A security control that stops an attacker but also stops paying customers is a control most businesses will eventually switch off. That tension has shaped how cautiously organizations approach automated defense, and it is the problem Upwind, the Cloud and AI security platform, addresses with Upwind Response.
Announced on November 12, 2026, Upwind Response stops AI-driven attacks within seconds of detection and prevents attackers from moving deeper into a customer’s environment. Its defining trait is restraint: it targets the attacker and the specific service under attack, and leaves everything else running.
The Cost of Blocking Too Much
Security teams have long weighed automatic remediation against the risk of collateral damage. Many have resisted it, concerned that false positives or over-reaching responses would lead to ongoing problems. A broad block can cut off legitimate users. An aggressive shutdown can take down a service the business depends on.
That concern is reasonable, and it has kept many organizations relying on manual review even as attacks have sped up. Upwind built Response so that teams no longer have to choose between acting quickly and keeping the business online.
The goal is a response that is fast enough to matter and narrow enough to leave legitimate activity untouched.
Targeting the Attacker, Not the Application
Response starts by understanding the threat in full. It unifies signals across cloud, runtime, code, and identity, so that when it acts, it knows which activity is malicious and where it is coming from.
When Response spots an attacker executing a malicious activity, such as an attempt to exploit a vulnerability or take remote control of a server, it blocks the attacker’s access point from reaching the specific service. The block works at the cloud network level and takes effect in seconds. Normal customer traffic keeps flowing.
For a customer using the application, nothing changes. For the attacker, the route to the targeted service is closed.
Amiram Shachar, Co-Founder and CEO of Upwind, explained why that level of targeting is achievable.
“Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit,” Shachar said. “That precision is what makes automatic blocking safe.”
Small Actions Before Big Ones
The same principle carries through every step Response can take. If an attacker gets further, Response can terminate a specific malicious process and keep it from starting again. Ending one process instead of restarting systems avoids large disruptions to regular operations.
Response can also limit what a compromised machine can reach by trimming that machine’s cloud identity so it loses access to object storage and databases. The machine stays up, but the attacker’s path to data is closed.
Only as a last resort does Response isolate the machine completely, taking it off the internet and the rest of the network. Even then, a secure tunnel into the machine is maintained.
This ordering means the business absorbs as little disruption as possible at every stage of an attack.
It also gives teams a clearer picture of what was affected, because each action is limited in scope.
Why Waiting Is No Longer an Option
Precision would matter less if teams had time to review every alert. They increasingly do not. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before the CVE was published. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock to achieve success.
JPMorgan Chase described the imbalance in a recent post on AI and security, writing that “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.”
Upwind holds that finding risks and detecting attacks remain the foundation of cloud security. But when a new flaw can be used within hours, a scan-and-patch cycle cannot close the window quickly enough. Backlogs of risky settings and unused permissions keep growing too, and each one is a possible way in.
That is why Response is built to act without waiting for a person: when Upwind sees an attacker try to exploit a cloud application, Response cuts off the attacker’s access to the targeted service and stops the kill chain.
Control That Matches Comfort Level
Teams set the boundaries. Security teams decide which threats Response mitigates on its own and which need their approval. They can begin by requiring approval for every action and allow Response more independence as they gain confidence.
Every action is temporary, visible, and can be easily rolled back. If something needs to be reversed, the path to reverse it is already there.
That reversibility is part of what makes it reasonable to let Response act on its own, since no action is permanent.
Uptime as a Security Outcome
Shachar framed the business case in terms of both the attacker and the customer.
“Finding risk will always matter, but against attackers that move at machine speed, defense has to be active,” he said. “Every blocked attempt costs the attacker time and money, while our customers’ business keeps running.”
In that framing, keeping services available is part of the security result, not a trade-off against it.
It reflects a simple principle: a defense that disrupts the business is a defense that eventually gets turned off.
A Wider Benefit
Response also strengthens the broader customer community. Each attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform, so every Upwind customer can achieve better security through the collective experience of their peers.
The precision that protects customer traffic also makes each recorded attack more useful, since the platform knows exactly which address attacked which service.
Availability
Upwind Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Admins can enable it today within the console, and because Response uses cloud- and AI-native primitives, there is no extra firewall to deploy.
Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.
