Abstract: A system and method for inspecting a resource in an on-premises environment for a cybersecurity threat is presented. The method includes initiating a network communication between an on-premises environment and an inspection environment; scanning the on-premises environment for a workload, the workload including a disk; generating an inspectable disk based on the disk; providing access to an inspector deployed in the inspection environment to inspect the inspectable disk for a cybersecurity object; and releasing a resource allocated to the inspectable disk in response to detecting that inspection of the inspectable disk is complete.

Abstract: A system and method detect a malware infection path in a compute environment. The method includes detecting a malware object on a first workload in a computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph including an endpoint node representing a resource which is accessible to a public network; generating a potential infection path between the resource node and the endpoint node including at least a second resource node connected to the resource node; inspecting a second workload of the plurality of workloads represented by the second resource node; determining that the potential infection path is a confirmed infection path, in response to detecting the malware on the second workload; and determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware.

Abstract: A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing.

Abstract: A system and method for detecting cybersecurity issues in a cloud computing environment is presented. The method includes: detecting a plurality of objects deployed in the cloud computing environment, including a first object of a first type and a second object of a second type, wherein each object of the plurality of objects includes a unique identifier; selecting a group of objects of the plurality of objects, based at least on the unique identifier of each object of the group of objects; selecting an inspector workload from a plurality of inspectors based at least on an attribute of a first object of the group of objects; inspecting the first object of the group of objects by the selected inspector; generating an enriched dataset based on a result of inspecting the first object; and detecting a vulnerability on the first object based on the enriched dataset.

Abstract: A system and method for evaluating definitions from a markup language document for agentless host configuration includes generating an inspectable disk based on a disk of a host, the host deployed in a virtualized computing environment. The system is configured to: receive a markup language document, the markup language document including a plurality of definitions, each definition including a data element; inspect the inspectable disk for a cybersecurity object corresponding to a first data element of a first definition of the plurality of definitions; evaluate the first definition further based on the cybersecurity object to generate an evaluated first definition result, in response to determining that the definition is evaluable; generate an output based on the evaluated first definition result; and generate the output based on a predetermined notification, in response to determining that the definition is unevaluable.

Abstract: A system and method for applying a cybersecurity contextual policy in a cloud computing environment is presented. The method includes detecting a cybersecurity object in the cloud computing environment; selecting a policy from a policy engine of the cloud computing environment, the policy including a conditional rule; generating an exception to the conditional rule based on the cybersecurity object; generating a contextual policy based on: the conditional rule, and the exception to the conditional rule; and configuring an admission controller of a software container cluster deployed in the computing environment to apply the contextual policy.

Abstract: A system and method for detecting a cybersecurity object in operating system-level virtualization objects. The method comprises: inspecting a first image of an operating system-level virtualization for a cybersecurity object; inspecting a second image for the cybersecurity object, wherein the second image is based off of the first image; associating the cybersecurity object with the first image, in response to detecting the cybersecurity object in the first image and detecting the cybersecurity object in the second image; and associating the cybersecurity object with the second image, in response to detecting the cybersecurity object in the second image and not detecting the cybersecurity object in the first image.

Abstract: A system and method for reducing redundancy in inspecting container layers for cybersecurity objects is presented. The method includes generating a diff output between a first container layer of a live container and a second container layer of a container image, wherein the second container layer is previously generated based off of the first container layer, wherein the diff output includes a software object; inspecting the first container layer for a cybersecurity object; inspecting the diff output for the cybersecurity object; associating the cybersecurity object with the first container layer in response to detecting the cybersecurity object in the first container layer and not in the diff output; and associating the cybersecurity object with the second container layer in response to detecting the cybersecurity object in the diff output and not in the first container layer.

Abstract: A system and method for determining an artificial intelligence (AI) security posture management (SPM) of a cloud computing environment is presented. The method includes inspecting the cloud computing environment for components of an AI pipeline; generating an AI pipeline representation based on a representation of each component of the AI pipeline in a security database; inspecting the cloud computing environment for a cybersecurity object associated with a component of the AI pipeline; analyzing the AI pipeline for a cybersecurity risk based on a result of inspecting the cloud computing environment for the cybersecurity object; and initiating a remediation action in the cloud computing environment in response to detecting the cybersecurity risk.

Abstract: A system and method for cybersecurity inspection of a volume based on image layers is disclosed. In some implementations, the method may include generating an inspectable disk based on a volume of a virtual instance, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers. In addition, the method may include parsing a manifest associated with the volume, the manifest including an identifier of each unique layer. The method may include determining an order of layers based on the manifest, where a first layer of the virtual instance is deployed prior to a second layer of the virtual instance. Moreover, the method may include initiating inspection for a cybersecurity object on a first layer of the plurality of layers. Also, the method may include initiating a mitigation action in response to detecting the cybersecurity object.

Abstract: A system and method for inspecting different types of cloud workloads for cybersecurity threats, all deployed in a cloud computing environment, includes a unifying extractor to expose different compute types to agnostic inspectors. The method includes accessing a first cloud workload of a first type from a plurality of deployed cloud workloads; accessing a second cloud workload of a second type from the plurality of deployed cloud workloads; extracting data from each of the first cloud workload and the second cloud workload into a storage layer having a data schema, based on a predefined data structure; and inspecting the extracted data to detect a first target object, the target object indicating a cybersecurity threat, wherein extraction for each of the first cloud workload and the second cloud workload is based on the workload type.

Abstract: A system and method for inspecting a running container for a cybersecurity object in a cloud computing environment is disclosed. The method includes: generating a clone of a disk, wherein the disk is deployed in a cloud computing environment; detecting a software container on the generated clone of the disk; and inspecting the software container for a cybersecurity object, in response to determining that the container is a running container.

Abstract: A method for scalable vulnerability detection is provided. The method includes selecting at least a workload of a plurality of workloads deployed in a first cloud environment for inspection, wherein the workload includes a first volume; generating in a remote cluster an inspection node, the inspection node including at least a first disk, wherein the remote cluster provisions inspection nodes in response to demand for inspection nodes; generating a persistent volume (PV) on which the at least a first disk is mounted, wherein the at least a first disk is generated from a snapshot of the first volume; and generating a persistent volume claim (PVC) of the PV for an inspector workload, wherein the inspector workload is configured to inspect the PV for an object, and wherein inspector workloads are provisioned in response to demand for inspector workloads.

Abstract: A system and method for applying a cybersecurity contextual policy in a computing environment are disclosed. In an embodiment, the method includes: detecting a cybersecurity object on a virtualization, the virtualization deployed in a computing environment; detecting a policy of the computing environment, the policy including a conditional rule; generating a contextual policy based on: the conditional rule, and an exception to the conditional rule based on the cybersecurity object; and configuring an admission controller of a software container cluster deployed in the computing environment to apply the contextual policy.

Abstract: The system and method for agentless detection of sensitive data in a cloud computing environment are presented. The method includes extracting a data schema of a data file from the data file; deploying the data file in a cloud computing environment; storing the data schema in a security database, the security database including a representation of the cloud computing environment; generating a data file node in the security database, the data file node corresponding to the data file; classifying a type of sensitive data in the data file; updating a value in metadata of the data file node, the value indicating the classified type of sensitive data; and performing a mitigation action based on the classified type of sensitive data and a location of the data file.

Abstract: A system and method provide detection of a malware attack path. The method includes detecting at a first time a malware object on a first workload deployed in the compute environment, wherein the first workload is represented by a first node in a security graph, the security graph including a representation of the compute environment; querying the security graph to detect a second node connected to the first node, wherein the connection indicates that the first workload represented by the first node can access a second workload represented by the second node; and generating an instruction to inspect the second workload represented by the second node at a second time, occurring after the first time.

Abstract: A system and method for inspecting a resource in an on-premises environment for a cybersecurity threat are disclosed. According to an embodiment, the method includes initiating a network communication between an on-premises environment and an inspection environment; scanning the on-premises environment for a workload, the workload including a disk; generating an inspectable disk based on the disk; providing access to an inspector deployed in the inspection environment to inspect the inspectable disk for a cybersecurity object; and releasing a resource allocated to the inspectable disk in response to detecting that inspection of the inspectable disk is complete.

Abstract: A system and method for inspecting virtual instances in a cloud computing environment for cybersecurity threats utilizing disk cloning. The method includes: selecting a virtual instance in a cloud computing environment, wherein the virtual instance includes a disk having a disk descriptor with an address in a cloud storage system; generating an instruction to clone the disk of the virtual instance, the instruction when executed causes generation of a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the virtual instance; inspecting the cloned disk for a cybersecurity threat; and releasing the cloned disk in response to completing the inspection of the cloned disk.

Abstract: A system and method for agentless detection of sensitive data in a cloud computing environment is presented. The method includes inspecting a disk for a cybersecurity object, the cybersecurity object indicating sensitive data, wherein the disk is deployed in a cloud computing environment; extracting a data schema from the cybersecurity object, in response to detecting the cybersecurity object on the disk; generating a classification of the data schema; determining that the data schema corresponds to sensitive data based on the generated classification; detecting in the disk a plurality of data files, each data file including the data schema; generating in a security database: a representation of the data schema, and a representation of each data file; and rendering a visual representation of the cloud computing environment including a representation of the data schema based on a query result of the security database.

Abstract: A system and method for reducing redundancy in inspecting container layers for cybersecurity objects includes: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: generate a diff output between a first container layer and a second container layer, wherein the second container layer is previously generated based off of the first container layer, wherein the diff includes at least an object; inspect the first container layer for a cybersecurity object; inspect the object for the cybersecurity threat; associate the cybersecurity object with the first container layer in response to detecting the cybersecurity object in the first container layer and not in the at least an object; and associate the cybersecurity object with the second container layer in response to detecting the cybersecurity object in the at least an object and not in the first container layer.