted Advanced Forms should contact support first.
ServiceNow disclosed five vulnerabilities in its AI Platform on 24 September 2026, two of them critical (CVE-2026-13016 and CVE-2026-86860, CVSS 9.3) and exploitable without authentication. Belgium’s CCB says patch immediately.
Under Poland’s amended National Cybersecurity System Act, its NIS2 law in force since 3 April 2026, key and important entities must apply for entry in the KSC list by 3 October 2026 and meet the other duties by 3 April 2027.
Microsoft will enforce a Content Security Policy on login.microsoftonline.com from mid-October 2026, allowing only Microsoft-hosted scripts. Browser extensions and tools that inject scripts into sign-in may stop working; act by 19 October.
Google’s threat intelligence team says the ShinyHunters group is again exploiting PeopleSoft’s CVE-2026-35273, encoding one letter of the path to get past WAF rules. Apply Oracle’s June security alert, disable EMHub and hunt for web shells.
A high-severity advisory in the official MCP Python SDK lets a malicious MCP server steer a client’s OAuth secret, code and PKCE verifier to its own token endpoint. Fixed in 1.30.0 and 2.2.0, but machine-to-machine clients must also pass issuer=.
A $28m Series A led by Red Dot Capital Partners follows a $6m seed from Dell Technologies Capital and Emerge. The Israeli company says it already runs in more than 200 security operations centres.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- More IsraelThe ranking for this subject
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.