Abstract: A system and method for detecting a permission escalation event in a computing environment is disclosed. The method includes: generating a cloned disk based on an original disk of a resource deployed in a computing environment; detecting an identifier of a first principal on the cloned disk; detecting a second principal in the computing environment, the first principal authorized to assume the first principal; storing a representation of the computing environment in a security database, including: a first principal node representing the first principal, and a second principal node representing the second principal, further associated with a permission; querying the representation to determine a permission of the first principal; determining that the second principal includes a permission which the first principal does not include based on a result of querying the representation; and generating a permission escalation event.

Abstract: A system and method for providing cybersecurity incident response is presented. The method includes receiving an incident input based on an event in a computing environment; generating an input for a generative artificial intelligence (AI) based on the received incident input; utilizing the generative AI to generate an output based on the generated input; utilizing the generative AI to associate the received incident input with an incident response action of a plurality of incident response actions; generating a query based on the received incident; executing the query on a security database, the security database including a representation of the computing environment; and initiating a mitigation action based on a result of the executed query and the associated incident response action.

Abstract: A system and method for technology stack discovery by performing active inspection of a cloud computing environment utilizing disk cloning is presented. The method includes generating an inspectable disk based on an original disk of a reachable resource, wherein the reachable resource is deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment; detecting a cybersecurity object, indicating an application, on the inspectable disk; selecting a network path to access the reachable resource; executing an access instruction including a network protocol on the network path to send an instruction to the reachable resource, wherein the reachable resource is configured to send a response to the instruction; and determining that the application is deployed on the reachable resource and utilizing the network protocol, based on detecting in the response a predetermined result.

Abstract: A system and method for tracing suspicious activity to a workload based on a forensic log is presented. The method includes detecting in a cloud log of a cloud computing environment a plurality of events, each event indicating an action in the cloud computing environment; extracting from a first event of the plurality of events an identifier of a cloud entity, wherein the first event includes an action, wherein the action indicates a suspicious event; traversing a security graph to detect a node representing the cloud entity, wherein the security graph further includes a representation of the cloud computing environment; detecting that the node representing the cloud entity is connected to a node representing a cybersecurity vulnerability; and initiating a mitigation action in the cloud computing environment based on the cloud entity and based on the cybersecurity vulnerability.

Abstract: A system and method for inspecting a resource in an on-premises environment for a cybersecurity threat is presented. The method includes initiating a network communication between an on-premises environment and an inspection environment; scanning the on-premises environment for a workload, the workload including a disk; generating an inspectable disk based on the disk; providing access to an inspector deployed in the inspection environment to inspect the inspectable disk for a cybersecurity object; and releasing a resource allocated to the inspectable disk in response to detecting that inspection of the inspectable disk is complete.

Abstract: A system and method detect a malware infection path in a compute environment. The method includes detecting a malware object on a first workload in a computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph including an endpoint node representing a resource which is accessible to a public network; generating a potential infection path between the resource node and the endpoint node including at least a second resource node connected to the resource node; inspecting a second workload of the plurality of workloads represented by the second resource node; determining that the potential infection path is a confirmed infection path, in response to detecting the malware on the second workload; and determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware.

Abstract: A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing.

Abstract: A system and method for detecting cybersecurity issues in a cloud computing environment is presented. The method includes: detecting a plurality of objects deployed in the cloud computing environment, including a first object of a first type and a second object of a second type, wherein each object of the plurality of objects includes a unique identifier; selecting a group of objects of the plurality of objects, based at least on the unique identifier of each object of the group of objects; selecting an inspector workload from a plurality of inspectors based at least on an attribute of a first object of the group of objects; inspecting the first object of the group of objects by the selected inspector; generating an enriched dataset based on a result of inspecting the first object; and detecting a vulnerability on the first object based on the enriched dataset.

Abstract: A system and method for evaluating definitions from a markup language document for agentless host configuration includes generating an inspectable disk based on a disk of a host, the host deployed in a virtualized computing environment. The system is configured to: receive a markup language document, the markup language document including a plurality of definitions, each definition including a data element; inspect the inspectable disk for a cybersecurity object corresponding to a first data element of a first definition of the plurality of definitions; evaluate the first definition further based on the cybersecurity object to generate an evaluated first definition result, in response to determining that the definition is evaluable; generate an output based on the evaluated first definition result; and generate the output based on a predetermined notification, in response to determining that the definition is unevaluable.

Abstract: A system and method for applying a cybersecurity contextual policy in a cloud computing environment is presented. The method includes detecting a cybersecurity object in the cloud computing environment; selecting a policy from a policy engine of the cloud computing environment, the policy including a conditional rule; generating an exception to the conditional rule based on the cybersecurity object; generating a contextual policy based on: the conditional rule, and the exception to the conditional rule; and configuring an admission controller of a software container cluster deployed in the computing environment to apply the contextual policy.

Abstract: A system and method for detecting a cybersecurity object in operating system-level virtualization objects. The method comprises: inspecting a first image of an operating system-level virtualization for a cybersecurity object; inspecting a second image for the cybersecurity object, wherein the second image is based off of the first image; associating the cybersecurity object with the first image, in response to detecting the cybersecurity object in the first image and detecting the cybersecurity object in the second image; and associating the cybersecurity object with the second image, in response to detecting the cybersecurity object in the second image and not detecting the cybersecurity object in the first image.

Abstract: A system and method for reducing redundancy in inspecting container layers for cybersecurity objects is presented. The method includes generating a diff output between a first container layer of a live container and a second container layer of a container image, wherein the second container layer is previously generated based off of the first container layer, wherein the diff output includes a software object; inspecting the first container layer for a cybersecurity object; inspecting the diff output for the cybersecurity object; associating the cybersecurity object with the first container layer in response to detecting the cybersecurity object in the first container layer and not in the diff output; and associating the cybersecurity object with the second container layer in response to detecting the cybersecurity object in the diff output and not in the first container layer.

Abstract: A system and method for determining an artificial intelligence (AI) security posture management (SPM) of a cloud computing environment is presented. The method includes inspecting the cloud computing environment for components of an AI pipeline; generating an AI pipeline representation based on a representation of each component of the AI pipeline in a security database; inspecting the cloud computing environment for a cybersecurity object associated with a component of the AI pipeline; analyzing the AI pipeline for a cybersecurity risk based on a result of inspecting the cloud computing environment for the cybersecurity object; and initiating a remediation action in the cloud computing environment in response to detecting the cybersecurity risk.

Abstract: A system and method for cybersecurity inspection of a volume based on image layers is disclosed. In some implementations, the method may include generating an inspectable disk based on a volume of a virtual instance, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers. In addition, the method may include parsing a manifest associated with the volume, the manifest including an identifier of each unique layer. The method may include determining an order of layers based on the manifest, where a first layer of the virtual instance is deployed prior to a second layer of the virtual instance. Moreover, the method may include initiating inspection for a cybersecurity object on a first layer of the plurality of layers. Also, the method may include initiating a mitigation action in response to detecting the cybersecurity object.

Abstract: A system and method for inspecting different types of cloud workloads for cybersecurity threats, all deployed in a cloud computing environment, includes a unifying extractor to expose different compute types to agnostic inspectors. The method includes accessing a first cloud workload of a first type from a plurality of deployed cloud workloads; accessing a second cloud workload of a second type from the plurality of deployed cloud workloads; extracting data from each of the first cloud workload and the second cloud workload into a storage layer having a data schema, based on a predefined data structure; and inspecting the extracted data to detect a first target object, the target object indicating a cybersecurity threat, wherein extraction for each of the first cloud workload and the second cloud workload is based on the workload type.

Abstract: A system and method for inspecting a running container for a cybersecurity object in a cloud computing environment is disclosed. The method includes: generating a clone of a disk, wherein the disk is deployed in a cloud computing environment; detecting a software container on the generated clone of the disk; and inspecting the software container for a cybersecurity object, in response to determining that the container is a running container.

Abstract: A method for scalable vulnerability detection is provided. The method includes selecting at least a workload of a plurality of workloads deployed in a first cloud environment for inspection, wherein the workload includes a first volume; generating in a remote cluster an inspection node, the inspection node including at least a first disk, wherein the remote cluster provisions inspection nodes in response to demand for inspection nodes; generating a persistent volume (PV) on which the at least a first disk is mounted, wherein the at least a first disk is generated from a snapshot of the first volume; and generating a persistent volume claim (PVC) of the PV for an inspector workload, wherein the inspector workload is configured to inspect the PV for an object, and wherein inspector workloads are provisioned in response to demand for inspector workloads.

Abstract: A system and method for applying a cybersecurity contextual policy in a computing environment are disclosed. In an embodiment, the method includes: detecting a cybersecurity object on a virtualization, the virtualization deployed in a computing environment; detecting a policy of the computing environment, the policy including a conditional rule; generating a contextual policy based on: the conditional rule, and an exception to the conditional rule based on the cybersecurity object; and configuring an admission controller of a software container cluster deployed in the computing environment to apply the contextual policy.

Abstract: The system and method for agentless detection of sensitive data in a cloud computing environment are presented. The method includes extracting a data schema of a data file from the data file; deploying the data file in a cloud computing environment; storing the data schema in a security database, the security database including a representation of the cloud computing environment; generating a data file node in the security database, the data file node corresponding to the data file; classifying a type of sensitive data in the data file; updating a value in metadata of the data file node, the value indicating the classified type of sensitive data; and performing a mitigation action based on the classified type of sensitive data and a location of the data file.

Abstract: A system and method provide detection of a malware attack path. The method includes detecting at a first time a malware object on a first workload deployed in the compute environment, wherein the first workload is represented by a first node in a security graph, the security graph including a representation of the compute environment; querying the security graph to detect a second node connected to the first node, wherein the connection indicates that the first workload represented by the first node can access a second workload represented by the second node; and generating an instruction to inspect the second workload represented by the second node at a second time, occurring after the first time.