“Finding risk will always matter, but against attackers that move at machine speed, defense has to be active.”
That statement from Amiram Shachar, Co-Founder and CEO of Upwind, sums up the thinking behind Upwind Response, which the Cloud and AI security platform announced on November 12, 2026. Response stops AI-driven attacks within seconds of detecting them and prevents attackers from moving deeper into a customer’s environment. It marks a clear step from identifying threats toward stopping them as they happen.
The launch draws a clear line between two jobs that are often treated as one: knowing about a threat and stopping it.
From Finding to Stopping
Cloud security has long centered on visibility: knowing where the risks are and spotting attacks when they occur. Upwind maintains that this work remains the foundation. Detection is still how defenders know something is wrong.
The limitation is what happens between detection and action. In many organizations, an alert is the start of a process rather than the end of one. Someone has to review it, confirm it, and decide what to do. When attackers moved at human speed, that delay was manageable. Today it is far harder to absorb.
Response closes that distance. When Upwind sees an attacker try to exploit a cloud application, Response cuts off the attacker’s access to the targeted service and stops the kill chain, without waiting for a person to act.
That is the practical meaning of active defense. Detection still raises the flag, but the response no longer has to wait in line behind it.
The Machine-Speed Problem
The urgency comes from how attacks now operate. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before the day the CVE was published. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and continue working around the clock.
The pressure on defenders is constant rather than occasional.
JPMorgan Chase captured the problem in a recent post on AI and security, writing that “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.”
This is where the traditional cycle breaks down. When a new flaw can be used within hours, scanning and patching cannot close the window fast enough. Backlogs of risky settings and unused permissions continue to grow, and each one is another possible entry point.
For defenders, this creates an uncomfortable reality. The list of things to fix grows faster than it can be cleared, and an attacker only needs one item on it to get in.
Precision as the Enabler
Active defense only works if it is accurate. Many security teams have resisted automatic remediation because they worry false positives or over-reaching responses will cause ongoing problems.
Shachar’s answer to that concern is visibility. “Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit,” he said. “That precision is what makes automatic blocking safe.”
Response draws on that visibility by unifying signals across cloud, runtime, code, and identity. With the full picture of a threat in view, it can act on the attacker’s access point and the specific service being targeted, instead of shutting down broader parts of the environment.
This is the difference between active defense and blunt defense. Acting quickly is only useful if the action lands on the right target.
A Graduated Response
Response matches its actions to how far an attack has progressed.
When it detects malicious activity, such as an attempt to exploit a vulnerability or take remote control of a server, Response blocks the attacker’s access point from reaching the specific service. The block operates at the cloud network level, takes effect in seconds, and leaves normal customer traffic flowing.
If the attacker gets further, Response can terminate a specific malicious process and keep it from starting again. This avoids large disruptions to day-to-day operations.
It can also trim a compromised machine’s cloud identity so the machine loses access to object storage and databases, limiting what an attacker can reach.
As a last resort, Response isolates the machine entirely, removing it from the internet and the rest of the network while keeping a secure tunnel into it.
Each step represents a further commitment, and Response only takes it when the previous step has not been enough.
Raising the Cost of Attack
Active defense also changes the economics for attackers. “Every blocked attempt costs the attacker time and money, while our customers’ business keeps running,” Shachar said.
That framing matters in an era of automated attacks. AI agents can try again and again, but each blocked attempt is effort that does not pay off.
Over time, that shifts the balance. Attackers relying on volume and persistence find their effort being spent without a return.
Control and Confidence
Moving to active defense does not mean handing over control. Security teams decide which threats Response mitigates on its own and which need their approval. Teams can begin by requiring approvals, then allow Response to act autonomously as they gain confidence. Every action is temporary, visible, and can be easily rolled back.
This approach lets each organization decide for itself how active its defense should be, and change that decision as its comfort grows.
Shared Defense
Response also helps strengthen the industry as a whole. Each attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform, which allows every Upwind customer to achieve better security through the collective experience of their peers.
Active defense in one environment, in other words, becomes better-informed defense in the next.
Availability
Upwind Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Admins can enable it today within the console. Because it uses cloud- and AI-native primitives, there is no extra firewall to deploy.
Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.
