Attackers have put AI to work. AI agents can now probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and keep at it around the clock until they succeed. Defense that relies on a human noticing, deciding, and acting is operating on a different clock.
Upwind, the Cloud and AI security platform, is closing that difference with Upwind Response. Announced on November 12, 2026, Response stops AI-driven attacks within seconds of detecting them and prevents attackers from moving deeper into a customer’s environment.
The premise is straightforward. If attackers are using automation to move faster, defenders need automation of their own to keep up.
A Mismatch in Tempo
The numbers show how fast exploitation has become. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before the CVE was published. In those cases, the attack was underway before the industry had even formally named the flaw.
When attacks move that quickly, the time defenders spend deciding what to do becomes part of the attacker’s advantage.
JPMorgan Chase wrote about this in a recent post on AI and security: “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.”
The pace of discovery has changed. The pace of fixing has not kept up.
The mismatch is not about effort or skill on the defender’s side. It is structural. When a new flaw can be used within hours, a scan-and-patch cycle cannot close the window quickly enough. And while teams work through that cycle, backlogs of risky settings and unused permissions keep growing, each one another possible way in.
No amount of extra effort fully closes a gap that is built into the process itself.
Answering Automation With Automation
Upwind continues to view finding risks and detecting attacks as the foundation of cloud security. Response adds what detection alone cannot provide: action at the same speed as the threat.
When Upwind sees an attacker try to exploit a cloud application, Response cuts off that attacker’s access to the targeted service and stops the kill chain. It does not wait for a person to act.
The time between seeing an attack and stopping it shrinks to seconds.
Amiram Shachar, Co-Founder and CEO of Upwind, put the case directly: “Finding risk will always matter, but against attackers that move at machine speed, defense has to be active.”
How Response Keeps Up
Speed starts with context. Response unifies signals across cloud, runtime, code, and identity to understand the full picture of a threat. With that picture in hand, it can act the moment it sees an attacker executing a malicious activity, such as an attempt to exploit a vulnerability or take remote control of a server.
Its first move is to block the attacker’s access point from reaching the specific service. Because the block works at the cloud network level, it takes effect in seconds. Normal customer traffic keeps flowing.
Speed and precision work together here. A fast response that hit the wrong target would create new problems. A fast response aimed at the right one simply ends the attempt.
If an attacker gets further, Response continues to act at speed. It can terminate a specific malicious process and keep it from starting again, avoiding large disruptions to regular operations. It can trim a compromised machine’s cloud identity so the machine loses access to object storage and databases. As a last resort, it can isolate the machine completely, taking it off the internet and the rest of the network while keeping a secure tunnel into it.
At every stage, the response keeps pace with the attack rather than trailing behind it.
Fast, but Not Reckless
Speed has historically been the reason teams hesitated to automate. Many security teams have resisted automatic remediation because they worry false positives or over-reaching responses will lead to ongoing problems.
That concern is reasonable. Speed without accuracy can cause as much disruption as the threat it is meant to stop.
Upwind’s position is that precision changes that calculation. “Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit,” Shachar said. “That precision is what makes automatic blocking safe.”
Response also keeps humans in charge of the rules. Security teams decide which threats it mitigates on its own and which need their approval. They can start by requiring approvals, then let Response act independently as they gain confidence. Every action is temporary, visible, and can be easily rolled back.
This combination lets teams adopt machine-speed defense without giving up oversight.
Turning the Persistence of AI Against Attackers
AI agents are persistent. They try, fail, and try again. Response turns that persistence into a cost. “Every blocked attempt costs the attacker time and money, while our customers’ business keeps running,” Shachar said.
Each attempt that Response blocks is also a lesson. Every attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform. This allows every Upwind customer to achieve better security through the collective experience of their peers. An attacker probing many environments may find that what failed in one is recognized in others.
That is a meaningful advantage in a landscape where the same automated techniques may be aimed at many organizations.
No New Infrastructure to Slow It Down
Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Because it uses cloud- and AI-native primitives, there is no extra firewall to deploy. Admins can enable it today within the console.
The faster Response can be switched on, the sooner a team can benefit from defense that matches the attacker’s tempo.
Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.