Abstract: A method for access verification in an IAM system, comprising: receiving a role and a group of users associated with the role, the role comprising a list of role entitlements indicative of given permissions to execute first actions by each user of the group of users; for each one of the at least a portion of the group of users, retrieving a respective list of user entitlements indicative of actual permissions to execute second actions, the actual permissions having been granted to a respective user; for each one of the at least portion of the group of users, comparing the respective list of user entitlements to the list of role entitlements; and outputting an identification of a given user of the at least portion of the group of users in response to the respective list of user entitlements exceeding the list of role entitlements for the given user:

Abstract: A system for generating a cybersecurity investigation case that comprises: an event parser for receiving an event and identifying at least one empty entity from the received event; a case investigator for determining a value to the at least one empty entity to obtain at least one enriched entity; a case correlator for associating at least one existing investigation case to the received event; and a case manager for generating and outputting the cybersecurity investigation case.

Abstract: A computer-implemented method for defining roles, comprising: receiving access usage data comprising identities and respective performed actions; receiving a list of entitlements each allowing the execution of at least one respective action; generating a plurality of groups of actions by regrouping given ones of the identities having associated thereto a same group of the respective performed actions using the access usage data; for each one of the plurality of groups of actions, determining a group of entitlements contained in the list of entitlements that allow the execution of the group of actions; for each one of the plurality of groups of actions, associating thereto the respective group of entitlements, thereby obtaining a plurality of roles; and outputting the plurality of roles.

Abstract: A system for anomaly estimation for a telephonic call is described, receiving a call object including an identifier field associating the call object to a purported user; retrieving a user data object associated with the purported user, and processing the user data object to retrieve one or more vectorized user features associated with the purported user. A neural network processes the one or more vectorized call features and the one or more vectorized user features through a machine learning model.