Abstract: A system and method for prioritizing remediation actions for cybersecurity issues in a cloud computing environment based on a data risk score is presented. The method includes detecting a plurality of data objects in the computing environment, the computing environment including a plurality of resources and principals; determining a cybersecurity context for each detected data object; generating a representation of each data object, each resource, and each principal in a security database; detecting in the security database a resource representation connected to a data object representation, wherein a cybersecurity context is determined for the resource; generating a cybersecurity risk score based on the cybersecurity context of the data object and the cybersecurity context of the resource; prioritizing a plurality of remediation actions based on the generated cybersecurity risk score; and executing a remediation action based on the prioritization.

Abstract: A method and system for populating multi-layer technology product catalogs are provided.

Abstract: A system and method for detecting stale objects in a cloud computing environment is presented. The method includes detecting a plurality of resources deployed in a cloud computing environment; generating for each resource a representation in a security database, the security database including a representation of the cloud computing environment; generating for each resource a state, based at least on a detected utilization of a respective resource; detecting, based on the state, a resource of the plurality of resources which is an underutilized resource; and initiating a mitigation action on the underutilized resource.

Abstract: A system and method for reducing redundancy in inspecting container layers for cybersecurity objects is presented. The method includes generating a diff output between a first container layer of a live container and a second container layer of a container image, wherein the second container layer is previously generated based off of the first container layer, wherein the diff output includes a software object; inspecting the first container layer for a cybersecurity object; inspecting the diff output for the cybersecurity object; associating the cybersecurity object with the first container layer in response to detecting the cybersecurity object in the first container layer and not in the diff output; and associating the cybersecurity object with the second container layer in response to detecting the cybersecurity object in the diff output and not in the first container layer.

Abstract: A system and method for remediating exposed deleted client data in a cloud computing virtualization is presented. The method includes accessing a disk of a virtualization in a computing environment, the disk including deleted data; recovering at least a file from the deleted data; detecting client data on the at least a file, wherein the client data is untied to any functionality provided by the virtualization; and permanently deleting the detected client data from the disk.

Abstract: A system and method for applying compounded cybersecurity controls in a data security posture management (DSPM) system based on data findings associated with an individual data object in a cloud computing environment are presented. The method includes detecting data objects in data sources of the cloud computing environment, wherein the data objects include a first data object; obtaining metadata for the data object without accessing payload content; generating a first data finding for the data object; associating the first data finding with an object identifier of the data object; obtaining a sample of the payload content from the data object; generating a second data finding for the data object; associating the second data finding with the object identifier; aggregating the first data finding and the second data finding; determining a compounded sensitivity output; determining a compounded cybersecurity control decision; and initiating a remediation action in the cloud computing environment.

Abstract: A system and method for deploying a multi-architecture sensor for cybersecurity object detection is presented. The method includes: deploying a monitoring debugger on a hardware abstraction layer of a virtual instance, the virtual instance deployed in a computing environment; deploying a sensor application communicating with the monitoring debugger, the sensor application configured to detect events in the virtual instance; detecting an event based on data detected by the sensor application; determining that the detected event corresponds to a cybersecurity issue; and initiating a remediation action based on the cybersecurity issue.

Abstract: A system and method for software service discovery in a computing environment are presented. The method includes detecting in a computing environment: a code object, and a resource deployed in the computing environment based on the code object; generating a representation in a security database of the code object and a representation of the resource, wherein the security database includes a representation of the computing environment; generating a representation of a service in the security database, the representation of the service connected to: the representation of the code object and the representation of the resource; inspecting the code object for a first cybersecurity object; inspecting the resource for a second cybersecurity object; and generating a context for the representation of the service based on a first result of inspecting the code object and a second result of inspecting the resource.

Abstract: A system and method for identifying software component associations is presented.

Abstract: A system and method for determining an artificial intelligence (AI) security posture management (SPM) of a cloud computing environment is presented. The method includes inspecting the cloud computing environment for components of an AI pipeline; generating an AI pipeline representation based on a representation of each component of the AI pipeline in a security database; inspecting the cloud computing environment for a cybersecurity object associated with a component of the AI pipeline; analyzing the AI pipeline for a cybersecurity risk based on a result of inspecting the cloud computing environment for the cybersecurity object; and initiating a remediation action in the cloud computing environment in response to detecting the cybersecurity risk.

Abstract: A system and method for cross-entity ephemeral resource correlation to compute entities for applying controls in a cybersecurity system is presented. The method includes detecting an IP address in a record of a network event in a cloud computing environment, wherein the IP address is an ephemeral resource which is allocated for a limited duration; associating the IP address with a compute entity of the cloud computing environment based on the record; associating each event detected in a log of the cloud computing environment including the IP address with the compute entity; storing a representation of the compute entity and the IP address in a security database, the security database further including a representation of the cloud computing environment; and applying a control on the representation of the compute entity based at least on an event detected in the log of the cloud computing environment.

Abstract: A system and method for detecting a cybersecurity toxic combination prior to a virtual instance deployment is presented. The method includes: inspecting an entity in a cloud computing environment for a cybersecurity object, the cybersecurity object; detecting the cybersecurity object on the inspected entity; inspecting a code object utilized to deploy a virtual instance in the cloud computing environment prior to deployment of the virtual instance; detecting a toxic combination cybersecurity issue based on the cybersecurity object and the code object; and initiating a mitigation action on the code object.

Abstract: A system and method for software container remediation. A method includes determining that a vulnerability of a software container resides in a first origin image of the software container at least partially by identifying a plurality of derived container images referencing the origin image which have the vulnerability, wherein a first derived container image of the plurality of derived container images is used to run the software container; and rebuilding the first derived container image using contents of a second origin image, wherein the second origin image avoids the vulnerability.

Abstract: A system and method for optimizing the deployment of a cloud computing environment is presented. The method includes inspecting the cloud computing environment; generating a representation of the cloud computing environment based on a result of inspecting the cloud computing environment; detecting a plurality of software components associated with a resource deployed in the cloud computing environment; determining a resource cost associated with the resource, based on a resource cost of a software component of the plurality of software components; generating an optimization action for the resource, wherein the optimization action reduces the determined resource cost; and initiating the optimization action in the cloud computing environment.

Abstract: A system or method for trust-aware cybersecurity detection is presented. The method includes receiving from a computing environment a plurality of cybersecurity signals; detecting in a first cybersecurity signal of the plurality of cybersecurity signals a cybersecurity issue and an identifier of a resource associated with the cybersecurity issue; determining a trust score of the resource based at least on the identifier; selecting a response action based on the cybersecurity issue; adapting the response action based on the trust score; and initiating the adapted response action in the computing environment.

Abstract: A system and method for cybersecurity inspection of a volume based on image layers is disclosed. In some implementations, the method may include generating an inspectable disk based on a volume of a virtual instance, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers. In addition, the method may include parsing a manifest associated with the volume, the manifest including an identifier of each unique layer. The method may include determining an order of layers based on the manifest, where a first layer of the virtual instance is deployed prior to a second layer of the virtual instance. Moreover, the method may include initiating inspection for a cybersecurity object on a first layer of the plurality of layers. Also, the method may include initiating a mitigation action in response to detecting the cybersecurity object.

Abstract: A method and system for deploying a cybersecurity monitoring system in a cloud computing environment is presented. The method includes: deploying a plurality of cybersecurity modules in a cloud computing environment, each cybersecurity module configured to monitor a portion of the cloud computing environment; periodically determining for each cybersecurity module a phase of deployment in the cloud computing environment; generating a corrective action for a first cybersecurity module of the plurality of cybersecurity modules, in response to determining that a phase of deployment for the first cybersecurity module indicates that the first cybersecurity module is partially deployed; and initiating the corrective action in the cloud computing environment.

Abstract: A system and method for automatically implemented runtime cybersecurity rules is presented. The method includes detecting a code object of a cloud computing environment, the code object utilized to deploy a resource in the cloud computing environment; performing static analysis on the code object; generating a behavior baseline of the resource based on a result of the static analysis of the code object; generating a runtime rule based on the behavior baseline; applying the generated runtime rule on an event related to the resource; detecting a suspicious activity respective of the resource based on an application of the generated runtime rule on the event.

Abstract: A system and method for mitigating alerts using network path resolution. A method includes identifying resolution routes based on communications between entities. Each resolution route is a series of connections among the plurality of connections beginning at a starting entity of the plurality of entities and concluding at an ending entity of the plurality of entities. Paths correspond to respective resolution routes are created in a graph. A heatmap is generated based on a number of instances in which each path resolved to a respective workload. Nodes of the heatmap include heat values determined based on the number of instances in which each path resolved to one of the workloads. A first path is identified among the paths based on the heatmap and an alert, wherein the identified first path leads to a first computing resource of the plurality of computing resources indicated in the alert.

Abstract: A system and method for performing cross-entity correlation of activity in a cloud computing environment for applying a cybersecurity control is presented. The method includes detecting a principal in the cloud computing environment, wherein the principal is deployed in the cloud computing environment; detecting an external identity to the cloud computing environment, wherein the external identity associated with a canonical user and the external entity is managed by an entity which is external to the cloud computing environment; detecting a hint in an event of the cloud computing environment, wherein the hint associates the external identity with the detected principal; generating a representation in a security database of the detected principal and of the external identity; connecting the representation of the detected principal with the representation of the external identity based on the hint; and applying a control on the representation.