Upwind Unveils Response to Act on Cloud Threats Without Waiting for Manual Intervention

New York, United States, November 12th, 2026, FinanceWire

In security operations, the most expensive moments are often the ones spent waiting. An alert fires, and then the clock runs while someone confirms the threat and decides what to do. Against attackers that operate at machine speed, those minutes can decide the outcome.

Upwind, the Cloud and AI security platform, announced Upwind Response on November 12, 2026, to remove that wait. Response stops AI-driven attacks within seconds of detecting them and keeps attackers from moving deeper into a customer's environment, while security teams retain control over how and when it acts.

Where Time Gets Lost

Detection has become a strength for many cloud security programs. Upwind considers finding risks and detecting attacks to be the foundation of cloud security, and that remains true. The delay tends to appear after detection, in the handoff between an alert and an action.

An alert on its own changes nothing in the environment. Until someone acts on it, the attacker is still free to continue.

That delay has become harder to tolerate. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before its CVE was published. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock. They do not pause while a human reviews a ticket.

JPMorgan Chase described the imbalance in a recent post on AI and security, writing that "vulnerability discovery and attack automation are moving at warp speed. Remediation is not."

The gap between those two speeds is where attacks succeed.

Seconds Instead of a Queue

Response is designed to act in the time it takes to detect. When Upwind sees an attacker try to exploit a cloud application, Response cuts off that attacker's access to the targeted service and stops the kill chain, without waiting for a person to act.

To do this, it unifies signals across cloud, runtime, code, and identity, building a full picture of the threat. When it spots an attacker executing malicious activity, such as an attempt to exploit a vulnerability or take remote control of a server, it blocks the attacker's access point from reaching the specific service. The block works at the cloud network level and takes effect in seconds.

The result is that the time from detection to containment shrinks from however long a manual process takes to a matter of seconds.

Keeping the Business Running

Speed alone is not enough if it comes at the cost of uptime. Many security teams have resisted automatic remediation for exactly that reason: false positives or over-reaching responses can lead to ongoing problems.

Response is built to minimize that risk. Normal customer traffic keeps flowing when the network block is applied. If an attacker gets further, Response can terminate a specific malicious process and keep it from starting again, avoiding large disruptions to regular operations.

Response can also limit what a compromised machine can reach by trimming the machine's cloud identity so it loses access to object storage and databases. As a last resort, it isolates the machine completely, removing it from the internet and the rest of the network while keeping a secure tunnel into it.

Each of these options targets a narrow piece of the environment, which is what allows Response to act quickly without broad disruption to the systems teams keep running.

Amiram Shachar, Co-Founder and CEO of Upwind, emphasized that both sides of the equation matter. "Every blocked attempt costs the attacker time and money, while our customers' business keeps running," he said.

Built on What Teams Already Use

Response does not require a new detection stack. It is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Admins can enable it today within the console.

Because Response uses cloud- and AI-native primitives, there is no extra firewall to deploy. For security operations teams, that means the capability can be added to existing workflows without a separate infrastructure project.

Teams do not have to stand up and maintain a separate enforcement point to get automated blocking.

A Gradual Path to Autonomy

Removing the wait does not mean removing people from the decision. Security teams decide which threats Response mitigates on its own and which need their approval. Teams can begin by requiring approval before Response acts, then let it act independently as they gain confidence.

Every action is temporary, visible, and can be easily rolled back. That gives operations teams a clear record of what Response did and a straightforward way to reverse it.

For operations teams, that visibility makes it easier to trust automated actions and to explain them afterward.

Shachar connected the safety of this model to Upwind's visibility into customer environments.

"Finding risk will always matter, but against attackers that move at machine speed, defense has to be active," said Shachar. "Because Upwind sees what is actually happening on the servers running our customers' applications, we know exactly which address sent the attack and which service it hit. That precision is what makes automatic blocking safe."

The Backlog Behind the Alerts

The pressure on security teams is not limited to live attacks. Backlogs of risky settings and unused permissions keep growing, and each one is a possible way in. When a new flaw can be used within hours, a scan-and-patch cycle cannot close the window quickly enough.

Response gives teams a way to stop active attacks in seconds even while that longer-term work continues.

The two efforts work together: long-term remediation reduces exposure, while Response handles the attacks that arrive in the meantime.

Learning From Every Incident

Each attack Response handles is cataloged, anonymized, and added to the knowledge of the Upwind Platform. This allows every Upwind customer to achieve better security through the collective experience of their peers.

Every incident handled in one environment adds to what the platform can recognize in others.

Availability

Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.

Contact