The CVE Tsunami is here, Vulnpocalypse if you will. 

The exposed ones, not even the criticals, have led to ransomware, data theft, and remote code execution that disrupted live service. 

At Upwind, we have seen it firsthand. In recent weeks, enterprises around the world have suffered real breaches. Our MDR heroes have spent weekends, days and nights with customers helping them to detect fast and contain their attacks.

We came to a realization that detection, even the fastest detection, is no longer enough. We must respond, automatically, at the same speed as attacks. That’s why we are incredibly excited to announce the release of Upwind Response, a set of capabilities built to help defenders match the defense speed with the speed of AI-backed attackers.

The moment demands this from us at an unprecedented speed. What we launch today will stop attacks that would otherwise become breaches. 

Attackers move at AI Speed. This week, we matched them.

The CVE Tsunami is Here

This year’s numbers are not subtle. Of the 495 vulnerabilities VulnCheck confirmed as exploited in the wild during the first half of 2026, 23.43% showed evidence of exploitation on or before the day their CVE was published. 

The volume moved with it. The first half of 2026 produced 35,364 new CVEs, about 195 a day, a 49.5% increase over the same window in 2025. October alone ran at more than 550 a day. No triage process built for a hundred disclosures a day survives that.

The outcome shows up in the extortion numbers. October 2026 was the highest month on record across multiple leak-site trackers. HackerFeeds, working from ransomware. live data, recorded 1,147 victims, up 27.9%, across 81 active groups.

JPMorganChase’s Global Technology Leadership Team put the asymmetry in one line on November 2: Vulnerability discovery and attack automation are moving at warp speed. Remediation is not. (200 days into the frontier).

Attackers Put AI to Work First

Attackers are running AI agents against production environments. They probe an environment from hundreds of angles at once. They chain dozens of small weaknesses into a single path. They work around the clock. fast.

What used to take a skilled operator a week of reconnaissance now takes an agent an afternoon. The economics of a low-value target changed with it: when probing costs nothing, everything is worth probing.

We see the result in customer environments – attackers are looking at what was reachable, not what was rated as critical. Attackers have brought AI agents into the campaign, and it’s time for defenders to rise with better tools and capabilities.

Upwind Response

Upwind Response is a set of capabilities built to bring defenders up to the speed of AI-backed attackers.

Upwind Response stops AI-driven attacks within seconds of detecting them and prevents attackers from moving deeper into a customer’s environment. When Upwind sees an attacker try to exploit a cloud application, Response cuts off that attacker’s access to the targeted service and stops the kill chain, without waiting for a person to act.  Security teams decide which threats Response mitigates on its own and which need their approval, and every action is temporary and can be rolled back.

Available to every Upwind customer, existing or new, Upwind Response includes Runtime Containment that stops an attack while it is running. Threat Feed tells you if you are exposed and where a new threat touches your environment. And a new Issues feed puts everything that needs handling in one feed, accessible to agents through Upwind MCP.

1. Runtime Containment: Stopping Attackers in Seconds

Runtime Containment triggers when Upwind sees an attacker actually executing — exploiting a vulnerability through remote code execution, or taking remote control of a server. Not when a scanner finds a risk. When someone acts on one.

It cuts the attacker off at the cloud network level. Upwind blocks the attacker’s access to the specific service under attack, and the block takes effect in seconds. Normal customer traffic keeps flowing. The service stays up for everyone who is supposed to be using it.

If the attacker is already further in, it stops the process. Upwind terminates the malicious process on the host and prevents it from starting again. Containment covers two layers: the cloud network and the operating system process.

It acts on correlated evidence, not on a score. Every containment action traces back to observed runtime activity — the process, the connection, the payload — which is what makes automated enforcement something you can leave switched on in production.

2. Threat Feed Live Dashboards

Every week, security teams wake up to a new zero-day or a dozen new CVEs and ask the same three questions. Where are we exposed? What is affected? How do we fix it? Answering those questions by hand is most of the week.

Threat Feed covers zero-days, newly published CVEs, and supply chain attacks, and it changes the question. Severity is not the filter. Exposure is. A medium-severity CVE reachable from the internet is a live problem, because that is exactly what AI-backed attackers are harvesting while the critical-first queue works through its backlog.

Every item gets a live dashboard. For each threat, you see which resources are affected, how many are exposed to the internet, and how many the Upwind Red Agent has validated as genuinely reachable.

The path runs from headline to remediation in minutes. You read about a CVE, open the item, and know whether it is in your environment, where it is reachable, and what to do about it.

The Next Wave is already here.

Runtime Intelligence is the future, and it has to sit inside a platform with unified context across endpoint, cloud, and code. It’s an architectural decision, not a feature. 

What we release today will stop attacks that would otherwise become breaches. All of us at Upwind are proud to work on it alongside you.

Up & Up!
Amiram