When Upwind Response stops an attack, the result does not stay with one customer. Each attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform, so every Upwind customer can achieve better security through the collective experience of their peers.
That shared-defense model is one of the defining features of Upwind Response, announced on November 12, 2026, by Upwind, the Cloud and AI security platform. Response stops AI-driven attacks within seconds of detection and prevents attackers from moving deeper into a customer’s environment, and it is designed to make the industry more resilient overall in the process.
It reflects a view that cloud defense works better as a shared effort than as a series of isolated ones.
An Attack Stopped Once Informs Everyone
Attackers using AI do not target one organization at a time in isolation. Automated tools can try the same approaches across many environments. A defensive model where each organization learns only from its own incidents leaves every customer starting from scratch.
That gap is especially costly when attacks move at machine speed.
Upwind’s approach changes that. Because every attack Response encounters becomes part of the platform’s knowledge, the experience of one customer contributes to the protection of others. The anonymization step ensures that this shared knowledge does not expose details about the organization where the attack occurred.
In practice, this means an organization does not have to experience an attack first in order to benefit from what has been learned about it.
What Response Actually Does
At the level of a single environment, Response acts quickly and narrowly. When Upwind sees an attacker try to exploit a cloud application, Response cuts off that attacker’s access to the targeted service and stops the kill chain, without waiting for a person to act.
Response unifies signals across cloud, runtime, code, and identity to understand the full picture of a threat. When it spots an attacker executing a malicious activity, such as attempting to exploit a vulnerability or take remote control of a server, it blocks the attacker’s access point from reaching the specific service. That block operates at the cloud network level and takes effect in seconds, while normal customer traffic keeps flowing.
The precision of that first action is what makes it practical to run automatically. It is also what makes each recorded attack useful, because the platform knows which address sent the attack and which service it hit.
Containment in Stages
If an attack progresses, Response has further options, each applied only as needed.
It can terminate a specific malicious process and keep it from starting again. This avoids large disruptions to regular operations.
It can limit what a compromised machine can reach by trimming that machine’s cloud identity, so the machine loses access to object storage and databases.
As a last resort, it can isolate the machine completely, taking it off the internet and the rest of the network while keeping a secure tunnel into it.
Each stage gives Response another opportunity to stop the attack, and each recorded attack adds to the platform’s understanding of how such sequences unfold.
Why Now
Attackers have gained speed. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before the CVE was published. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock to achieve success.
In a recent post on AI and security, JPMorgan Chase wrote that “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.”
Finding risks and detecting attacks remain the foundation of cloud security. But a scan-and-patch cycle cannot close the window quickly enough when a new flaw can be used within hours. Backlogs of risky settings and unused permissions keep growing, and each one is another potential entry point.
Shared intelligence helps here. If AI agents are testing techniques broadly, a defense that pools what it learns across customers is better positioned to recognize those techniques.
Seen this way, collective learning and automatic blocking reinforce each other. Blocking stops the attack in front of a customer, and the knowledge gained from it improves defenses across the platform.
Control and Reversibility
Automatic remediation has historically met resistance from security teams worried about false positives and over-reaching responses. Response addresses those concerns with clear controls.
Security teams decide which threats Response mitigates on its own and which require their approval. They can start with approvals required, then let Response act autonomously as their confidence grows. Every action is temporary, visible, and can be easily rolled back.
Those controls apply regardless of how much the platform has learned. Teams decide how much autonomy Response has in their own environment.
Shachar on Precision
Amiram Shachar, Co-Founder and CEO of Upwind, explained that Upwind’s view inside customer environments is what makes automatic blocking possible.
“Finding risk will always matter, but against attackers that move at machine speed, defense has to be active,” said Shachar. “Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit. That precision is what makes automatic blocking safe. Every blocked attempt costs the attacker time and money, while our customers’ business keeps running.”
Taken together with the shared-knowledge model, that precision means each blocked attempt has value beyond the moment: it protects one customer immediately and adds to what the platform knows for all customers.
Availability
Upwind Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Admins can enable it today within the console. Because it uses cloud- and AI-native primitives, there is no extra firewall to deploy.
Customers who enable it begin contributing to, and benefiting from, the platform’s shared knowledge.
Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.
