Abstract: A system and method for inspecting a resource in an on-premises environment for a cybersecurity threat is presented. The method includes initiating a network communication between an on-premises environment and an inspection environment; scanning the on-premises environment for a workload, the workload including a disk; generating an inspectable disk based on the disk; providing access to an inspector deployed in the inspection environment to inspect the inspectable disk for a cybersecurity object; and releasing a resource allocated to the inspectable disk in response to detecting that inspection of the inspectable disk is complete.

Abstract: A system and method for detecting unintegrated systems in a computing environment is presented. The method includes obtaining data from at least one integrated system in the computing environment; parsing the data to identify one or more references to potential unintegrated systems; comparing each of the one or more references to a predetermined list of integrated systems; flagging each of the one or more references that does not match a known integration as corresponding to an unintegrated system; mapping each of the flagged references to at least one security finding associated with the computing environment; and calculating, for each flagged reference, a value for integrating the unintegrated system based on a frequency with which the unintegrated system is referenced in the obtained data.

Abstract: A method and system for identifying and recommending missing system integrations are presented. The method includes obtaining data from one or more integrated systems in a computing environment; identifying one or more references from the data that correspond to an unintegrated system in the computing environment, herein identifying the one or more references includes comparing the one or more references against a list of integrated systems; mapping the one or more references to at least one security finding corresponding to the computing environment; generating at least one suggested connection to the unintegrated system based on the mapping; and establishing a connection to the unintegrated system based on the at least one suggested connection.

Abstract: A method and system for agentless endpoint detection and response for software appliances deployed in a cloud computing environment is presented. The method includes detecting a software appliance deployed in a cloud computing environment, the software appliance including an application stored on a disk of the software appliance; generating an inspectable disk based on the disk, wherein the disk stores a log of events for the application; inspecting the log of events stored on the inspectable disk to detect a first event indicating a cybersecurity issue; inspecting a network log of the cloud computing environment to detect a second event in the cloud computing environment; determining a cybersecurity threat based on detecting the first event and the second event; and initiating a mitigation action in response to the detection of the cybersecurity threat.

Abstract: A system and method detect a malware infection path in a compute environment. The method includes detecting a malware object on a first workload in a computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph including an endpoint node representing a resource which is accessible to a public network; generating a potential infection path between the resource node and the endpoint node including at least a second resource node connected to the resource node; inspecting a second workload of the plurality of workloads represented by the second resource node; determining that the potential infection path is a confirmed infection path, in response to detecting the malware on the second workload; and determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware.

Abstract: A system and method for securing deployment of computing infrastructure resources.

Abstract: A system and method for noise reduction for cybersecurity alerts in a cloud computing environment is presented. The method includes receiving a plurality of cloud alerts, wherein each cloud alert in the plurality of cloud alerts includes an identifier of a cloud entity; initiating a fuzzy search based on the identifier of the cloud entity and a plurality of code objects stored in a code repository of the cloud computing environment; determining, based on a result of the fuzzy search, a probability that a code object of the plurality of code objects is associated with the cloud alert; removing the cloud alert from the cybersecurity monitoring system in response to determining that the probability exceeds a first predetermined threshold; and initiating a mitigation action in the cloud computing environment based on the cloud alert in response to determining that the probability is below a second predetermined threshold.

Abstract: A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing.

Abstract: A system and method for detecting an attack path in a computing environment, is presented.

Abstract: A system and method for detecting endpoint exposure in a cloud computing environment is presented. The method includes inspecting a plurality of resources deployed in the cloud computing environment; detecting an endpoint based on a result of inspecting the plurality of resources; associating the endpoint with a cloud object based on a result of inspecting a resource; detecting a network path between the cloud object and an external network; generating a plurality of potential network paths in response to detecting the network path; actively inspecting a potential network path of the plurality of potential network paths; determining that the potential network path is a valid network path based on a result of active inspection; determining that the endpoint is an exposed endpoint in response to determining that the potential network path is a valid network path; and initiating a remediation action for the exposed endpoint.

Abstract: A system and method for detecting cybersecurity issues in a cloud computing environment is presented. The method includes: detecting a plurality of objects deployed in the cloud computing environment, including a first object of a first type and a second object of a second type, wherein each object of the plurality of objects includes a unique identifier; selecting a group of objects of the plurality of objects, based at least on the unique identifier of each object of the group of objects; selecting an inspector workload from a plurality of inspectors based at least on an attribute of a first object of the group of objects; inspecting the first object of the group of objects by the selected inspector; generating an enriched dataset based on a result of inspecting the first object; and detecting a vulnerability on the first object based on the enriched dataset.

Abstract: A system and method for evaluating definitions from a markup language document for agentless host configuration includes generating an inspectable disk based on a disk of a host, the host deployed in a virtualized computing environment. The system is configured to: receive a markup language document, the markup language document including a plurality of definitions, each definition including a data element; inspect the inspectable disk for a cybersecurity object corresponding to a first data element of a first definition of the plurality of definitions; evaluate the first definition further based on the cybersecurity object to generate an evaluated first definition result, in response to determining that the definition is evaluable; generate an output based on the evaluated first definition result; and generate the output based on a predetermined notification, in response to determining that the definition is unevaluable.

Abstract: A system and method for detection of an Application Programming Interface (API) endpoint in a cloud computing environment is presented. The method includes receiving runtime data from a plurality of sensors, each sensor deployed on a workload in the cloud computing environment; extracting a plurality of API calls from the received runtime data; detecting an API path from an extracted API call of the plurality of API calls; initiating inspection of a workload associated with the API path; and detecting an API endpoint based on a result of the inspection and the detected API path.

Abstract: A system and method for enforcing a cybersecurity policy through multiple different enforcement points in a cloud computing environment is presented. The method includes generating a validation database, the validation database including a plurality of validated software images and a corresponding method of validation; configuring an enforcement point of a first type to validate a first deployable software image based on a first policy; configuring an enforcement point of a second type to validate a second deployable software image based on the first policy; and authorizing deployment of a software image in the cloud computing environment in response to determining that the enforcement points permit deployment.

Abstract: A system and method for managing a cybersecurity policy exception on a software service in a computing environment is presented. The method includes detecting a software service in a computing environment, the software service including a code object and a resource deployed in the computing environment based on the code object; generating a representation of the software service in a security database, the security database further including a representation of the computing environment; applying a policy on the representation of the software service, the policy including a conditional rule; detecting a policy exception in response to applying the policy resulting in a policy fail of the conditional rule; determining that the software service passes the policy in response to applying the policy exception resulting in a pass; and initiating a remediation action, in response to determining that applying the policy exception results in a policy fail.

Abstract: A system and method for applying a cybersecurity contextual policy in a cloud computing environment is presented. The method includes detecting a cybersecurity object in the cloud computing environment; selecting a policy from a policy engine of the cloud computing environment, the policy including a conditional rule; generating an exception to the conditional rule based on the cybersecurity object; generating a contextual policy based on: the conditional rule, and the exception to the conditional rule; and configuring an admission controller of a software container cluster deployed in the computing environment to apply the contextual policy.

Abstract: A system and method for verification of Application Programming Interface (API) endpoints in a cloud computing environment is presented. The method includes receiving a plurality of API endpoints detected in a cloud computing environment; generating a network access instruction based on at least an API endpoint of the plurality of API endpoints; executing the network access instruction on a network path including at least an external network, wherein the external network is external to the cloud computing environment; and determining that the API endpoint is an exposed API endpoint in response to receiving a predetermined result of executing the network access instruction.

Abstract: A system and method for initiating a mitigation action for an exposed Application Programming Interface (API) endpoint in a cloud computing environment is presented. The method includes: receiving runtime data from a plurality of sensors, each sensor deployed on a workload in the cloud computing environment; extracting a plurality of API calls from the received runtime data; detecting an API path from an extracted API call of the plurality of API calls; executing a network access instruction on the API endpoint, wherein the network access instruction is provided over at least an external network; determining that the API endpoint is an exposed API endpoint in response to receiving a predetermined result of executing the network access instruction; and initiating a mitigation action in response to the detection of the exposed API endpoint.

Abstract: A system and method for training a generative artificial intelligence (AI) model for extracting secrets utilized in a computing environment is presented. The method includes accessing a code repository, wherein the code repository stores code objects representative of resources in a cloud computing environment; processing each code object with a first generative AI model to detect a plurality of potential secrets; extracting the plurality of detected potential secrets from the code objects; and generating a confidence score for each potential secret.

Abstract: A system and method for applying a policy on a software service discovered in a computing environment is presented. The method includes detecting a software service in a computing environment, the software service including a resource; generating a representation in a security database of the software service, wherein the representation of the software service includes representations of components of the software service; applying a policy on the representation of the software service in the security database; and initiating a remediation action in the computing environment in response to detecting a policy fail.