Abstract: Systems and methods are provided for predicting the validity or authorization of a user to access applications (apps) in a network. A method, according to one implementation, includes a step of obtaining transaction logs that include a) user features related to a plurality of users of an organization, b) app features related to a plurality of apps used within the organization, and c) user-app interaction information related to requests by users to access apps in addition to responses to the requests to either permit or deny user access. Also, the method includes a step of applying a collaborative filtering technique on the transaction logs to train an Artificial Intelligence (AI) model for predicting whether a new user is legitimately permitted access to one or more of the plurality of apps.

Abstract: Systems and methods for zero trust access control are provided. A cloud-based security platform positioned between an entity and a network resource detects a request by the entity to connect to, access, or communicate with the network resource and blocks the request by default pending completion of a plurality of evaluation procedures. A verification procedure evaluates at least an identity of the entity and a context associated with the request. A control procedure evaluates at least one of a risk associated with the entity, presence of malicious content in traffic associated with the request, and presence of sensitive data in the traffic. An enforcement procedure determines, based on outputs of the verification procedure and the control procedure, an action to apply to the request, the action being selected from a plurality of conditional allow actions and a plurality of conditional block actions.

Abstract: Systems and methods for detecting and responding to threats in a cloud native computing environment include steps of collecting, from one or more sensors configured to monitor container hosts, runtime telemetry that includes process activity, system call traces, and network traffic data; ingesting, into a data fabric, the runtime telemetry along with log data from a cloud system positioned to block suspicious traffic; analyzing the ingested runtime telemetry and the log data to identify one or more indicators of compromise (IoCs); correlating an event blocked by the cloud system at the perimeter with the identified IoCs from the runtime telemetry; and initiating, based on the correlation, an automated remediation action in the cloud native computing environment.

Abstract: Systems and methods for measuring and assigning network experience scores include collecting end-to-end metric data corresponding to application traffic between one or more clients and one or more servers, the metric data including any of latency, jitter, and packet loss; comparing the metric data with baseline percentile values; assigning one or more scores to one or more segments of a path associated with the application traffic based on the metric data and the baseline percentile values; and aggregating the scores of the one or more segments to produce a single network experience score indicative of overall network performance for the application traffic.

Abstract: Systems and methods for cloud-based multi-layered privacy protection and tracking prevention include routing traffic of a plurality of users associated with a tenant of the cloud-based system through a Secure Web Gateway (SWG) of a cloud-based system; analyzing traffic of a user of the plurality of users for privacy threats; employing one or more defense modules to protect the user from the privacy threats based on the analyzing; and monitoring performance of a destination of the traffic to detect performance degradation due to the one or more defense modules.

Abstract: Systems and methods are provided for enabling hybrid processing of cybersecurity analysis for embedded systems in vehicles, whereby local cybersecurity threats are detected locally on the vehicle itself, while a remote edge server can provide more comprehensive cybersecurity threat analysis. According to one implementation, an embedded system may be installed on or incorporated within a vehicle. The embedded system, for example, includes a wireless transceiver device and an operating system including at least a kernel and a cybersecurity agent. The cybersecurity agent includes minimal resources for contributing base level or lightweight functionality with respect to protection against vehicle cybersecurity attacks. The wireless transceiver device is configured to offload vehicle data to a cloud-based server, the cloud-based server configured for contributing detailed level or heavyweight functionality with respect to protection against the vehicle cybersecurity attacks.

Abstract: Systems and methods for Hypertext Markup Language (HTML) sandboxing with browser isolation include responsive to a user attempting to access a webpage, sending the webpage to a sandbox for performing an analysis on the webpage; rendering the webpage within a browser isolation session, thereby allowing the user to interact with the webpage while the analysis is being performed; generating a score for the webpage based on the analysis, the score being indicative of the maliciousness of the webpage; and performing one or more actions based on the score associated with the webpage.

Abstract: Systems and methods for optimized cloud-based Data Loss Prevention (DLP) include monitoring user traffic associated with one or more tenants of the cloud-based system, the traffic including actions performed in association with a file sharing and storage service; responsive to a user accessing a file within the file sharing and storage service, performing a DLP scan requirement analysis; based on a result of the DLP scan requirement analysis, (i) performing a DLP scan of the file or (ii) bypassing a DLP scan of the file; and performing one or more actions based on policy associated with the user and the file.

Abstract: A system and method for generating a cybersecurity risk profile based on an identity in a computing environment is disclosed. The method includes: detecting a plurality of identities in a computing environment, each identity including a permission to initiate an action in the computing environment; querying an identity and access management service to detect a permission associated with a first identity of the plurality of identities; accessing an activity log of the computing environment; parsing the activity log to detect an event based on the first identity; and generating an identity risk profile based on: the detected event, and the detected permission.

Abstract: A system and method for cybersecurity vulnerability management through ticket system reduction reduces alert fatigue. The method includes, responsive to monitoring of a computing environment by a plurality of cybersecurity monitoring systems, receiving a plurality of alerts from the plurality of cybersecurity monitoring systems that provide overlapping detection of cybersecurity issues and do not communicate with one another, such that a given alert from each of the plurality of cybersecurity monitoring systems possibly relates to a same cybersecurity issue; preprocessing the plurality of alerts to identify any alerts for the same cybersecurity issue; and generating tickets for the plurality of alerts including a unified ticket for the any alerts for the same cybersecurity issue thereby reducing tickets by using the unified ticket for duplicate alerts from the plurality of cybersecurity monitoring systems.

Abstract: Systems and methods for Data Loss Protection (DLP) utilizing distilled models include receiving a plurality of general data predictions from a teacher model; determining one or more strengths of the teacher model based on the received general data predictions; generating a synthetic dataset based on the one or more strengths of the teacher model; providing the synthetic dataset to the teacher model and receiving a plurality of synthetic data predictions from the teacher model based thereon; and performing knowledge distillation on a student model based on the synthetic data predictions received from the teacher model to produce a distilled model. The distilled model is then used in production for classifying inputs to a DLP system.

Abstract: Systems and methods for policy based seamless authentication for PRA systems through zero trust private networks. The various systems and methods described herein include steps of receiving a request to access a Privileged Remote Access (PRA) system; determining if any credential rules apply to a console associated with the request; retrieving credentials associated with any of a user and the console from a database, thereby avoiding the user being required to provide credentials; and providing access to the requested PRA system based on the retrieved credentials.

Abstract: Systems and methods for providing private access to third-party applications include responsive to execution of a third-party application on a mobile device, transmitting a pre-login tunnel request to the cloud-based system; responsive to receiving a signed certificate from the cloud-based system, establishing a pre-login tunnel to one or more pre-login endpoints of the third-party application; performing authentication to the third-party application via the pre-login tunnel; and responsive to receiving a second signed certificate from the cloud-based system, establishing a post-login tunnel to one or more post-login endpoints of the third-party application.

Abstract: Systems and methods for active directory protection in zero trust networks. In an embodiment, steps include performing inline monitoring of traffic associated with a cloud-based system; detecting one or more active directory protocols based on the inline monitoring; classifying the traffic as being associated with any of the one or more active directory protocols; inspecting the traffic associated with the one or more detected active directory protocols; and generating one or more active directory logs based on the inspecting and classifying.

Abstract: Systems and methods for processing search queries are provided. A method, according to one implementation, includes a step of receiving a query from a user interface, the query including one or more questions or commands pertaining to datasets stored in a relational database. The method also includes a step of generating a prompt having instructions related to how a Large Language Model (LLM) is to handle a complex query having one or more cascading dependencies. Also, the method includes a step of providing the prompt, datasets, and query to an LLM with instructions to convert the query into Structure Query Language (SQL) code.

Abstract: Systems and methods for cloud discovery and orchestration include retrieving a plurality of out-of-band inputs related to a cloud environment; retrieving a plurality of inline inputs related to the cloud environment; determining one or more correlations between one or more destinations, sources, and networks associated with the cloud environment based on the out-of-band inputs and the inline inputs; and determining one or more relationships between the one or more destinations, sources, and networks based on the correlations.

Abstract: Systems and methods for automated network environment compliance control include receiving one or more security findings associated with an organization's network environment; analyzing, by a Large Language Model (LLM) agent, the one or more security findings to identify compliance requirements across a plurality of compliance frameworks; determining one or more compliance controls based on the compliance requirements identified by the LLM agent; validating each of the one or more compliance controls; and generating a compliance report including one or more implementation strategies and risk analyses for each validated compliance control.

Abstract: Systems and methods for automated reasoning and explanation of correlated factors in digital experience monitoring include collecting performance data from a plurality of sources, the performance metrics including network metrics, application performance metrics, device metrics, and user behavior metrics; identifying one or more anomalies and correlations between the collected performance data; processing the one or more anomalies and correlations with a Large Language Model (LLM) to generate one or more explanations for the identified anomalies and correlations; and presenting the generated explanations through a user interface.

Abstract: Systems and methods for self-service network reconciliation improve network performance in a cloud-based system by using an SDN controller to dynamically optimize routing paths. The SDN controller receives route information from BGP speakers and gathers user experience metrics—such as latency, jitter, or packet loss—to evaluate whether current routes meet performance or SLA targets. If a route falls short, the controller applies a smart routing algorithm to select an alternative path that better satisfies performance criteria. It then updates BGP attributes accordingly, causing traffic to shift to the improved route and enhancing overall user experience.

Abstract: The disclosed system and methods are used for collecting information of third-party applications. A search is performed for detecting uniform resource locator (URL) that is associated with a web page allowing to download at least one third-party application. The search is based on URL patterns that are previously and uniquely determined for each digital data source. An identifier, e.g., client ID, of a third-party application is extracted from each URL of a web page which allows to download a third-party application. Then, the system initiates a software as a service (SaaS) instance in a cloud-based computing environment. The system provides to the third-party application access credentials to access the SaaS instance and extract attributes and behavior data of the third-party application based on at least the actions performed by the third-party application in the SaaS instance.