New York, United States, November 12th, 2026, FinanceWire
Upwind, the Cloud and AI security platform, announced Upwind Response on November 12, 2026. The capability stops AI-driven attacks within seconds of detection and keeps attackers from moving deeper into cloud environments. Below is a breakdown of what Response does, why Upwind built it, and how customers can put it to work.
What is Upwind Response?
Upwind Response is an automatic, targeted blocking capability within the Upwind Cloud & AI Security Platform. When Upwind sees an attacker attempt to exploit a cloud application, Response cuts off that attacker’s access to the targeted service and stops the kill chain. It does this without waiting for a person to act.
Response builds on the detections Upwind customers already use. Rather than replacing detection, it adds the ability to act on what has been detected.
In short, Response connects what Upwind already sees with an action that stops the attacker.
Why did Upwind build it?
Attacks are moving faster than traditional defenses can respond. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before its CVE was published.
AI is speeding this up. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock until they succeed.
JPMorgan Chase summarized the issue in a recent post on AI and security: “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.”
Finding risks and detecting attacks remain the foundation of cloud security. But when a new flaw can be used within hours, a scan-and-patch cycle cannot close the window quickly enough. Backlogs of risky settings and unused permissions also keep growing, and each one is a potential way in.
What makes AI-driven attacks different?
Speed and persistence. AI agents can test an environment from many directions at once, link minor weaknesses into a working breach, and keep going without breaks. That combination shrinks the time defenders have to respond.
Does Response replace vulnerability management?
No. Upwind maintains that finding risks and detecting attacks remain the foundation of cloud security. Response adds a way to act when an attack is underway, which matters most when a new flaw can be used before the scan-and-patch cycle catches up.
Why haven’t security teams automated this already?
Automatic remediation has been considered, but many security teams have resisted it. The concern is that false positives or over-reaching responses will lead to ongoing problems, such as blocking legitimate users or disrupting business operations. Response was built to address that concern through precision, approvals, and rollback.
How does Response decide when to act?
Response unifies signals across cloud, runtime, code, and identity to understand the full picture of a threat. It acts when it spots an attacker executing a malicious activity, such as an attempt to exploit a vulnerability or to take remote control of a server.
What happens first?
Response blocks the attacker’s access point from reaching the specific service under attack. The block works at the cloud network level and takes effect in seconds. Normal customer traffic keeps flowing, so legitimate users are not affected.
The aim of this first step is to end the attack early. By cutting off the attacker’s access to the targeted service, Response stops the kill chain before it can progress.
What if the attacker gets further?
Response has additional steps that scale with the threat:
It can terminate a specific malicious process and keep it from starting again, which avoids large disruptions to regular operations.
Ending a single process removes the attacker’s foothold while the rest of the machine keeps running.
It can limit what a compromised machine can reach by trimming that machine’s cloud identity, so the machine loses access to object storage and databases.
As a last resort, it can isolate the machine completely, taking it off the internet and the rest of the network while keeping a secure tunnel into it.
Who decides when Response acts on its own?
Security teams do. They choose which threats Response mitigates automatically and which require their approval. Teams can start by requiring approval before any action, then let Response act on its own as they gain confidence in it.
Can actions be undone?
Yes. Every action Response takes is temporary, visible, and can be easily rolled back.
Can teams see what Response has done?
Yes. Every action is visible, which gives teams a clear record of what Response did, alongside the option to roll any of it back.
Does it require new infrastructure?
No. Response uses cloud- and AI-native primitives, so there is no extra firewall to deploy. Admins can enable it today within the Upwind console.
How should teams get started?
The path is gradual. Teams can begin by requiring approval before Response takes any action, then expand what it is allowed to do on its own as their confidence grows. That lets each organization move at its own pace.
Does Response help beyond a single customer?
It does. Each attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform. This allows every Upwind customer to achieve better security through the collective experience of their peers, which helps the industry become more resilient overall.
Because the information is anonymized, customers benefit from what others have seen without their own details being shared.
What does Upwind’s CEO say?
Amiram Shachar, Co-Founder and CEO of Upwind, explained why precise visibility is central to the product.
“Finding risk will always matter, but against attackers that move at machine speed, defense has to be active,” said Shachar. “Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit. That precision is what makes automatic blocking safe. Every blocked attempt costs the attacker time and money, while our customers’ business keeps running.”
When is it available?
Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.