Abstract: Systems and methods for providing intelligent alert remediation recommendations include receiving a security alert from an External Attack Surface Management (EASM) platform; extracting metadata and contextual information from the security alert and converting the extracted metadata and contextual information into a vector embedding; performing a similarity search over a knowledge base comprising structured and unstructured data using the vector embedding to retrieve relevant remediation data; and generating, via a Large Language Model (LLM), remediation recommendations based on a context-aware prompt constructed from the retrieved data and the alert information.

Abstract: Systems and methods for advanced Common Vulnerabilities and Exposure (CVE) enrichment using Large Language Models (LLMs) include receiving vulnerability information, including at least a CVE identifier and corresponding CVE description; parsing and processing the received information to extract key attributes and apply enrichment logic; generating an interactive enriched CVE analysis output, organized into structured components; and providing the enriched CVE analysis output to a user through an interactive user interface (UI).

Abstract: Systems and methods for automated threat analysis and detection using generative AI include receiving events from one or more cloud environments associated with one or more tenants of a cloud-based system, wherein the events include logs related to process activities, network interactions, and file modifications; retrieving and updating threat intelligence data from a dynamically updated RAG system with a vector store, wherein the threat intelligence data includes external data and data from internal resources; calculating an anomaly score using the events in combination with updated threat intelligence data retrieved from the RAG system; and generating an alert responsive to the anomaly score exceeding a predefined threshold.

Abstract: Systems and methods for cross-tenant access to private applications includes establishing a trusted federation relationship within a private application access service between a host tenant and a guest tenant, the host tenant and the guest tenant being tenants of a cloud-based system operating the private application access service; evaluating access requests, by users of the guest tenant, to one or more private applications of the host tenant; creating a secure connection between a user of the guest tenant and a private application of the host tenant; and monitoring the connection via the private application access service.

Abstract: Systems and methods include receiving a request from a user device for access to an application; performing an authentication of the request via a customer Identity Provider (IDP); receiving a Security Assertion Markup Language (SAML) assertion from the customer IDP; and performing an action based on the SAML assertion, the action being one of blocking the request, allowing the request, and isolating the request.

Abstract: The present disclosure includes systems and methods for posture control of cloud environments. Various embodiments include scanning a cloud environment for posture control data; identifying one or more configurations associated with the cloud environment; identifying one or more activities performed by a plurality of identities associated with the cloud environment; and providing one or more alerts related to any of the one or more configurations and the one or more activities. The various alerts and posture control data can be further represented in a Graphical User Interface (GUI).

Abstract: Systems and methods for securely steering traffic through a cloud-based system using Encrypted Client Hello (ECH) include receiving Domain Name System (DNS) queries from a user device; providing, in response to the DNS queries, IP addresses of at least one proxy node in a cloud environment and ECH information including a user-specific public key and an ephemeral public Server Name Indication (SNI); decrypting an encrypted portion of a TLS Client Hello message using the user-specific public key to validate a user identity and determine an actual destination address; and routing user traffic to the actual destination address based on the validated user identity.

Abstract: A multi-agent AI-driven system addresses limitations of Large Language Models (LLMs) in automated software testing by integrating symbolic formal verification and generative AI. The system analyzes software to identify implied functions, dependencies, and static variables, generating mock-up compilation units to enable isolated unit testing. A symbolic verification engine systematically identifies backward arithmetic and logical conditions required to execute specific code paths, overcoming the inability of LLMs to reliably perform backward reasoning. LLMs then generate executable, forward-reasoned unit tests based on these formal results. Test executions produce coverage information that highlights gaps and detects errors or regressions. Reflective analysis by LLMs further generates targeted tests and suggests improvements, enhancing software robustness and test coverage. The method effectively combines formal logic with generative AI, enabling automated, reliable, and comprehensive software testing.

Abstract: Systems and methods for defining and utilizing DLP sub-dictionaries include monitoring network traffic associated with one or more tenants of a plurality of tenants of a cloud-based system; identifying a document in transit based on the monitoring of network traffic; identifying, based on one or more DLP dictionary weights, at least one parent dictionary and at least one corresponding sub-dictionary to be searched; matching contents of the document against data patterns or phrases defined in the identified sub-dictionary; and triggering an alert or a policy action if at least one matched data pattern or phrase exceeds a predefined threshold determined in part by the one or more DLP dictionary weights.

Abstract: Systems and methods for real-time scoring to monitor performance and provide proactive remediation via actionable insights which includes collecting one or more specific hardware and software performance metrics from one or more computing devices, assigning a weighted score to each performance metric, computing a composite score, and providing one or more actionable user recommendations.

Abstract: Systems and methods for enhancing the WireGuard protocol are provided. In one implementation, a gateway device is arranged in a cloud-based system and connected via tunnels to multiple connectors in a client network. The gateway device is configured to assign loopback IP addresses to the multiple connectors and populate the loopback IP addresses into AllowedIP lists associated with the multiple connectors, the multiple AllowedIP lists addressing the connectors as crypto peers for use with the WireGuard protocol. Based on network operating parameters, the gateway device is configured to determine a packet routing plan for distributing multiple packets among the connectors. When a packet of the multiple packets is determined, according to the packet routing plan, to be routed through a connector other than a designated WireGuard peer, the gateway device further performs a step of encapsulating the packet with the corresponding loopback IP address of the connector.

Abstract: Techniques for optimized tracing in IPV6 environments include sending a plurality of trace packets between a client and a destination in a service path; responsive to receiving a response from the plurality of trace packets, extracting trace information therefrom; and determining a corresponding router associated with each of the responses based on the trace information.

Abstract: Systems and methods for client-side decryption include intercepting, via an agent application installed on a client device, a secure connection request originating from a browser or other application executing on the client device; extracting, by the agent application, handshake parameters from the secure connection request; establishing a secure session between the agent application and the browser using a locally generated decryption certificate and the handshake parameters; decrypting, by the agent application, data received from the browser and conditionally inspecting and re-encrypting the decrypted data for transmission to a cloud-based system or a destination server.

Abstract: Systems and methods for emulating Unix pipes on Windows operating systems include creating an emulated pipe by creating a listening Transmission Control Protocol (TCP) socket and a client TCP socket and establishing a local loopback TCP connection between them; utilizing the emulated pipe for inter-process communication by assigning file descriptors to the established TCP connection, wherein a first file descriptor is designated for reading and a second file descriptor is designated for writing; and enabling asynchronous operation by integrating the emulated pipe with event-driven Application Programming Interfaces (APIs), allowing non-blocking communication between processes or threads within an application.

Abstract: Systems and methods for version based stateless caching to deliver cloud enforcement policy to user devices include receiving keep-alive signals from a plurality of agent applications, each agent application of the plurality of agent applications being associated with and identifying a corresponding user device; storing device details associated with the plurality of agent applications; intercepting a policy request from at least one agent application of the plurality of agent applications; and responsive to determining device details associated with the at least one agent application are stored, returning a response to the at least one agent application from a policy cache.

Abstract: Systems and methods described herein are configured to inspect prompts before they are transmitted to an external Large Language Model (LLM) chatbot or Generative Pre-trained Transformer (GPT). A method, according to one implementation, includes a step of intercepting a text-based prompt sent from a client device, the text-based prompt intended to be sent to an LLM chatbot. The method also includes analyzing the text-based prompt to determine whether one or more keywords exist therein. In response to detecting that one or more keywords exist in the text-based prompt, the method further includes a step of inspecting text surrounding the one or more keywords to determine whether one or more text segments include secretive information. In response to detecting that one or more text segments include secretive information, the method prevents leakage of the one or more text segments to the LLM chatbot while sending the text-based prompt.

Abstract: Systems and methods for geolocating an Access Point (AP) based on network identifiers and external data sources includes caching the AP's location by associating it with one or more network identifiers, deriving an egress IP address of the AP from an external tool or service, and generating a unique key based on the egress IP address. The unique key can be used to geolocate the AP. Such systems and methods can be incorporated with location based services.

Abstract: Systems and methods for enforcing policy based on assigned user risk scores in a cloud-based system. Various methods include receiving a request to access a resource; determining whether a user associated with the request is allowed to access the resource, wherein the determining is based on a risk score of the user; and responsive to the user being permitted to access the resource, stitching together a connection between a cloud-based system, the resource, and the device to provide access to the resource.

Abstract: Systems and methods for a hierarchical step-up authentication mechanism include monitoring access to one or more private applications; responsive to a request to access the one or more private applications, determining an Authentication Level (AL) of a user associated with the request, wherein determining the AL of the user comprises referencing one or more AL trees; and responsive to determining an AL of the user, performing one or more actions based thereon, wherein the one or more actions comprises one of allowing access to the one or more private applications and denying access to the one or more private applications.

Abstract: Systems and methods for generating SDLC-based application segments include defining a set of applications, the set of applications comprising a plurality of applications associated with a tenant of the cloud-based system; generating a plurality of application pairs from the set of applications; analyzing applications within each application pair of the plurality of application pairs for filtering the plurality of application pairs, the analyzing comprising a plurality of similarity checks and identification of environment key words; and generating one or more application segments each comprising one or more applications from the set of applications based on the filtering.