Upwind Response operates on a simple principle: act on the smallest possible target first, and widen the action only if the attacker keeps going. Upwind, the Cloud and AI security platform, announced the new capability on November 12, 2026, positioning it as a way to stop AI-driven attacks within seconds of detection while keeping normal business traffic moving.
Response is designed to do more than block a single request. Its purpose is to stop the kill chain early and keep attackers from moving deeper into a customer’s environment, with each layer narrowing what an intruder can still do.
The design is worth examining layer by layer, because the order of operations is central to how Upwind approaches automated defense.
Signals Come First
Before Response takes any action, it needs to know what it is looking at. Upwind Response unifies signals across four domains: cloud, runtime, code, and identity. Bringing those together gives it the full picture of a threat, rather than a single alert viewed in isolation.
This matters because the decisions that follow are automatic. Response is built to act when it sees an attacker executing a malicious activity, such as an attempt to exploit a vulnerability or take remote control of a server. The combined context is what lets it identify the attacker’s access point and the specific service being targeted.
In effect, the signal layer is what separates a precise response from a guess.
Layer One: The Network Block
The first action is the most targeted. Response blocks the attacker’s access point from reaching the specific service under attack. The block is applied at the cloud network level and takes effect in seconds.
Two details define this layer. First, it does not wait for a person to act, so the kill chain is cut off before the attacker can progress. Second, normal customer traffic keeps flowing. The block applies to the attacker and the targeted service, not to every user of the application.
Layer Two: Process Termination
If an attacker gets past the initial stage, Response can move to the workload itself. It can terminate a specific malicious process and keep that process from starting again.
The emphasis here is on the word “specific.” Rather than restarting a server or taking down an application, Response ends the one process the attacker is using. That approach avoids large disruptions to regular operations, which is a frequent concern when automated tools are allowed to intervene on production systems.
Layer Three: Identity Trimming
Cloud workloads carry identities that determine what they can reach. When a machine is compromised, that identity effectively becomes the attacker’s set of permissions.
Response can limit the damage by trimming the compromised machine’s cloud identity so it loses access to object storage and databases. The machine may still be running, but the routes to sensitive data are cut.
Layer Four: Full Isolation
The final layer is reserved for the most serious cases. As a last resort, Response isolates the machine completely, taking it off the internet and off the rest of the network. A secure tunnel into the machine is kept in place, so the security team can still reach it after isolation.
Each layer serves as a fallback for the one before it, so the force applied rises only as the attack advances.
Why the Design Favors Precision
The layered structure reflects a long-standing problem with automatic remediation. Many security teams have resisted it because they worry that false positives or over-reaching responses will lead to ongoing problems. A tool that shuts down too much, too often, quickly loses the trust of the people running the business.
Amiram Shachar, Co-Founder and CEO of Upwind, pointed to visibility as the factor that makes automation workable.
“Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit,” said Shachar. “That precision is what makes automatic blocking safe.”
He added that the effect is felt on both sides of an attack: “Every blocked attempt costs the attacker time and money, while our customers’ business keeps running.”
Shachar also summarized the broader philosophy behind the product: “Finding risk will always matter, but against attackers that move at machine speed, defense has to be active.”
Controls and Reversibility
Every Response action is temporary, visible, and can be easily rolled back. Security teams decide which threats Response mitigates on its own and which require approval. Teams can begin with approvals required for every action, then allow Response to act autonomously as they gain confidence.
Deployment Without New Hardware
Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Because it relies on cloud- and AI-native primitives, there is no extra firewall to deploy. Admins can enable it today within the console.
The platform also learns from each incident. Every attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform, so each customer benefits from the collective experience of their peers.
The Threat Behind the Build
The case for this architecture rests on how quickly attacks now unfold. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before the CVE was published. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock.
JPMorgan Chase addressed this in a recent post on AI and security, writing that “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.”
When a new flaw can be used within hours, a scan-and-patch cycle cannot close the window fast enough, and backlogs of risky settings and unused permissions keep growing. Response is Upwind’s answer to that gap.
None of this diminishes the role of visibility. Upwind maintains that finding risks and detecting attacks remain the foundation of cloud security. Response is the layer that turns those detections into action when an attacker is already at work.
Upwind Response is available today for all Upwind customers. Details and demo requests are available at https://www.upwind.io/response.
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.