Abstract: Automatically investigating security incidents and generating security incident reports using a Large Language Model (LLM). A computerized system receives an incoming Security Alert Message pertaining to a possible security-related incident. The system automatically feeds into the LLM at least: the content of the Security Alert Message; the metadata of the Security Alert Message; context information describing a security domain; and organization context information pertaining to users and machines of that organization. The system automatically prompts the LLM to automatically investigate the Security Alert Message and to automatically generate a detailed Incident Report pertaining to the Security Alert Message.

Abstract: Automatically investigating security incidents and generating security incident reports using a Large Language Model (LLM). A computerized system receives an incoming Security Alert Message pertaining to a possible security-related incident. The system automatically feeds into the LLM at least: the content of the Security Alert Message; the metadata of the Security Alert Message; context information describing a security domain; and organization context information pertaining to users and machines of that organization. The system automatically prompts the LLM to automatically investigate the Security Alert Message and to automatically generate a detailed Incident Report pertaining to the Security Alert Message.

Abstract: A system for managing access to services in a computing system. The system includes processes to allow users to request access to services, and the automated review of such requests. The system is configured to consider a wide range of factors, including the content of the request and the service requested, information relating to the user, and metadata relating to the service, as well as user behaviours. Natural language analysis is utilised to analyse a user's request for access and the service to which access is requested.

Abstract: A system for managing access to objects in a computing system. The system includes processes to allow users to request access to objects, and the automated review of such requests. The system is configured to consider a wide range of factors, including the content of the request and the object requested, information relating to the user, and metadata relating to the document, as well as user behaviours. Natural language analysis is utilised to analyse a user's request for access and the object to which access is requested.

Abstract: Improved email security and prevention of phishing attacks using a Large Language Model (LLM) engine. A computerized method includes evaluating whether a digital message received at a Protected Entity is malicious or legitimate, by performing: (a) obtaining extracted data from documents and data repositories of the Protected Entity; feeding the extracted data into an LLM engine; and constructing an Organizational Context Index having vectors of LLM-generated embeddings that describe relations and roles of members and objects of the Protected Entity; (b) prompting the LLM to evaluate whether the digital message is malicious or legitimate, based on LLM analysis of a query envelope that includes at least: (i) content of the digital message, and (ii) meta-data of the digital message, and (iii) a set of LLM-based embeddings from the Organizational Context Index that pertain to that digital message.