Upwind has introduced a new answer to AI-driven attacks. Upwind Response, announced on November 12, 2026, by the Cloud and AI security platform, stops AI-driven attacks within seconds of detection and keeps attackers from moving deeper into a customer’s environment. It is available now to every Upwind customer.
The capability is designed around two goals that security teams have often found hard to reconcile: stopping attackers quickly and keeping the business running while that happens.
The Short Version
When Upwind detects an attacker trying to exploit a cloud application, Response cuts off that attacker’s access to the targeted service and stops the kill chain. No one has to log in, review an alert, and click approve before that happens, unless the team has chosen to keep that step in place.
That choice belongs to the security team. Teams decide which threats Response mitigates on its own and which ones require their approval. Whatever Response does, the action is temporary and can be rolled back, so speed never comes at the expense of control.
The Problem It Solves
Attackers have become dramatically faster. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before the day its CVE was published, which means a meaningful share of attacks were already underway before the flaw had a public identifier.
AI is a major reason for that pace. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock to achieve success. Unlike the people defending against them, they never need to stop.
JPMorgan Chase summarized the imbalance in a recent post on AI and security: “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.” Discovery and exploitation have accelerated, while the work of fixing problems has not kept pace.
Why Patching Alone Falls Short
Upwind is clear that finding risks and detecting attacks remain the foundation of cloud security. Response does not move away from detection. It adds a way to act on what detection finds.
The challenge is timing. A new flaw can now be used within hours, and a scan-and-patch cycle cannot close that window quickly enough. Patching still matters, but on its own it cannot move at the speed attackers now set.
The backlog adds to the pressure. Risky settings and unused permissions keep piling up in cloud environments, and each one is a possible way in. Clearing them takes time that an active attacker does not allow.
Why Teams Held Back
Automatic remediation is not a new idea, and many security teams have resisted it for understandable reasons. False positives and over-reaching responses can cause ongoing problems. When an automated tool blocks the wrong thing, the business absorbs the cost.
As a result, many organizations kept a person in the loop for every step. That approach kept things safe, but it also kept them slow. Response was built to remove that trade-off by combining precision with the ability to undo any action it takes.
How It Works
Response pulls together signals across cloud, runtime, code, and identity, giving it the full picture of a threat. It is focused on attacks in progress rather than general risk, acting when it sees malicious activity such as an attempt to exploit a vulnerability or to take remote control of a server.
When it identifies that kind of activity, Response blocks the attacker’s access point from reaching the specific service under attack. The block happens at the cloud network level and takes effect in seconds. Normal customer traffic keeps flowing, so legitimate users carry on while the attacker is cut off.
If the Attacker Gets Further
Response has additional options when an attack progresses beyond that first step. It can terminate a specific malicious process and keep that process from starting again, avoiding large disruptions to regular operations.
It can also trim a compromised machine’s cloud identity so that the machine loses access to object storage and databases. The workload keeps running, but the attacker’s path to the data is closed.
As a last resort, Response can isolate the machine completely, taking it off the internet and the rest of the network. A secure tunnel into the machine stays open, so the security team can still reach it. Each of these steps is narrower than a full shutdown, and each one is used only when the situation calls for it.
What It Does Not Do
The design is as notable for what it avoids as for what it does. Response does not shut down an entire application, cut off real customers, or take down a server to remove a single process.
Instead, it targets the attacker, the specific service under attack, and the specific process involved. That narrow focus is what separates it from the blunt automation many teams have learned to distrust.
What the CEO Says
Amiram Shachar, Co-Founder and CEO of Upwind, explained why that precision makes automatic action safe.
“Finding risk will always matter, but against attackers that move at machine speed, defense has to be active,” said Shachar. “Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit. That precision is what makes automatic blocking safe. Every blocked attempt costs the attacker time and money, while our customers’ business keeps running.”
His point is that seeing an attack clearly is what makes it safe to stop automatically, and that the cost of each failed attempt falls on the attacker rather than the customer.
Easing In
Teams do not have to go fully automatic on day one. Approval mode is the natural place to begin: organizations can require approvals before Response acts, then let it act on its own as their confidence builds.
Every action remains temporary, visible, and easy to roll back throughout that process. Security teams stay in charge of the rules, while Response handles the part of the job that has to happen in seconds.
Shared Learning
Each attack Response encounters is cataloged, anonymized, and added to the knowledge of the Upwind Platform. Identifying details are removed, but the lessons remain.
As a result, every Upwind customer achieves better security through the collective experience of their peers, and the industry becomes more resilient overall. An attack faced by one customer becomes knowledge that helps protect the rest.
Why It Matters Now
Detection tells a security team there is a problem. Response deals with it. When attacks move at machine speed, that second step cannot wait for a manual process to catch up, and Upwind built Response to close that gap.
Setup
Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Because it uses cloud- and AI-native primitives, there is no extra firewall to deploy and no new hardware to manage.
Admins can enable it today within the console, which keeps setup to a change in settings rather than a new project.
Learn More
Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.