Upwind launches targeted cloud attack response to avoid taking applications offline

The new feature aims to contain attacks in progress with temporary, reversible controls, as evidence points to a shrinking window between vulnerability disclosure and exploitation.

Upwind has launched Response, a cloud-security feature designed to contain active attacks without automatically taking an entire application offline. Announced on 12 November 2026, the service is available to Upwind customers and is intended to act on threats as they unfold, rather than waiting for a security team to review an alert. The company says teams can decide which actions happen automatically and which require approval, with containment measures designed to be temporary and reversible. Upwind’s announcement and product information describe these as vendor capabilities, not independently verified performance results.

The launch comes as defenders face a narrowing window between the disclosure of a vulnerability and its exploitation. VulnCheck’s analysis of vulnerabilities added to its Known Exploited Vulnerabilities dataset in the first half of 2026 found evidence that 23.43 per cent had been exploited on or before the date their CVE was published. That proportion was lower than the 28.93 per cent recorded in 2025, but VulnCheck also found that the median time from publication to inclusion in its dataset fell from 120 days to 80 days. The figures describe the vulnerabilities and evidence covered by the study, rather than every attack in the wild.

JPMorganChase’s Global Technology Leadership Team has warned that “vulnerability discovery and attack automation are moving at warp speed. Remediation is not.” In its discussion of AI and business security, published on 2 November 2026, the bank argued that organisations need to make decisions about exposure, remediation and acceptable risk before an incident occurs. It also urged leaders to set clear escalation thresholds and identify who has authority to act in an emergency, preserving governance while enabling a rapid response.

Upwind says Response is intended to bridge the gap between identifying a threat and intervening. Its announcement describes the system as acting on evidence of an attack in progress, such as an attempt to exploit a vulnerability or take control of a server, rather than responding to a vulnerability finding alone. The company says it correlates runtime activity with cloud, code and identity context to identify the service under attack and restrict the attacker’s access to it at the cloud network level.

The proposed containment is deliberately narrow: Upwind says ordinary customer traffic can continue while access to the targeted service is blocked. If an intrusion advances, the company says Response can stop a malicious process and prevent it from restarting, restrict a compromised workload’s access to cloud resources such as databases or object storage, or isolate a machine while preserving a secure route for security teams to reach it. These descriptions come from the vendor; the precise suitability and effects of such actions will depend on how a system is configured.

Upwind’s wider platform documentation describes runtime monitoring through Sensors and Tracers on virtual machines, containers and serverless workloads. The company says these tools observe processes, files and system activity, as well as application traffic, and use that information to build a picture of behaviour while workloads are running. That context can help distinguish a live, reachable vulnerability from a theoretical risk, although the documentation does not independently verify every Response feature or its performance.

Automation has long presented a dilemma for security teams: a mistaken intervention can disrupt legitimate business activity, while requiring approval for every action may cost valuable time. Upwind says organisations can begin with approval requirements and move towards automatic action as confidence grows. It also says its measures can be rolled back. JPMorganChase’s guidance similarly stresses the importance of establishing authority and decision rules in advance, rather than improvising governance during an incident.

Upwind also says attacks encountered by Response are anonymised and added to the platform’s shared knowledge. The company has not provided independent performance evidence in the supplied materials to substantiate claims about the speed or effectiveness of containment, or the benefits of this collective learning. For organisations considering the service, the central questions will include how its controls operate in their cloud environments, what permissions they require and how rollback safeguards work in practice.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

Source: Fuse Wire Services