Abstract: A method for evaluating a scope of cyber-attack incidents, the method may include detecting original compromised assets and malicious external machines that are related to each of the cyber-attack incidents; classifying potentially compromised assets to different classes based on (a) similarities between the potentially compromised assets and the original compromised assets, (b) a level of accessibility from the original compromised assets and malicious external machines to the potentially compromised assets, and (c) volumes of traffic between the potentially compromised assets and each one of the malicious external machines and the original compromised assets; wherein the different classes comprise compromised and non-compromised; and generating an alert that is indicative of the compromised assets and of potentially compromised assets that were classified as compromised.

Abstract: A system for retrieving information related to a topic of interest, comprising: (a) a finder for finding a location of a computerized source of information, the information being divided into at least one message, such that the source of information is a located source of information, the finder being a self-operated software program; (b) a source repository for storing the location of the located source of information; (c) a sampler for sampling the located source of information by retrieving the at least one message from the located source of information, such that the at least one message is a retrieved message, the sampler being a self-operated software program; (d) a matcher for determining a matching score for the retrieved message, the matcher being a self-operated software program; and (e) a message repository for storing the retrieved message and the matching score.