In a recent post on AI and security, JPMorgan Chase wrote that “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.” Those two sentences describe a gap that has been widening across the industry, and it is the gap Upwind, the Cloud and AI security platform, set out to close with Upwind Response.
Announced on November 12, 2026, Upwind Response stops AI-driven attacks within seconds of detection and prevents attackers from moving deeper into a customer’s environment. It is available today to all Upwind customers.
Two Speeds
The security industry now operates at two speeds. On one side, attackers are faster than ever. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before its CVE was published. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock.
On the other side, remediation still depends on processes built for a slower era. Scanning, prioritizing, testing, and patching all take time. When a new flaw can be used within hours, a scan-and-patch cycle cannot close the window quickly enough.
Each of those steps exists for good reasons, but together they take longer than an attacker now needs.
Upwind is clear that finding risks and detecting attacks remain the foundation of cloud security. The issue is that detection without fast action leaves defenders aware of a threat but unable to stop it in time.
Put simply, knowing about a threat is no longer the hard part. Acting on it in time is, and that is where the gap opens.
The Backlog Problem
The pressure does not come only from new vulnerabilities. Backlogs of risky settings and unused permissions keep growing in cloud environments, and each one is a possible way in. Clearing those backlogs is important work, but it is not work that finishes in seconds.
Automatic remediation might seem like the natural fix. Many security teams, however, have resisted it, worried that false positives or over-reaching responses will lead to ongoing problems. A remediation tool that breaks things creates its own backlog.
That leaves many teams relying on manual action for the most time-sensitive part of the job.
Response as the Bridge
Upwind Response sits between detection and long-term remediation. Its role is to stop the attack in progress so that the rest of the work can proceed on a normal schedule.
When Upwind sees an attacker try to exploit a cloud application, Response cuts off that attacker’s access to the targeted service and stops the kill chain, without waiting for a person to act. Security teams decide which threats Response mitigates on its own and which need their approval, and every action is temporary and can be rolled back.
This division of labor matters. Response does not replace patching or configuration cleanup. It buys time for that work by stopping the attacker first.
Narrow by Design
The key to bridging the gap safely is precision. Response unifies signals across cloud, runtime, code, and identity to understand the full picture of a threat before acting.
When it spots an attacker executing a malicious activity, such as an attempt to exploit a vulnerability or take remote control of a server, Response blocks the attacker’s access point from reaching the specific service. This block works at the cloud network level, takes effect in seconds, and leaves normal customer traffic flowing.
The steps that follow are equally targeted. If an attacker gets further, Response can terminate a specific malicious process and keep it from starting again, avoiding large disruptions to regular operations. It can trim a compromised machine’s cloud identity so the machine loses access to object storage and databases. As a last resort, it can isolate the machine completely, taking it off the internet and the rest of the network while keeping a secure tunnel into it.
Each action addresses the attacker without forcing a broad outage, which is what makes it compatible with how businesses need to run.
Because each action is narrow, temporary, and visible, it is straightforward to review and roll back when needed.
Leadership View
Amiram Shachar, Co-Founder and CEO of Upwind, described why this level of precision is possible.
“Finding risk will always matter, but against attackers that move at machine speed, defense has to be active,” said Shachar. “Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit. That precision is what makes automatic blocking safe. Every blocked attempt costs the attacker time and money, while our customers’ business keeps running.”
Building Confidence Over Time
Upwind expects teams to adopt Response at their own pace. Organizations can start by requiring approvals before Response acts, then let the service act on its own as they gain confidence. Every action is temporary, visible, and can be easily rolled back.
This gradual model reflects the reality that trust in automation is earned. Teams can watch Response work under approval before allowing it to act independently.
Response also strengthens defenses across Upwind’s customer base. Each attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform, allowing every Upwind customer to achieve better security through the collective experience of their peers.
What Customers Get
Upwind Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Admins can enable it today within the console. Because it uses cloud- and AI-native primitives, there is no extra firewall to deploy.
For organizations caught between fast attackers and slower remediation, Response offers a way to stop the immediate threat while the longer work of fixing root causes continues.
Detection remains essential, and remediation remains necessary. Response is the piece that lets defenders act at the speed attackers now set.
Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.
