Upwind Introduces Response to Contain Compromised Cloud Workloads and Protect Data

New York, United States, November 12th, 2026, FinanceWire

In the cloud, a compromised machine is rarely the attacker's final goal. The machine is a means to an end, and that end is usually data. What a compromised workload can reach, through its cloud identity and permissions, often determines how serious an incident becomes.

Upwind, the Cloud and AI security platform, has built that reality into Upwind Response, announced on November 12, 2026. Response stops AI-driven attacks within seconds of detection and prevents attackers from moving deeper into a customer's environment, including by cutting a compromised machine off from the data stores it would otherwise be able to reach.

Containing a compromised machine, in other words, is as much about what it can reach as about the machine itself.

Identity as the Attacker's Pathway

Cloud machines operate with identities that grant them access to other resources. When an attacker takes control of a machine, those identities can become a pathway to sensitive information.

In many incidents, it is that access, rather than the initial foothold, that determines how much damage can be done.

Response can close that pathway. It limits what a compromised machine can reach by trimming that machine's cloud identity so it loses access to object storage and databases. The machine may still be under investigation, but its ability to serve as a bridge to data is removed.

The change is aimed at what the machine can reach, not at whether it keeps running.

This capability addresses a broader concern as well. Backlogs of risky settings and unused permissions keep growing in cloud environments, and each one is a possible way in. Response gives teams a way to act on a compromised identity at the moment it matters, even while longer-term cleanup continues.

Each unused permission is a door that does not need to be open. When a machine holding such permissions is compromised, those doors become available to the attacker.

Stopping the Attack Earlier

Identity trimming is one step in a larger sequence. Response is designed to stop attacks as early as possible.

The earlier an attack is stopped, the less chance there is that the attacker ever reaches the data.

It unifies signals across cloud, runtime, code, and identity to understand the full picture of a threat. When Upwind sees an attacker try to exploit a cloud application, Response cuts off that attacker's access to the targeted service and stops the kill chain, without waiting for a person to act.

Specifically, when Response spots malicious activity, such as an attempt to exploit a vulnerability or take remote control of a server, it blocks the attacker's access point from reaching the specific service. The block works at the cloud network level, takes effect in seconds, and keeps normal customer traffic flowing.

If the attacker gets further, Response can terminate a specific malicious process and keep it from starting again, avoiding large disruptions to regular operations. Identity trimming follows if needed. As a last resort, Response can isolate the machine completely, taking it off the internet and the rest of the network while keeping a secure tunnel into it.

Each step narrows what the attacker can do, and identity trimming specifically targets the route to data.

Why Speed Matters for Data

The faster an attacker moves from foothold to data, the less time defenders have. AI has shortened that path. AI agents can probe an environment from hundreds of angles, chain dozens of small weaknesses into a breach, and work around the clock to achieve success.

Each minute an attacker spends inside an environment is time spent looking for a path to valuable information.

Exploitation itself is happening sooner. Nearly one in four vulnerabilities attacked in the first half of 2026 was exploited on or before the CVE was published.

JPMorgan Chase described the gap in a recent post on AI and security, writing that "vulnerability discovery and attack automation are moving at warp speed. Remediation is not."

Finding risks and detecting attacks remain the foundation of cloud security. But when a new flaw can be used within hours, a scan-and-patch cycle cannot close the window quickly enough to protect the data behind it.

Precision Keeps Operations Intact

Many security teams have resisted automatic remediation, worried that false positives or over-reaching responses would lead to ongoing problems. Response is designed to avoid those outcomes by acting narrowly: one attacker's access point, one malicious process, one machine's identity.

That narrow focus applies to identity as well. Trimming a machine's access to object storage and databases does not require taking the machine offline.

Amiram Shachar, Co-Founder and CEO of Upwind, explained the basis for that precision. "Finding risk will always matter, but against attackers that move at machine speed, defense has to be active," said Shachar. "Because Upwind sees what is actually happening on the servers running our customers' applications, we know exactly which address sent the attack and which service it hit. That precision is what makes automatic blocking safe. Every blocked attempt costs the attacker time and money, while our customers' business keeps running."

Teams Stay in Control

Security teams decide which threats Response mitigates on its own and which need their approval. They can start by requiring approvals before Response acts and expand its autonomy as they gain confidence. Every action is temporary, visible, and can be easily rolled back, including changes to a machine's cloud identity.

For teams cautious about changing identities in production, that reversibility is an important safeguard.

Collective Protection

Each attack Response encounters is cataloged, anonymized, and added to the knowledge of the Upwind Platform. This allows every Upwind customer to achieve better security through the collective experience of their peers.

Lessons from one attempt to reach data can inform defenses for every customer.

Availability

Upwind Response is part of the Upwind Cloud & AI Security Platform and builds on the detections customers already use. Admins can enable it today within the console. Because it uses cloud- and AI-native primitives, there is no extra firewall to deploy.

Upwind Response is available today for all Upwind customers. To learn more or request a demo, visit https://www.upwind.io/response.

Contact