For Upwind customers, turning on automated attack blocking now takes a setting change rather than a deployment project. Upwind, the Cloud and AI security platform, announced Upwind Response on November 12, 2026, and admins can enable it today directly within the Upwind console.
Response stops AI-driven attacks within seconds of detection and prevents attackers from moving deeper into a customer’s environment. Because it uses cloud- and AI-native primitives, there is no extra firewall to deploy, no new appliance to manage, and no separate detection layer to stand up.
For many teams, the effort involved in deploying a new security control is reason enough to delay it. Response is designed to remove that obstacle.
Built on Existing Detections
Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. The signals and insights teams rely on today become the trigger for action.
Under the hood, Response unifies signals across cloud, runtime, code, and identity to understand the full picture of a threat. That combined view is what allows it to act with confidence when it identifies an attacker.
Because the detections are already in place, enabling Response does not mean starting over. It means letting those detections lead directly to action.
What Happens After It Is Switched On
Once enabled, Response watches for attackers executing malicious activity, such as an attempt to exploit a vulnerability or take remote control of a server. When Upwind sees an attacker try to exploit a cloud application, Response cuts off that attacker’s access to the targeted service and stops the kill chain, without waiting for a person to act.
The first action is a block applied at the cloud network level. It prevents the attacker’s access point from reaching the specific service and takes effect in seconds. Normal customer traffic keeps flowing.
Legitimate users carry on as before, while the attacker loses its path to the service it was targeting.
Further actions are available if the attacker gets further:
Response can terminate a specific malicious process and keep it from starting again, avoiding large disruptions to regular operations.
Response can trim a compromised machine’s cloud identity so it loses access to object storage and databases.
As a last resort, Response can isolate the machine completely, taking it off the internet and the rest of the network while keeping a secure tunnel into it.
Each of these actions is visible to the team and can be reversed.
A Recommended Starting Point
Upwind has designed the rollout so teams can move at a comfortable pace. Organizations can start by requiring approvals before Response acts, reviewing each proposed action before it takes effect. As they gain confidence, they can let the service act on its own.
Security teams decide which threats Response mitigates automatically and which need their approval. That allows a team to automate the cases it is most comfortable with first while keeping a human checkpoint on others.
This flexibility lets each organization match automation to its own risk tolerance rather than accepting a single default.
Every action Response takes is temporary, visible, and can be easily rolled back. Teams can see what was done and undo it if needed.
That reversibility is what makes it practical to extend automation gradually over time.
Why Upwind Made It This Simple
The ease of adoption reflects a hard reality. Many security teams have resisted automatic remediation, worried that false positives or over-reaching responses would lead to ongoing problems. A complicated deployment would only add to the hesitation. A capability that switches on in the console, starts in approval mode, and can be rolled back lowers the barrier considerably.
The need is pressing. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before its CVE was published. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock to achieve success.
JPMorgan Chase addressed this directly in a recent post on AI and security, writing that “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.”
Finding risks and detecting attacks remain the foundation of cloud security. But when a new flaw can be used within hours, a scan-and-patch cycle cannot close the window quickly enough. Meanwhile, backlogs of risky settings and unused permissions keep growing, and each one is a possible way in.
That is the gap Response is designed to cover while the longer-term work of reducing exposure continues.
The Thinking Behind It
Amiram Shachar, Co-Founder and CEO of Upwind, described what makes automatic blocking a safe default.
“Finding risk will always matter, but against attackers that move at machine speed, defense has to be active,” said Shachar. “Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit. That precision is what makes automatic blocking safe. Every blocked attempt costs the attacker time and money, while our customers’ business keeps running.”
Shachar’s point connects directly to the rollout model. Because the actions are precise, teams can extend automation step by step with confidence that the business will keep running.
Value That Grows Over Time
Customers who enable Response also contribute to a wider pool of knowledge. Each attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform. This allows every Upwind customer to achieve better security through the collective experience of their peers, helping the industry become more resilient overall.
Every customer that switches Response on adds to that shared knowledge.
How to Get It
Upwind Response is available today for all Upwind customers. Admins can enable it within the console now. To learn more or request a demo, visit https://www.upwind.io/response.