Uptycs Blog | Cloud Security Insights for Linux and Containers

Agentic Cloud Security: Fixing AI’s 4 Biggest Gaps

Written by Umesh Sirsiwal | 4/22/26 1:56 PM

Take an armful of customer data, shove it into an off-the-shelf large language model, and ask Claude for a system prompt that summarizes alerts and generates remediation steps. Congratulations, you've not only learned the entire history of security AI product releases over the past three years, but also how they were built.

That recipe produces a system that is, in every way that matters, a stranger to the environment it’s supposed to protect. Enterprise data is distributed across platforms, so the AI operates with partial visibility. The business has specific priorities and constraints, but the AI remains uncalibrated to the domain. Partial visibility combined with miscalibration produces shallow, single-pass answers to questions that demand deep, multi-threaded investigation across sources. And because the AI has no mechanism to act, every investigation ends where manual work begins.

We call this missing quality attunement. The AI's ability to orient itself to the environment it’s operating on, reason within its constraints, and proceed with the depth and agency that environment demands. Every capability in Juno has been built to deepen that attunement, and we extend that philosophy with four new features.

1. Connectors

Connectors redefine what Juno has access to. Until now, Juno analyzed Uptycs telemetry. Now it reaches across your full environment: GitHub, Microsoft 365 admin logs, CloudWatch, Google Admin logs, queried in place through the open MCP protocol. This is a fundamental shift: not an AI for one platform's data, but a security intelligence layer that reasons across all of your data sources. When Juno combines github activity with admin events, cloud telemetry, and identity logs in a single investigation, it surfaces findings no individual source could produce alone.

2. Calibrations

Calibrations work in two layers. First, you tell Juno about your business priorities, threat landscape, and compliance posture. Juno then validates and extends that picture against your actual telemetry: which cloud providers are present, what platforms are running, what threat categories have been observed, whether agentless or agent-based detection is deployed. And once calibrated, Juno shows its attunement by reasoning through it. Different priorities produce different severity assessments, different investigation paths, different recommendations.

3. Deep Research Agent

Enterprise environments are not simple, and the questions worth asking about them aren't either. Something as straightforward as "assess our lateral movement exposure" touches IAM, network segmentation, vulnerability management, and identity risk simultaneously. The best security analysts already think this way: decompose, investigate each dimension, and synthesize across all of them. They're just constrained by time and access. The Deep Research Agent removes both constraints. It follows the analyst's lead with unlimited context: parallel sub-investigations across every data source, reasoned through your business priorities, assembled into a report with full evidence chains.

4. Remediation

Connectors give Juno access. Calibrations give it context. Deep Research gives it depth. Remediation gives it agency. In Juno, that starts with alert exceptions, suppressing findings your calibrations confirm are known-good, backed by the full evidence chain, requiring human approval. This is the first action in what will become a growing remediation catalog.

The four capabilities above make Juno attuned to your environment right now. Recall makes it attuned over time.

One more thing — Recall & Rerun

No capable analyst begins every investigation from zero, and Juno doesn’t either. Recall & Rerun gives Juno the ability to search, reference, and compare every past investigation. Ask Juno what it has already explored about your Lambda security posture, and it returns the full history: scope, findings, and recommendations. Ask it to rerun an investigation, and it highlights what has changed since the last run. Prefer a specific report format? Juno remembers that as well.

Attunement isn’t only about understanding the environment as it exists. It is also about understanding how it evolves.

Most security AI operates as a stranger to the environment it’s meant to protect. With this release, that changes through better attunement rather than a better model. Broader access, calibrated reasoning, deeper investigation, the ability to act, and memory that compounds over time. See it for yourself.