Abstract: Techniques for training and using machine learning models for sensitivity detection. A method for sensitivity detection training includes fine-tuning a language model by iteratively applying the language model to prompts and adjusting weights of the language model. The prompts indicate classifications for a set of first resources and characteristics of an entity. The fine-tuned language model is queried with respect to classifications of a set of second resources. The fine-tuned language model is queried using prompts indicating the second classifications and data indicating characteristics of an entity, where outputs of the language model include a sensitivity for each of the second classifications. Training data including the second classifications is labeled based on the sensitivities output by the language model.

Abstract: Techniques for training and using machine learning models for resource-level classification. A method for training includes refining outputs of a language model by providing a prompt and a set of sample resources to the language model over a series of iterations. Accuracies for the classifications output by the language model at each iteration are determined based on semantic similarity between those classifications and corresponding reference classifications for the sample resources. The language model is applied to data of a set of training resources when the outputs of the language model have been refined, in order to output a set of classifications for the set of training resources. Training data is labeled based on the set of classifications output by the language model. A classifier machine learning model is trained via supervised machine learning using the set of labeled training data in order to produce a trained classifier machine learning model.

Abstract: A system and method for data classification. A method includes sampling a dataset into at least one first sample and at least one second sample having different data types; applying a truth table to the at least one first sample in order to obtain a first set of outputs, wherein the truth table includes a plurality of input variables and a plurality of corresponding logical operation results; applying a classifier to features extracted from the at least one second sample in order to obtain a second set of outputs, wherein the classifier is configured to classify the at least one second sample with respect to a plurality of patterns in the at least one second sample; determining at least one classification for the dataset based on the first set of outputs and the second set of outputs.

Abstract: A system and method for cybersecurity policy management. The method includes generating a first measurement based on at least one event which triggers a first cybersecurity policy, wherein the first measurement is defined with respect to at least one triggering of the first cybersecurity policy by the at least one event; generating a second cybersecurity policy based on the first cybersecurity policy and the first measurement; and applying the second cybersecurity policy on the at least one event.

Abstract: A system and method for discovering data store locations. A method includes reading, for each disk of a plurality of disks deployed in a cloud environment, only a portion of a snapshot of the disk accessed via a cloud provider tool, wherein the portion of the snapshot of each disk accessed via the cloud provider tool includes file system metadata of a file system of the disk, wherein the cloud provider tool is configured to provide direct access to data from each of the plurality of disks; analyzing the portion of the snapshot of each disk of the plurality of disks to determine whether each disk contains a data store; and identifying, based on the analysis, at least one data store in the cloud environment.

Abstract: A system and method for generating multi-source cybersecurity policies is presented. The method includes generating a first normalized cybersecurity policy based on a first received cybersecurity policy in a first policy format. A second normalized cybersecurity policy is generated based on a second received cybersecurity policy in a unique second policy format. A first generated cybersecurity policy is generated utilizing the second policy format and based on the first normalized cybersecurity policy. A second generated cybersecurity policy is generated utilizing the first policy format and based on the second normalized cybersecurity policy. The first generated cybersecurity policy is applied by a first cybersecurity platform which utilizes the second policy format. The second generated cybersecurity policy is applied by a second cybersecurity platform which utilizes the first policy format.

Abstract: A system and method for classification. A method includes identifying candidate entities among text data by applying at least one entity identification rule to the text data. Inputs are constructed based on the identified candidate entities, where each input includes a first portion of text indicating a candidate entity and at least one second portion of text and where the at least one second portion of text of each input is adjacent to the first portion of text of the input. Multiple language models are applied to the inputs, where each language model is trained to identify a respective set of entities and where outputs of the language models include at least one portion of entity-indicating text for each input. Based on the outputs of the language models, at least one named entity in the text data is determined.

Abstract: A system and method for scanning. A method includes identifying an entity in a computing environment based on a scan of the computing environment, wherein the entity is defined with respect to a relationship between the entity and a storage volume in the computing environment; restoring a snapshot of the entity to a running volume by creating a volume based on the snapshot; analyzing data of the running volume in order to identify at least one database; and running each of the identified at least one database.

Abstract: A system and method for discovering data store locations. A method includes reading, for each disk of a plurality of disks deployed in a cloud environment, only a portion of a snapshot of the disk accessed via a cloud provider tool, wherein the portion of the snapshot of each disk accessed via the cloud provider tool includes file system metadata of a file system of the disk, wherein the cloud provider tool is configured to provide direct access to data from each of the plurality of disks; analyzing the portion of the snapshot of each disk of the plurality of disks to determine whether each disk contains a data store; and identifying, based on the analysis, at least one data store in the cloud environment.

Abstract: A system and method for data classification. A method includes: determining a role for each of a plurality of portions of data, wherein the role for each of the plurality of portions of data is defined with respect to a corresponding entity having at least one characteristic represented by the respective portion of data; classifying each of the plurality of portions of data into a plurality of classifications, wherein classifying at least one first portion of data among the plurality of portions of data further comprises applying a classification for at least one second portion of data among the plurality of portions of data to the at least one first portion of data, wherein the role of the at least one first portion of data and the role of the at least one second portion of data match; and performing at least one remediation action based on the plurality of classifications.

Abstract: A system and method for classification. A method includes identifying candidate entities among text data by applying at least one entity identification rule to the text data. Inputs are constructed based on the identified candidate entities, where each input includes a first portion of text indicating a candidate entity and at least one second portion of text and where the at least one second portion of text of each input is adjacent to the first portion of text of the input. Multiple language models are applied to the inputs, where each language model is trained to identify a respective set of entities and where outputs of the language models include at least one portion of entity-indicating text for each input. Based on the outputs of the language models, at least one named entity in the text data is determined.

Abstract: A system and method for data discovery. A method includes performing a scan of a plurality of snapshots, each snapshot corresponding to a respective disk of a plurality of disks; identifying a plurality of data store files in the plurality of disks based on file metadata found during the scan; and detecting at least one data store based on the identified plurality of data store files, wherein each of the at least one data store is in a disk of the plurality of disks including one of the plurality of data store files.

Abstract: Techniques for data classification using clustering. A method includes replacing a plurality of portions of metadata for a plurality of data objects with a plurality of replacement characters in order to generate a plurality of replaced strings; clustering the plurality of data objects into a plurality of clusters based on commonalities between the plurality of replaced strings of data objects of the plurality of data objects; classifying a subset of the data objects in each cluster into at least one class; and aggregating classes within at least one cluster of the plurality of clusters, wherein aggregating classes within each of the at least one cluster includes applying the at least one class for the subset of the data objects in each cluster to each other data object within the cluster.

Abstract: A system and method for cybersecurity policy management in a computing environment is presented. The method includes receiving a selection of a first cybersecurity policy of a digital security platform of a computing environment; applying the first cybersecurity policy to generate a first measurement; generating a second cybersecurity policy based on the first cybersecurity policy and a result of the first measurement; applying the second cybersecurity policy to generate a second measurement; generating a third cybersecurity policy based on a result of the second measurement and the second cybersecurity policy; and applying the third cybersecurity policy on the computing environment.

Abstract: A system and method for dynamically generating a compact cybersecurity policy based on an original policy is presented. The method includes receiving a cybersecurity policy in a first policy language, the first policy language including a first data format; determining a constraint of a second policy language; generating a context for a generative artificial intelligence (AI) based at least on the determined constraint; configuring the generative AI to generate a second cybersecurity policy in the second policy language based on the determined constraint and the generated context; and applying the generated second cybersecurity policy in a cybersecurity platform configured to utilize the second policy language.

Abstract: A system and method for applying policies across data loss prevention (DLP) systems of a computing environment is presented. The method includes receiving a plurality of events, including a first event from a DLP system, and a second event from a second DLP system, each providing a software service to the computing environment; normalizing the plurality of events into normalized events based on a normalizing schema; configuring a generative artificial intelligence (AI) model to output an event summary based on: a normalized event, a metadata associated with the normalized event, and an enrichment; configuring the generative AI model to output a severity based on: the normalized event, the metadata, the enrichment, and a service level agreement; configuring the generative AI model to output a reason based on the severity and the event summary; and initiating a remediation action based on an output of the generative AI model.

Abstract: A system and method for generating multi-source cybersecurity policies is presented. The method includes receiving a plurality of cybersecurity policies, wherein a first cybersecurity policy is stored in a first data format, and a second cybersecurity policy is stored in a second data format; generating a normalized cybersecurity policy based on each received cybersecurity policy, including a normalized first cybersecurity policy and a normalized second cybersecurity policy; generating a first generated cybersecurity policy based on the normalized first cybersecurity policy, utilizing the second data format; generating a second generated cybersecurity policy based on the normalized second cybersecurity policy, utilizing the first data format; and applying each of the generated cybersecurity policies on a respective cybersecurity platform.

Abstract: Techniques for data classification. A method includes sampling a dataset into first and second samples. Each first sample is a numerical value, and each second sample is a string of characters. A truth table is applied to the first samples from a dataset. The truth table includes multiple first columns, each of which accepts an input value determined for each of the first samples, and a second column which outputs first scores representing likelihoods for respective classifications. Classifiers are applied to features extracted from the second samples, where each classifier is a machine learning model trained to output a second score representing a likelihood for a respective classification for each second sample. Classifications are determined based on the first and second scores. The classifications include a classification for each first sample determined based on the first scores and a classification for each second sample determined based on the second scores.

Abstract: Techniques for training and using machine learning models for resource-level classification. A method for training includes refining outputs of a language model by providing a prompt and a set of sample resources to the language model over a series of iterations. Accuracies for the classifications output by the language model at each iteration are determined based on semantic similarity between those classifications and corresponding reference classifications for the sample resources. The language model is applied to data of a set of training resources when the outputs of the language model have been refined, in order to output a set of classifications for the set of training resources. Training data is labeled based on the set of classifications output by the language model. A classifier machine learning model is trained via supervised machine learning using the set of labeled training data in order to produce a trained classifier machine learning model.

Abstract: Techniques for data classification using clustering. A method includes replacing a plurality of portions of metadata for a plurality of data objects with a plurality of replacement characters in order to generate a plurality of replaced strings; clustering the plurality of data objects into a plurality of clusters based on commonalities between the plurality of replaced strings of data objects of the plurality of data objects; classifying a subset of the data objects in each cluster into at least one class; and aggregating classes within at least one cluster of the plurality of clusters, wherein aggregating classes within each of the at least one cluster includes applying the at least one class for the subset of the data objects in each cluster to each other data object within the cluster.