Surf AI joins Chainguard's Athena coalition. Prasad Raman | September 28, 2026 AI is changing the economics for attackers. Frontier models can now find zero-days in widely used software and weaponize them far faster than defenders are used to, and the window between discovery and exploitation keeps shrinking. This era requires enterprises to put more of their focus on basic security hygiene. Many security teams have ignored a large portion of their backlog, betting that no adversary would spend the time and money discovering and exploiting an obscure flaw. Security by obscurity worked for a long time, but it doesn't hold up when an AI model can do the digging for an attacker. The organizations that stay secure will be the ones that proactively improve their security hygiene and continuously minimize their attack surface. Today Surf AI Inc. is announcing that Chainguard has invited Surf AI to join Athena, the industry coalition defending open source software against AI-driven attacks. Its role is to help member enterprises put Athena's work into practice: identifying who owns each affected asset, understanding what a change will touch, and moving the fix through to completion inside real environments. What is Athena. Athena is a coalition that brings pre-disclosure vulnerability findings from across the industry into a shared clearinghouse. The findings come from frontier AI models, and many are zero-days in open source software that enterprises rely on every day. Chainguard rebuilds the affected code as a private, hardened version ahead of disclosure, reconciles each fix against upstream throughout the embargo, and layers independent network, platform, and vendor mitigations around it so members stay covered even where a patch can't be deployed right away. The coalition is already operating at real scale: more than 21,175 validated zero days with more than two dozen members across banking, cloud, networking, and software supply chain security. Each member brings something the others don't, and that's what makes the model work. Why Surf AI joined. Athena gives members something rare: validated findings and hardened fixes before a flaw is public. The next step happens inside each organization's own environment, and that's where Surf comes in. In a large enterprise, applying a fix means answering a string of practical questions. Which team owns the affected component? Where else does it run? Does changing it touch a compliance boundary? Who is on call to do the work, and does it need to go through a change board? When those answers live across a dozen systems and have to be pieced together by hand. AI-driven threats make this harder in two ways. Serious findings arrive faster than teams can triage them by hand, and many of these flaws are fixed upstream without ever getting a CVE, so they don't show up in workflows built around CVE and NVD data. Surf was built for exactly this. Its Context Graph, a continuously updated map of every entity, relationship, ownership assignment, and policy in an environment, gives teams the context they need to act on a fix as soon as it's available. Joining Athena lets Surf AI Inc. help enterprises put the coalition's work into practice: identifying who owns each affected asset, understanding what a change will touch, and seeing the fix through to completion. What customers get. For enterprises running Surf, every Athena finding comes with the context to act on it: who owns it, what it touches, and how it gets approved. Surf then carries the fix through to closed using the workflows teams already have. That adds up to: * A head start. For coalition members, the groundwork can happen while a flaw is still under embargo, so disclosure day starts with the fix already in motion. * Visibility into silent fixes. Upstream fixes that never receive a CVE get handled like any other finding. * Fixes that don't break things. Teams know what a change will affect before it goes in. * A cleaner backlog. Findings move all the way to closed, even as the volume grows. Want to see how Surf AI turns Athena findings into closed remediation inside your environment? Talk to Surf AI Inc.. Prasad Raman is Head of Technology Partnerships at Surf AI, with a decade of experience building alliance and partnership programs across the security industry.

Surf AI now integrates with Cyera. Prasad Raman | September 17, 2026 Surf AI now integrates with Cyera to bring organizational context and agentic remediation to discovered data risk. Enterprise environments are complex, and they do not get simpler over time. Sensitive data spreads across cloud infrastructure, SaaS applications, and unstructured stores. Access is granted to people, and to the services and automations that keep the business running, and it rarely gets cleaned up afterward. Data security platforms like Cyera surface sensitive data risks across the environment continuously and at scale: over-permissioned data stores, exposed PII, and policy violations. The finding makes the risk clear. Surf AI was built to operationalize security in exactly this kind of environment: to turn findings into resolved risks without forcing teams into manual triage every time something needs fixing. Acting on it safely is a separate problem, and in a complex enterprise, it is where SurfAI is a game-changer. From open data risk findings to resolved ones. When a sensitive data exposure surfaces, acting on it safely means answering questions built from additional organizational context. Who owns the affected data store? Which production workflows read from it? Will restricting access accidentally break something that runs on a schedule? Does the change need a compliance window or a privacy officer's sign-off? Is the person listed as the owner still on the team and in a position to respond? That context lives across identity, HR, cloud, ITSM, code, and collaboration systems, and today it gets assembled by hand. An analyst opens a ticket, chases owners through distribution lists, and waits for compliance to confirm the scope before anyone is comfortable touching an access policy. While that happens, the exposure stays open, and every new scan adds to the queue. What accumulates is a growing backlog of known, high-severity data risk that no one disputes and no one has the context to safely close. Cyera and Surf AI: from finding to safe resolution. This is the challenge Surf AI and Cyera solve together. Cyera brings continuous discovery and classification of sensitive data risk. Surf AI brings the organizational context and agentic execution to act on it safely and at scale. Cyera issues, including over-permissioned data stores, sensitive data exposures, policy violations, and unprotected PII, flow into Surf AI's Context Graph, a continuously updated, normalized map of every entity, relationship, ownership assignment, and policy in a customer's environment. The moment a finding arrives, the Context Graph enriches it with the cross-system context needed to act: who owns the affected data asset, who last modified it, which team owns the underlying service, what depends on it, whether access patterns are consistent with the owner's current role, what compliance requirements apply, and what the blast radius of any remediation action would be. That same context separates findings that reflect intentional design from those caused by silent misconfiguration, so teams act on real exposure rather than expected behavior. With that picture assembled, Surf routes a safe path to resolution to the right owner, executes the approved change, and records the action with a complete audit trail. Rather than end with a finding, the finding becomes the starting point. What this looks like in practice. For sensitive data exposures, the Context Graph identifies the data asset owner, maps every identity with active access to it, and models the downstream impact of restricting access to it. If the change is safe, Surf routes a one-click approval to the owner and executes on sign-off. If active dependencies exist, it models an alternative path and routes it with the full blast radius attached, so access is never restricted blindly. For findings that fall under regulations such as GDPR, CCPA, and HIPAA, the Context Graph automatically applies the compliance scope, determines the required action and the correct approval path, and executes with full policy awareness. Every action is documented with a timestamped audit record mapped to the applicable control, so privacy teams can demonstrate continuous compliance rather than point-in-time snapshots. For data stores with no documented owner, the shadow and abandoned assets that governance processes miss, the Context Graph validates true status before anything is touched. It cross-references signals across cloud, code, and collaboration history to identify the most likely owner or the responsible team. Confirmed-abandoned assets move to a decommission workflow. Ambiguous ones get an ownership challenge with a phased path: restrict access, confirm no impact, then remove. From continuous discovery to continuous resolution. Data security has spent years getting good at finding risk. The next step is to close it safely, without turning every exposure into another line in the backlog. Together, Cyera and Surf AI let teams move from continuous discovery to continuous, safe enforcement, so sensitive data risk gets resolved instead of just recorded. Prasad Raman is Head of Technology Partnerships at Surf AI, with a decade of experience building alliance and partnership programs across the security industry.