An approach for responding to a threat in a networked computing environment (e.g., a cloud computing environment) is provided. In an embodiment, a set of associations to a virtual machine (VM) instance are established, each association indicating a relationship between the VM instance and a related VM instance. Each of the associations in the set of associations is assigned a strength attribute. When a threat is detected in a VM instance, a first preventative measure is performed on a first related VM instance, the strength of which is determined based on the strength attribute that corresponds to the association between the VM instance and the first related VM instance. A second preventative measure is performed on a second related VM instance, the strength of which is based on the strength attribute that corresponds to the association between the VM instance and the second related VM instance.