Abstract: Some embodiments address technical challenges arising from efforts to identify and mitigate security risks, in particular but not only, risks that sensitive data will be exfiltrated. Some embodiments provide or utilize an anomaly detector which is configured to detect a security anomaly in data based on at least a distribution of sensitive information type documents in a collection of documents and classifications of documents by trainable classifiers based on machine learning. Some embodiments provide or utilize a security policy generator which is configured to proactively and automatically generate security policy recommendations, rank at least two of the security policy recommendations, and present at least one top-ranked generated security policy recommendation in a user interface. Some embodiments generate a security policy in a managed computing system based on at least an anomaly score, and then configure the managed computing system according to the generated security policy.

Abstract: In some examples, a seed query is received. A set of candidate queries is retrieved from a database based on matching the seed query with each candidate query. Based on the seed query, a ranking model is used to assign a relevance score to each candidate query. The relevance score indicates suitability of the candidate query as a follow-up query to the seed query (“next query” suitability). At least one candidate query is outputted based on the relevance scores. For example, candidate queries may be ordered or filtered based on their relevancy scores. In some implementations, an action is instigated automatically or semi-automatically based on a model-generated response to a candidate query. In some implementations, generative model calls are instigated on the seed query and a next query selected from the candidate next queries.

Abstract: Some embodiments address technical challenges arising from efforts to identify and mitigate security risks, in particular but not only, risks that sensitive data will be exfiltrated. Some embodiments provide or utilize an anomaly detector which is configured to detect a security anomaly in data based on at least a distribution of sensitive information type documents in a collection of documents and classifications of documents by trainable classifiers based on machine learning. Some embodiments provide or utilize a security policy generator which is configured to proactively and automatically generate security policy recommendations, rank at least two of the security policy recommendations, and present at least one top-ranked generated security policy recommendation in a user interface. Some embodiments generate a security policy in a managed computing system based on at least an anomaly score, and then configure the managed computing system according to the generated security policy.