the UpGuardian | Are we in the Middle of a Cyber Risk Tidal Wave?

50% of history’s vulnerabilities arrived in the last 5 years. Learn how to navigate this violent explosion of new threats.  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­  

The UpGuardian Feature August is for Outages: Surviving a LockBit Attack  With CISO Nick Gicinto   Blog Meet the AI Protocol Quietly Expanding Your Attack Surface Opinion 25 Vulnerabilities That Have Defined the 2020s (Thus Far)  From the Editor Just as a minor disturbance in the open ocean can build into a devastating rogue wave, software vulnerabilities (and the attackers riding their crest) constantly gain momentum to crash through security patches and firewalls. The difference, however, is the terrifying speed at which this digital tide rises.   While a physical wave takes time to gather force, cyber undercurrents accelerate by the day. To put this momentum into perspective: the National Vulnerability Database (NVD) recorded just 321 entries in its first year, and about 18,000 in 2020. Yet already in 2026, we have seen well over 27,000 new vulnerabilities recorded, a massive surge that is completely overwhelming traditional security playbooks.   In this issue of The UpGuardian, we track the mechanics of this rising tidal wave and analyze the most dangerous vulnerabilities and threat actors currently threatening to submerge security teams around the world.   - Nicholas Sollitto   At a glance 1999 The National Vulnerability Database was founded in 1999. It took 21 years to reach the first 150,000 recorded vulns. It only took 5 years (2021–2026) to find the next 150,000 vulns and double that number. 48,000 In 2025 alone, over 48,000 new vulnerabilities were published. That is an average of 132 new threats every single day. April 4 In April 2026, NIST officially transitioned to a risk-based prioritization model, acknowledging that it is now impossible for humans to catalog every digital artifact manually. Feature August is for Outages: Surviving a LockBit Attack with CISO Nick Gicinto By Nicholas Sollitto (with Greg Pollock and Nick Gicinto)   In August 2023, while thousands of students at William Jewell College were hauling mini-fridges and textbooks into dorms, the invisible, digital heart of the campus was flatlining. There was no internet. No email. Even the HVAC system, tied to a compromised network, had shut down in the sweltering Missouri heat. The culprit? LockBit, a prolific ransomware syndicate that just hit Boeing days prior. For Boeing, it was a data exfiltration headache; for William Jewell, a small liberal arts college, it was an existential threat during its most critical revenue window of the year. “I needed to have visibility. I didn't know what I was looking at. I couldn't really see much. I couldn't even reconstruct the attack itself.” Continue reading → Blog Meet the AI Protocol Quietly Expanding Your Attack Surface By Shane Moosa   In February 2026, researchers uncovered something that should give every security leader pause. A malware operation called SmartLoader, previously known for targeting consumers who downloaded pirated software, had completely pivoted its infrastructure. SmartLoaders new target was developers, and its new entry point was a protocol most security teams had never heard of. The payload delivered to victims: every saved browser password, every cloud session token, every SSH key on the machine. The protocol was called MCP. And it had been running silently in developer environments across thousands of organizations for over a year. Continue reading → Opinion 25 Vulnerabilities That Have Defined the 2020s (Thus Far) By Nicholas Sollitto   Welcome to vulnerability management's big bang. If it feels like your security team is running a marathon on a treadmill set to a permanent incline of 12.0 with 50lb sandbags tied around each ankle, you're in good company. We have officially entered the era of the Great Vulnerability Acceleration. To put this recent synthetic bloom into perspective, consider this: in the last five years, the cybersecurity community has identified and recorded over 150,000 new vulnerabilities.  Continue reading → Palette cleanser Guglielmo Marconi and the World's First Vulnerability In June 1903, Guglielmo Marconi prepared to demonstrate his wireless telegraph at London’s Royal Institution, only to fall victim to the world's first recorded hack. As Marconi’s colleague waited for a message, the telegraph began clicking out a rhythmic, mocking poem filled with Shakespearean insults. The hooligan behind the breach was Nevil Maskelyne, a stage magician and rival inventor. UpGuard Inc., 650 Castro Street, Suite 120-387 , Mountain View, CA , 94041, United States +1 888 882 3223 Unsubscribe | Manage Preferences