Abstract: Systems and methods for similar domain detection include receiving a base domain, the base domain being associated with an enterprise; receiving a domain list comprising a plurality of domains; performing a plurality of similarity checks between the base domain and each of the plurality of domains within the domain list; and generating a directory of domains comprising one or more domains determined to be associated with the enterprise based on the one or more similarity checks.

Abstract: Systems and methods for anomaly detection based on endpoint and network traffic profiles include performing inline monitoring of traffic within a network of a plurality of networks via a cloud; identifying anomalous traffic within the traffic based on a network profile, wherein the network profile defines baseline network traffic parameters for the network; determining if one or more other networks of the plurality of networks exhibit traffic similar to the anomalous traffic; and performing an action based on the determining.

Abstract: Systems and methods for privileged remote access to Operational Technology (OT)/Internet of Things (IOT)/Industrial IOT (IIOT)/Industrial Control System (ICS) infrastructure, implemented in a cloud-based system. The method includes steps of, responsive to determining a user can access an application associated with the OT/IOT/IIOT/ICS infrastructure, determining the users security and access policies and creating a session for the user; establishing a secure connection to the application via a lightweight connector connected to the application; and brokering a connection between the users device and the application through the lightweight connector, enabling the user to interact with the application for the OT/IOT/IIOT/ICS infrastructure, based on the user's security and access policies.

Abstract: Systems and methods for identifying device type within a network include receiving data associated with monitoring network communication traffic associated with a plurality of devices; analyzing the data of the plurality of devices, wherein the analyzing includes identifying one or more features of the data of each of the plurality of devices; and labeling each of the plurality of devices as one of a user device and a non-user device based on the one or more features.

Abstract: Systems and methods for generating and utilizing lookalike Uniform Resource Locators (URLs) include receiving an original target domain; generating a first generation of lookalike domains based on the original target domain and a plurality of deception methods; generating a penalty value for each of a plurality of lookalike domains in the first generation of lookalike domains; generating subsequent generations of lookalike domains and penalty values therefor based on penalty values associated with each of a plurality of lookalike domains in a preceding generation of lookalike domains; and repeating the steps for an N number of generations.

Abstract: Systems and methods for cloud-based policy enforcement and risk controls based on geopolitical insights include ingesting external data feeds from a plurality of sources, the external data feeds providing information indicative of geopolitical factors; analyzing the ingested data to classify one or more geographic regions, networks, or user populations into risk categories; determining, for each tenant of the cloud-based system, a level of acceptable risk tolerance that defines actions to be taken upon assignment of a particular risk category to a region or user population; and applying, based on the determined risk tolerance and assigned risk category, one or more adaptive cybersecurity controls.

Abstract: An edge device, disposed at a branch network and configured to connect the branch network to a wide area network (WAN), the edge device includes circuitry configured to: interconnect with a plurality of local area network (LAN) interfaces in the branch network; form, over the plurality of LAN interfaces, a set of logical tunnels for high-availability (HA) traffic associated with clustering of a plurality of edge devices in the branch network; and distribute the HA traffic the set of logical tunnels to provide redundancy and resilience if one of the plurality of LAN interfaces fails or becomes congested.

Abstract: Systems and methods for enabling cybersecurity inquiries are provided. In one implementation, a method includes a step of receiving cybersecurity threat intelligence data from one or more threat intelligence sources. The method also includes structuring the cybersecurity threat intelligence data into one or more threat intelligence tables each having a plurality of fields describing attributes of network security threats. Also, the method includes sampling rows from each of the one or more threat intelligence tables and programmatically generating, from each corresponding row, a plurality of Q/A/R triples, each Q/A/R triple including a Question element, an Answer element, and a Reasoning element derived from one or more fields. Next, the method includes a step of generating a cybersecurity-focused language model from the one or more threat intelligence tables and the plurality of Q/A/R triples, wherein the cybersecurity-focused language model, when trained, is configured to answer network security inquiries.

Abstract: A systems and methods for determining a risk score for lookalike domains are disclosed. A plurality of candidate domains are generated from a seed domain using a genetic algorithm that applies deception techniques. Registered candidate domains are analyzed by multiple independent scoring engines that produce an internal deception score, a reputation score, a visual similarity score based on rendered webpage analysis, and a favicon similarity score. The individual scores are dynamically weighted and combined using conditional logic to calculate a final risk score. The weighting adapts based on signal strength, including prioritizing visual cloning indicators or malicious infrastructure signals. Unregistered domains are assigned reduced priority. When the final risk score exceeds a predefined threshold, an alert is generated. The disclosed approach integrates lexical, infrastructure, and content-based signals to reduce false positives and improve detection of sophisticated phishing domains.

Abstract: Systems and methods for an AI agent for agent applications including performing inline monitoring of traffic originating from the user device; receiving a query from a user associated with the user device, the query being associated with an issue affecting connectivity of the user device to one or more resources; analyzing the query via an Artificial Intelligence (AI) agent of the agent application; and any of providing one or more remediation steps for resolving the connectivity issue, generating and submitting an Information Technology (IT) support ticket, and autonomously performing one or more actions to resolve the connectivity issue via the AI agent of the agent application.

Abstract: Systems and methods for providing monitoring and troubleshooting for services of a cloud-based system include receiving a request from a user, the request being for any of monitoring and troubleshooting one or more services provided by the cloud-based system; submitting a job to one or more observability agents associated with the one or more services of the cloud-based system; receiving a response from the one or more observability agents, the response including metrics associated with the one or more services; and providing the response to the user.

Abstract: Systems and methods include receiving one or more disaster recovery configurations via a cloud-based system; storing the one or more received disaster recovery configurations in one or more components of the cloud-based system; identifying activation of a disaster recovery mode; and providing private application access based on one or more disaster recovery configurations.

Abstract: Systems and methods for managing a plurality of cloud services of a cloud-based system include receiving a request from a client associated with a cloud-based system, wherein the request is to perform one or more actions associated with the cloud-based system; determining if the client is allowed to perform the one or more actions based on a scope associated with the client; and routing the request to one or more services of the cloud-based system based on the determining. The systems can automatically determine the one or more services of the cloud-based system associated with the request; and route the request to the one or more services of the cloud-based system based thereon.

Abstract: Generating a natural language context from a ticket management system includes receiving an unstructured natural language query from a client device; generating a first prompt for a first large language model (LLM) based on: a predefined template and the unstructured natural language query, the first prompt when processed by the first LLM outputs a structured database query; executing the structured database query on a database, the database including a representation of a cloud computing environment; generating a second prompt for a second LLM based on a result of executing the structured database query, the second prompt when processed by the second LLM outputs a natural language response; and sending the natural language response to the client device.

Abstract: Systems and methods for uniquely labeling egress traffic from Secure Service Edge (SSE) platforms include intercepting traffic at cloud, wherein the traffic is associated with a tenant of one or more tenants of the cloud, and wherein the traffic is destined for an application; labeling the traffic with an egress Internet Protocol (IP) address and a unique hash value; and forwarding the traffic including the egress IP address and the unique hash value to the application. The unique hash value is unique to the tenant and identifiable by the application for determining the tenant of the one or more tenants based thereon.

Abstract: The present disclosure includes systems and methods for a security policy framework. Various embodiments include responsive to receiving a trigger, fetching one or more policies from a policy catalog service; compiling the one or more policies into a query, wherein the one or more policies can be compiled into a plurality of different query languages; executing the query over customer data, the customer data being located in one or more data sources; and persisting results of the query.

Abstract: Systems and methods for detecting SDP user accounts that are associated with a company include querying a software development platform for account and repository data based on a customer name for each account analyzing associated account and repository data, generating a score for each account of the plurality of accounts based on the analyzing, the score being indicative of an account belonging to the customer, and labeling one or more accounts of the plurality of accounts as belonging to the customer based on the score.

Abstract: Systems and methods for intelligent dynamic security profiles for Web Application Firewalls (WAFs) include receiving raw data related to operation of a plurality of Web Application Firewall (WAF) agents, wherein the plurality of WAF agents are distributed across multiple tenants globally over the Internet; normalizing and sanitizing the raw data; analyzing the normalized and sanitized data with a machine learning algorithm to determine prioritization of rules in a given WAF agent based on the raw data and an objective; and providing a security profile to the given WAF agent where the security profile includes a selection of the rules based on the prioritization and the objective.

Abstract: A system and method for detecting a protection gap in a cybersecurity system is provided. The method includes scanning a computing environment to detect a cybersecurity monitoring system connected to the computing environment; scanning the computing environment to detect a plurality of resources deployed in the computing environment; detecting a resource of the plurality of resources which is of a first resource type; determining that the cybersecurity monitoring system is not configured to monitor the first resource type; and initiating a mitigation action in response to determining that the cybersecurity monitoring system is not configured to monitor the first resource type.

Abstract: Systems and methods are provided for customizing flow paths to better handle queries and questions directed to a Large Language Model (LLM) or another automated search model. According to one implementation, a method includes a step of receiving a question from a user device. The method further includes a step of determining a level of complexity of the question. Also, the method includes tailoring a divide-and-conquer plan when the complexity of the question is determined to be higher than a lowest level of complexity. The method then includes a step of executing the divide-and-conquer plan to produce an answer to the question.