Upwind launches Response as AI-powered exploits outrun the patch cycle

Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before the day its CVE went public. That single figure explains why Upwind, the Cloud and AI security platform, has introduced Upwind Response, a capability designed to stop AI-driven attacks within seconds and keep intruders from going any further into a cloud environment.

The announcement, made on November 12, 2026, reflects a shift in how quickly defenders need to act. Waiting for a disclosure, a patch, and a maintenance window is a sequence that assumes attackers will wait too. Increasingly, they do not.

The Window Has Closed

For years, vulnerability management followed a familiar rhythm. A flaw was disclosed, teams scanned for it, and patches were scheduled. That rhythm depended on a gap between disclosure and exploitation. When a quarter of attacked vulnerabilities are exploited on or before publication, the gap effectively disappears for a large share of real-world threats.

That head start is what allowed patch programs to work. Without it, even a well-run program can find itself reacting after exploitation has already begun.

AI has accelerated this compression. AI agents can now probe an environment from hundreds of angles and chain dozens of small weaknesses into a breach. They can work around the clock to achieve success. A human attacker might give up after a few dead ends. An automated one simply keeps trying.

JPMorgan Chase put the problem plainly in a recent post on AI and security, writing:

“Vulnerability discovery and attack automation are moving at warp speed. Remediation is not.”

That mismatch is the market condition Upwind is responding to. Finding risks and detecting attacks remain the foundation of cloud security. But when a new flaw can be used within hours, a scan-and-patch cycle cannot close the window quickly enough. Backlogs of risky settings and unused permissions continue to pile up in the meantime. Each one is another potential entry point.

The result is a difficult position for defenders. Many know where their weaknesses are, yet fixing them takes longer than attackers need to use them.

Why Automation Stalled

The obvious answer would be to let software fix problems automatically. Many security teams have resisted that approach. Their worry has been that false positives or over-reaching responses would create a different set of ongoing problems, with legitimate traffic blocked and business services interrupted.

Upwind’s approach is built to get past that hesitation by being precise about what it touches and by keeping every action reversible.

That matters for adoption. A tool that teams trust enough to leave switched on provides far more protection than one held back because the risk of disruption feels too high.

What Upwind Is Shipping

Upwind Response unifies signals across cloud, runtime, code, and identity to understand the full picture of a threat. When Upwind sees an attacker try to exploit a cloud application, Response cuts off that attacker’s access to the targeted service and stops the kill chain, without waiting for a person to act.

The first line of action is a network block. When Response spots malicious activity, such as an attempt to exploit a vulnerability or to take remote control of a server, it blocks the attacker’s access point from reaching the specific service. This happens at the cloud network level and takes effect in seconds, while normal customer traffic keeps flowing.

That combination of speed and narrow targeting is what separates Response from a blunt shutdown.

Four Levels of Containment

Response is built to escalate in proportion to the threat:

The network block stops the attacker’s access point from reaching the targeted service.

If the attacker gets further, Response can terminate a specific malicious process and keep it from starting again, avoiding large disruptions to regular operations.

Response can trim a compromised machine’s cloud identity so that it loses access to object storage and databases.

As a last resort, Response isolates the machine completely, taking it off the internet and the rest of the network while keeping a secure tunnel into it.

Each level targets a narrower slice of the environment than a broad shutdown would, which is how Response limits collateral impact on the business.

The more forceful options remain available, but they are not where Response starts.

Teams Set the Pace

Security teams decide which threats Response mitigates on its own and which need their approval. Organizations can start with approvals required before Response acts, then let it act autonomously as confidence builds. Every action is temporary and visible, and teams can easily roll it back.

That flexibility allows each organization to set its own pace rather than adopting full automation on day one.

Amiram Shachar, Co-Founder and CEO of Upwind, tied the launch directly to the speed of today’s attackers.

“Finding risk will always matter, but against attackers that move at machine speed, defense has to be active,” Shachar said. “Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit. That precision is what makes automatic blocking safe. Every blocked attempt costs the attacker time and money, while our customers’ business keeps running.”

Learning Across the Customer Base

Response also contributes to a wider defensive effort. Every attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform. This allows every Upwind customer to achieve better security through the collective experience of their peers.

Where AI agents can test the same techniques against many targets, that shared knowledge gives defenders a way to benefit from attacks seen elsewhere.

That value compounds over time, as the platform’s knowledge grows with each attack it records.

Getting Started

Upwind Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already rely on. Admins can enable it today within the console. Because Response uses cloud- and AI-native primitives, there is no extra firewall to deploy.

Upwind Response is available today for all Upwind customers. More information and demo requests are available at https://www.upwind.io/response.