Abstract: Systems and methods are provided for enabling hybrid processing of cybersecurity analysis for embedded systems in vehicles, whereby local cybersecurity threats are detected locally on the vehicle itself, while a remote edge server can provide more comprehensive cybersecurity threat analysis. According to one implementation, an embedded system may be installed on or incorporated within a vehicle. The embedded system, for example, includes a wireless transceiver device and an operating system including at least a kernel and a cybersecurity agent. The cybersecurity agent includes minimal resources for contributing base level or lightweight functionality with respect to protection against vehicle cybersecurity attacks. The wireless transceiver device is configured to offload vehicle data to a cloud-based server, the cloud-based server configured for contributing detailed level or heavyweight functionality with respect to protection against the vehicle cybersecurity attacks.

Abstract: Systems and methods for Hypertext Markup Language (HTML) sandboxing with browser isolation include responsive to a user attempting to access a webpage, sending the webpage to a sandbox for performing an analysis on the webpage; rendering the webpage within a browser isolation session, thereby allowing the user to interact with the webpage while the analysis is being performed; generating a score for the webpage based on the analysis, the score being indicative of the maliciousness of the webpage; and performing one or more actions based on the score associated with the webpage.

Abstract: Systems and methods for optimized cloud-based Data Loss Prevention (DLP) include monitoring user traffic associated with one or more tenants of the cloud-based system, the traffic including actions performed in association with a file sharing and storage service; responsive to a user accessing a file within the file sharing and storage service, performing a DLP scan requirement analysis; based on a result of the DLP scan requirement analysis, (i) performing a DLP scan of the file or (ii) bypassing a DLP scan of the file; and performing one or more actions based on policy associated with the user and the file.

Abstract: A system and method for generating a cybersecurity risk profile based on an identity in a computing environment is disclosed. The method includes: detecting a plurality of identities in a computing environment, each identity including a permission to initiate an action in the computing environment; querying an identity and access management service to detect a permission associated with a first identity of the plurality of identities; accessing an activity log of the computing environment; parsing the activity log to detect an event based on the first identity; and generating an identity risk profile based on: the detected event, and the detected permission.

Abstract: A system and method for cybersecurity vulnerability management through ticket system reduction reduces alert fatigue. The method includes, responsive to monitoring of a computing environment by a plurality of cybersecurity monitoring systems, receiving a plurality of alerts from the plurality of cybersecurity monitoring systems that provide overlapping detection of cybersecurity issues and do not communicate with one another, such that a given alert from each of the plurality of cybersecurity monitoring systems possibly relates to a same cybersecurity issue; preprocessing the plurality of alerts to identify any alerts for the same cybersecurity issue; and generating tickets for the plurality of alerts including a unified ticket for the any alerts for the same cybersecurity issue thereby reducing tickets by using the unified ticket for duplicate alerts from the plurality of cybersecurity monitoring systems.

Abstract: Systems and methods for Data Loss Protection (DLP) utilizing distilled models include receiving a plurality of general data predictions from a teacher model; determining one or more strengths of the teacher model based on the received general data predictions; generating a synthetic dataset based on the one or more strengths of the teacher model; providing the synthetic dataset to the teacher model and receiving a plurality of synthetic data predictions from the teacher model based thereon; and performing knowledge distillation on a student model based on the synthetic data predictions received from the teacher model to produce a distilled model. The distilled model is then used in production for classifying inputs to a DLP system.

Abstract: Systems and methods for policy based seamless authentication for PRA systems through zero trust private networks. The various systems and methods described herein include steps of receiving a request to access a Privileged Remote Access (PRA) system; determining if any credential rules apply to a console associated with the request; retrieving credentials associated with any of a user and the console from a database, thereby avoiding the user being required to provide credentials; and providing access to the requested PRA system based on the retrieved credentials.

Abstract: Systems and methods for providing private access to third-party applications include responsive to execution of a third-party application on a mobile device, transmitting a pre-login tunnel request to the cloud-based system; responsive to receiving a signed certificate from the cloud-based system, establishing a pre-login tunnel to one or more pre-login endpoints of the third-party application; performing authentication to the third-party application via the pre-login tunnel; and responsive to receiving a second signed certificate from the cloud-based system, establishing a post-login tunnel to one or more post-login endpoints of the third-party application.

Abstract: Systems and methods for active directory protection in zero trust networks. In an embodiment, steps include performing inline monitoring of traffic associated with a cloud-based system; detecting one or more active directory protocols based on the inline monitoring; classifying the traffic as being associated with any of the one or more active directory protocols; inspecting the traffic associated with the one or more detected active directory protocols; and generating one or more active directory logs based on the inspecting and classifying.

Abstract: Systems and methods for processing search queries are provided. A method, according to one implementation, includes a step of receiving a query from a user interface, the query including one or more questions or commands pertaining to datasets stored in a relational database. The method also includes a step of generating a prompt having instructions related to how a Large Language Model (LLM) is to handle a complex query having one or more cascading dependencies. Also, the method includes a step of providing the prompt, datasets, and query to an LLM with instructions to convert the query into Structure Query Language (SQL) code.

Abstract: Systems and methods for cloud discovery and orchestration include retrieving a plurality of out-of-band inputs related to a cloud environment; retrieving a plurality of inline inputs related to the cloud environment; determining one or more correlations between one or more destinations, sources, and networks associated with the cloud environment based on the out-of-band inputs and the inline inputs; and determining one or more relationships between the one or more destinations, sources, and networks based on the correlations.

Abstract: Systems and methods for automated network environment compliance control include receiving one or more security findings associated with an organization's network environment; analyzing, by a Large Language Model (LLM) agent, the one or more security findings to identify compliance requirements across a plurality of compliance frameworks; determining one or more compliance controls based on the compliance requirements identified by the LLM agent; validating each of the one or more compliance controls; and generating a compliance report including one or more implementation strategies and risk analyses for each validated compliance control.

Abstract: Systems and methods for automated reasoning and explanation of correlated factors in digital experience monitoring include collecting performance data from a plurality of sources, the performance metrics including network metrics, application performance metrics, device metrics, and user behavior metrics; identifying one or more anomalies and correlations between the collected performance data; processing the one or more anomalies and correlations with a Large Language Model (LLM) to generate one or more explanations for the identified anomalies and correlations; and presenting the generated explanations through a user interface.

Abstract: Systems and methods for self-service network reconciliation improve network performance in a cloud-based system by using an SDN controller to dynamically optimize routing paths. The SDN controller receives route information from BGP speakers and gathers user experience metrics—such as latency, jitter, or packet loss—to evaluate whether current routes meet performance or SLA targets. If a route falls short, the controller applies a smart routing algorithm to select an alternative path that better satisfies performance criteria. It then updates BGP attributes accordingly, causing traffic to shift to the improved route and enhancing overall user experience.

Abstract: The disclosed system and methods are used for collecting information of third-party applications. A search is performed for detecting uniform resource locator (URL) that is associated with a web page allowing to download at least one third-party application. The search is based on URL patterns that are previously and uniquely determined for each digital data source. An identifier, e.g., client ID, of a third-party application is extracted from each URL of a web page which allows to download a third-party application. Then, the system initiates a software as a service (SaaS) instance in a cloud-based computing environment. The system provides to the third-party application access credentials to access the SaaS instance and extract attributes and behavior data of the third-party application based on at least the actions performed by the third-party application in the SaaS instance.

Abstract: Systems and methods for similar domain detection include receiving a base domain, the base domain being associated with an enterprise; receiving a domain list comprising a plurality of domains; performing a plurality of similarity checks between the base domain and each of the plurality of domains within the domain list; and generating a directory of domains comprising one or more domains determined to be associated with the enterprise based on the one or more similarity checks.

Abstract: Systems and methods for anomaly detection based on endpoint and network traffic profiles include performing inline monitoring of traffic within a network of a plurality of networks via a cloud; identifying anomalous traffic within the traffic based on a network profile, wherein the network profile defines baseline network traffic parameters for the network; determining if one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic; and performing an action based on the determining.

Abstract: Systems and methods for privileged remote access to Operational Technology (OT)/Internet of Things (IOT)/Industrial IOT (IIOT)/Industrial Control System (ICS) infrastructure, implemented in a cloud-based system. The method includes steps of, responsive to determining a user can access an application associated with the OT/IOT/IIOT/ICS infrastructure, determining the users security and access policies and creating a session for the user; establishing a secure connection to the application via a lightweight connector connected to the application; and brokering a connection between the users device and the application through the lightweight connector, enabling the user to interact with the application for the OT/IOT/IIOT/ICS infrastructure, based on the user's security and access policies.

Abstract: Systems and methods for identifying device type within a network include receiving data associated with monitoring network communication traffic associated with a plurality of devices; analyzing the data of the plurality of devices, wherein the analyzing includes identifying one or more features of the data of each of the plurality of devices; and labeling each of the plurality of devices as one of a user device and a non-user device based on the one or more features.

Abstract: Systems and methods for generating and utilizing lookalike Uniform Resource Locators (URLs) include receiving an original target domain; generating a first generation of lookalike domains based on the original target domain and a plurality of deception methods; generating a penalty value for each of a plurality of lookalike domains in the first generation of lookalike domains; generating subsequent generations of lookalike domains and penalty values therefor based on penalty values associated with each of a plurality of lookalike domains in a preceding generation of lookalike domains; and repeating the steps for an N number of generations.