Cloud security programs have invested heavily in seeing their environments clearly. They map risks, inventory configurations, and detect suspicious activity. Upwind, the Cloud and AI security platform, considers that work the foundation of the discipline. With its latest announcement, the company is extending that foundation into the moment an attack is actually happening.
On November 12, 2026, Upwind announced Upwind Response, a capability that stops AI-driven attacks within seconds of detection and prevents attackers from moving deeper into a customer’s environment. When Upwind sees an attacker try to exploit a cloud application, Response cuts off that attacker’s access to the targeted service and stops the kill chain, without waiting for a person to act.
The move reflects a clear view about where cloud security needs to go next: from understanding risk toward acting on it in the moment.
The Limits of Seeing Without Acting
Visibility tells a security team what is wrong. It does not, by itself, stop an attacker who is already working. For a long time that was acceptable, because the gap between disclosure and exploitation gave teams room to respond through normal processes.
Seeing is necessary. It is no longer sufficient.
That room has largely closed. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before its CVE was published. When a new flaw can be used within hours, a scan-and-patch cycle cannot close the window quickly enough.
The backlog compounds the issue. Risky settings and unused permissions keep growing in cloud environments, and each represents a possible way in. Teams can see these exposures, but working through them takes time that attackers do not provide.
Visibility, in this situation, identifies the problem without solving it.
Attackers Have Changed the Equation
The acceleration is tied closely to AI. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock to achieve success. They do not tire, and they do not wait for business hours.
That persistence turns every unaddressed exposure into a standing opportunity for them.
JPMorgan Chase described the resulting imbalance in a recent post on AI and security, writing that “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.”
In strategic terms, the defender’s bottleneck has moved. It is no longer primarily about finding problems. It is about acting on them fast enough to matter.
That shift has implications for how security programs are designed. Tools that only report need to be paired with tools that can act.
Why Automation Has Been Slow to Arrive
If action is the bottleneck, automation is the obvious lever. Yet many security teams have resisted automatic remediation. Their concern is that false positives or over-reaching responses will lead to ongoing problems, creating disruption that outweighs the protection.
The tension between speed and safety has long been one of the defining challenges of security operations.
Upwind’s approach to that concern rests on context and control. Response unifies signals across cloud, runtime, code, and identity to understand the full picture of a threat. Security teams decide which threats Response mitigates on its own and which need their approval, and every action is temporary and can be rolled back.
Those two elements, context before action and human control over action, form the basis of Upwind’s answer.
Amiram Shachar, Co-Founder and CEO of Upwind, linked the shift directly to that visibility.
“Finding risk will always matter, but against attackers that move at machine speed, defense has to be active,” said Shachar. “Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit. That precision is what makes automatic blocking safe.”
How Visibility Becomes Action
Response translates what Upwind sees into specific, limited interventions.
When it spots an attacker executing a malicious activity, such as an attempt to exploit a vulnerability or take remote control of a server, it blocks the attacker’s access point from reaching the specific service. The block works at the cloud network level, takes effect in seconds, and leaves normal customer traffic flowing.
If the attacker gets further, Response can terminate a specific malicious process and keep it from starting again, avoiding large disruptions to regular operations. It can trim a compromised machine’s cloud identity so the machine loses access to object storage and databases. As a last resort, it can isolate the machine completely, taking it off the internet and the rest of the network while keeping a secure tunnel into it.
Each step reflects the same idea: precise knowledge of the attack allows a precise response to it.
The more an organization knows about an attack, the less force it needs to stop it.
An Industry Dimension
Response also adds a collective layer to cloud defense. Each attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform. This allows every Upwind customer to achieve better security through the collective experience of their peers, helping the industry become more resilient overall.
Shachar noted the shift in economics that results. “Every blocked attempt costs the attacker time and money, while our customers’ business keeps running,” he said.
Viewed strategically, that changes the economics of attacking a well-defended cloud environment.
Adoption on the Customer’s Terms
Upwind Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Admins can enable it today within the console. Because Response uses cloud- and AI-native primitives, there is no extra firewall to deploy.
For customers already using Upwind for visibility, Response extends the same platform they already rely on.
Teams can start by requiring approvals before Response acts, then let it act on its own as they gain confidence. Every action is temporary, visible, and can be easily rolled back.
This model allows visibility and action to grow together, with each organization deciding how quickly to move from one to the other.
Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.
