“Every blocked attempt costs the attacker time and money, while our customers’ business keeps running.”
Amiram Shachar, Co-Founder and CEO of Upwind, used that line to describe the impact of Upwind Response, which the Cloud and AI security platform announced on November 12, 2026. It points to a dimension of security that often goes unspoken: attacks are an investment, and defenders can make that investment less rewarding.
Every attack attempt takes time and effort to prepare and run.
Response stops AI-driven attacks within seconds of detection and prevents attackers from moving deeper into a customer’s environment. Each time it does, the attacker’s effort produces nothing.
That reframing turns defense into more than damage control. It becomes a way to make attacking less worthwhile.
The Economics of Automated Attacks
AI has made attacking cheaper and more persistent. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock to achieve success. For attackers, automation means more attempts at lower effort.
The economics have tilted in the attacker’s favor.
The results show up in exploitation timelines. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before the CVE was published.
The faster a vulnerability can be exploited, the sooner an attacker sees a return on the effort.
JPMorgan Chase described the situation in a recent post on AI and security, writing that “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.”
For defenders, that imbalance has been costly. When a new flaw can be used within hours, a scan-and-patch cycle cannot close the window quickly enough. Backlogs of risky settings and unused permissions keep growing, and each one gives attackers another option to try.
Upwind’s position is that finding risks and detecting attacks remain the foundation of cloud security. On their own, however, they do not change the attacker’s math.
Shifting the Cost Back
Upwind’s approach is to make each attempt count against the attacker. When Upwind sees an attacker try to exploit a cloud application, Response cuts off that attacker’s access to the targeted service and stops the kill chain, without waiting for a person to act.
The key is that the cost lands on the right side. Blocking an attacker should not mean penalizing the business. Response unifies signals across cloud, runtime, code, and identity to understand the full picture of a threat, so it can act on the attacker specifically.
A blunt block would shift some of the cost onto legitimate users. A precise one keeps it where it belongs.
When Response spots an attacker executing a malicious activity, such as an attempt to exploit a vulnerability or take remote control of a server, it blocks the attacker’s access point from reaching the specific service. The block works at the cloud network level and takes effect in seconds, and normal customer traffic keeps flowing.
From the attacker’s perspective, the attempt simply fails. From the customer’s perspective, business continues.
Every Stage Is Another Loss for the Attacker
Attackers who get past the first stage face further setbacks.
Response can terminate a specific malicious process and keep it from starting again. The foothold an attacker worked to establish disappears, while regular operations avoid large disruptions.
That is time and effort the attacker has to spend again.
Response can trim a compromised machine’s cloud identity so it loses access to object storage and databases. The data the attacker was likely after is no longer reachable from that machine.
In economic terms, the most valuable prize in the environment is taken off the table.
As a last resort, Response can isolate the machine completely, taking it off the internet and the rest of the network while keeping a secure tunnel into it for the security team.
Even then, the defender keeps access to the machine.
Accuracy Protects the Defender’s Side of the Ledger
Automation has its own costs if it misfires. Many security teams have resisted automatic remediation because they worry false positives or over-reaching responses will lead to ongoing problems.
Shachar pointed to visibility as the factor that keeps those costs in check.
“Finding risk will always matter, but against attackers that move at machine speed, defense has to be active,” he said. “Because Upwind sees what is actually happening on the servers running our customers’ applications, we know exactly which address sent the attack and which service it hit. That precision is what makes automatic blocking safe.”
Precision, in this sense, is what lets Response raise the attacker’s costs without raising the defender’s.
Security teams also control the scope. They decide which threats Response mitigates on its own and which need approval. They can begin with approvals required and allow more autonomy as they gain confidence. Every action is temporary, visible, and can be easily rolled back.
That control matters for the defender’s own costs. An automated action that can be reviewed and reversed carries far less risk than one that cannot.
Knowledge That Compounds
The benefit extends across Upwind’s customer base. Each attack is cataloged, anonymized, and added to the knowledge of the Upwind Platform. This allows every Upwind customer to achieve better security through the collective experience of their peers.
For attackers relying on automation to try the same approaches broadly, that shared knowledge adds yet another obstacle.
The more attempts the platform sees, the better positioned every customer becomes.
Low Cost to Adopt
Just as Response raises costs for attackers, Upwind has kept adoption costs low for customers. Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Because it uses cloud- and AI-native primitives, there is no extra firewall to deploy. Admins can enable it today within the console.
That keeps the balance where Upwind wants it: expensive for attackers, easy for the teams defending against them.
Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.