Abstract: A system and method for identifying software component associations is presented.

Abstract: A system and method for determining an artificial intelligence (AI) security posture management (SPM) of a cloud computing environment is presented. The method includes inspecting the cloud computing environment for components of an AI pipeline; generating an AI pipeline representation based on a representation of each component of the AI pipeline in a security database; inspecting the cloud computing environment for a cybersecurity object associated with a component of the AI pipeline; analyzing the AI pipeline for a cybersecurity risk based on a result of inspecting the cloud computing environment for the cybersecurity object; and initiating a remediation action in the cloud computing environment in response to detecting the cybersecurity risk.

Abstract: A system and method for cross-entity ephemeral resource correlation to compute entities for applying controls in a cybersecurity system is presented. The method includes detecting an IP address in a record of a network event in a cloud computing environment, wherein the IP address is an ephemeral resource which is allocated for a limited duration; associating the IP address with a compute entity of the cloud computing environment based on the record; associating each event detected in a log of the cloud computing environment including the IP address with the compute entity; storing a representation of the compute entity and the IP address in a security database, the security database further including a representation of the cloud computing environment; and applying a control on the representation of the compute entity based at least on an event detected in the log of the cloud computing environment.

Abstract: A system and method for detecting a cybersecurity toxic combination prior to a virtual instance deployment is presented. The method includes: inspecting an entity in a cloud computing environment for a cybersecurity object, the cybersecurity object; detecting the cybersecurity object on the inspected entity; inspecting a code object utilized to deploy a virtual instance in the cloud computing environment prior to deployment of the virtual instance; detecting a toxic combination cybersecurity issue based on the cybersecurity object and the code object; and initiating a mitigation action on the code object.

Abstract: A system and method for software container remediation. A method includes determining that a vulnerability of a software container resides in a first origin image of the software container at least partially by identifying a plurality of derived container images referencing the origin image which have the vulnerability, wherein a first derived container image of the plurality of derived container images is used to run the software container; and rebuilding the first derived container image using contents of a second origin image, wherein the second origin image avoids the vulnerability.

Abstract: A system and method for optimizing the deployment of a cloud computing environment is presented. The method includes inspecting the cloud computing environment; generating a representation of the cloud computing environment based on a result of inspecting the cloud computing environment; detecting a plurality of software components associated with a resource deployed in the cloud computing environment; determining a resource cost associated with the resource, based on a resource cost of a software component of the plurality of software components; generating an optimization action for the resource, wherein the optimization action reduces the determined resource cost; and initiating the optimization action in the cloud computing environment.

Abstract: A system or method for trust-aware cybersecurity detection is presented. The method includes receiving from a computing environment a plurality of cybersecurity signals; detecting in a first cybersecurity signal of the plurality of cybersecurity signals a cybersecurity issue and an identifier of a resource associated with the cybersecurity issue; determining a trust score of the resource based at least on the identifier; selecting a response action based on the cybersecurity issue; adapting the response action based on the trust score; and initiating the adapted response action in the computing environment.

Abstract: A system and method for cybersecurity inspection of a volume based on image layers is disclosed. In some implementations, the method may include generating an inspectable disk based on a volume of a virtual instance, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers. In addition, the method may include parsing a manifest associated with the volume, the manifest including an identifier of each unique layer. The method may include determining an order of layers based on the manifest, where a first layer of the virtual instance is deployed prior to a second layer of the virtual instance. Moreover, the method may include initiating inspection for a cybersecurity object on a first layer of the plurality of layers. Also, the method may include initiating a mitigation action in response to detecting the cybersecurity object.

Abstract: A method and system for deploying a cybersecurity monitoring system in a cloud computing environment is presented. The method includes: deploying a plurality of cybersecurity modules in a cloud computing environment, each cybersecurity module configured to monitor a portion of the cloud computing environment; periodically determining for each cybersecurity module a phase of deployment in the cloud computing environment; generating a corrective action for a first cybersecurity module of the plurality of cybersecurity modules, in response to determining that a phase of deployment for the first cybersecurity module indicates that the first cybersecurity module is partially deployed; and initiating the corrective action in the cloud computing environment.

Abstract: A system and method for automatically implemented runtime cybersecurity rules is presented. The method includes detecting a code object of a cloud computing environment, the code object utilized to deploy a resource in the cloud computing environment; performing static analysis on the code object; generating a behavior baseline of the resource based on a result of the static analysis of the code object; generating a runtime rule based on the behavior baseline; applying the generated runtime rule on an event related to the resource; detecting a suspicious activity respective of the resource based on an application of the generated runtime rule on the event.

Abstract: A system and method for mitigating alerts using network path resolution. A method includes identifying resolution routes based on communications between entities. Each resolution route is a series of connections among the plurality of connections beginning at a starting entity of the plurality of entities and concluding at an ending entity of the plurality of entities. Paths correspond to respective resolution routes are created in a graph. A heatmap is generated based on a number of instances in which each path resolved to a respective workload. Nodes of the heatmap include heat values determined based on the number of instances in which each path resolved to one of the workloads. A first path is identified among the paths based on the heatmap and an alert, wherein the identified first path leads to a first computing resource of the plurality of computing resources indicated in the alert.

Abstract: A system and method for performing cross-entity correlation of activity in a cloud computing environment for applying a cybersecurity control is presented. The method includes detecting a principal in the cloud computing environment, wherein the principal is deployed in the cloud computing environment; detecting an external identity to the cloud computing environment, wherein the external identity associated with a canonical user and the external entity is managed by an entity which is external to the cloud computing environment; detecting a hint in an event of the cloud computing environment, wherein the hint associates the external identity with the detected principal; generating a representation in a security database of the detected principal and of the external identity; connecting the representation of the detected principal with the representation of the external identity based on the hint; and applying a control on the representation.

Abstract: A system and method for mitigating alerts using network path resolution. A method includes generating a graph mapping between computing resources and workloads, wherein the graph includes nodes and edges, wherein the nodes include computing resource nodes representing respective computing resources and workload nodes representing respective workloads, wherein each workload is at least one process; identifying a path including at least one first workload of the workloads by querying the graph based on a first computing resource of the computing resources indicated in an alert; identifying at least one root cause of an alert based on the identified path; and performing at least one mitigation action based on the identified at least one root cause.

Abstract: A system and method for generating an activity graph for cybersecurity threat detection is presented. The method includes detecting a plurality of events in a log of a computing environment, each event including a timestamp, and corresponding to a resource of a plurality of resources deployed in the computing environment; detecting a cybersecurity threat in an event of the plurality of events; detecting a plurality of components in the plurality of events, each component including a component identifier; generating a plurality of prompts for a generative artificial intelligence (AI) system; and configuring the generative AI system to process a first prompt of the plurality of prompts to output a summary of the cybersecurity threat based at least on the plurality of events.

Abstract: A system and method for generating an activity graph for cybersecurity threat detection is presented. The method includes detecting a plurality of event records indicating an activity in a computing environment; detecting an identifier of a component in the plurality of event records; detecting in a security database a plurality of representations, including a representation of the plurality of representations which represents the component, wherein the security database further includes a representation of the computing environment; and generating a visualization based on the plurality of event records and the representation of the component.

Abstract: A system and method for detecting endpoint exposures in a cloud computing environment is presented. The method includes detecting a plurality of endpoints in a cloud computing environment, inspecting each of a plurality of resources deployed in the cloud computing environment to detect an endpoint; associating the endpoint to another object, wherein the another object is an entity of the cloud computing environment; generating a representation of the endpoint in a security database, wherein the security database includes a representation of the cloud computing environment; detecting a network path between the another object and an external network; determining that the endpoint is an exposed endpoint in response to detecting the network path; and initiating a remediation action based on the exposed endpoint.

Abstract: A system and method for classifying data objects for data security posture management (DSPM) in a cloud computing environment based on metadata are presented. The method includes detecting data objects in data sources of the cloud computing environment, wherein each data object in the data objects comprises metadata; generating metadata-derived features from the metadata, wherein the metadata-derived features include hierarchy and path features; clustering the data objects into data clusters based on a similarity determination applied to the metadata-derived features; generating, for a first data cluster of the data clusters, an aggregated cluster representation and a corresponding prompt based on metadata associated with data objects in the first data cluster; generating a cluster classification for the first data cluster based on a result of processing the corresponding prompt with a language model; and generating data findings based on the cluster classification and classification results.

Abstract: A system and method for inspecting different types of cloud workloads for cybersecurity threats, all deployed in a cloud computing environment, includes a unifying extractor to expose different compute types to agnostic inspectors. The method includes accessing a first cloud workload of a first type from a plurality of deployed cloud workloads; accessing a second cloud workload of a second type from the plurality of deployed cloud workloads; extracting data from each of the first cloud workload and the second cloud workload into a storage layer having a data schema, based on a predefined data structure; and inspecting the extracted data to detect a first target object, the target object indicating a cybersecurity threat, wherein extraction for each of the first cloud workload and the second cloud workload is based on the workload type.

Abstract: A system and method for evaluating levels of risk utilizing a multi-tenant database to detect technologies is presented collecting a plurality of metadata for each technology in a plurality of technologies from a plurality of computing environments from a plurality of tenants; extracting a plurality of features from the metadata for each technology in the plurality of technologies; assigning a weight to each feature in the plurality of features for each technology in the plurality of technologies; determining a plurality of composite risk scores based on the plurality of weighted features for each technology in the plurality of technologies; and initiating a mitigatory action for at least one technology in the plurality of technologies from the plurality of computing environments from the plurality of tenants based on the composite risk scores.

Abstract: A system and method for managing a cybersecurity policy exception on a software service in a computing environment is presented. The method includes detecting a software service in a computing environment, the service including a code object and a resource; generating a representation of the software service in a security database, the security database further including a representation of the computing environment; applying a policy on the representation of the software service, the policy including a conditional rule; detecting a policy exception in response to applying the policy resulting in a policy fail of the conditional rule; determining that the software service passes the policy in response to applying the policy exception resulting in a pass; and initiating a remediation action, in response to determining that applying the policy exception results in a policy fail.