Abstract: Some embodiments gather security activity data from multiple environments instead of only a single environment. Activity data includes alerts, anomaly detections, and defensive actions taken automatically, in response to actual or simulated attacks. Data is cloaked to protect privacy. Security product coverage of techniques, tactics, procedures, threat categories, and other constituents of a cyberattack model is derived from the activity data via a mapping mechanism, allowing subsequent product installation or operation changes to be based on actual recorded responses of products to attacks. Coverage results may be operationalized as recommendations or proactive automated initiatives, for example. Security is enhanced on the basis of data which extends beyond the data available to any single cloud tenant.

Abstract: Embodiments allow for searching across multiple devices for user content. A user enters search criteria in a user interface client, which forwards the search criteria to a central search server. The search server forwards the search criteria to search agents on a plurality of other devices associated with the user. The search agents use local search functionality to identify any content that meets the search criteria. The search agents send result metadata to the user interface client via the search server. The user interface client combines result metadata from multiple devices for presentation to the user. After the user selects desired content, the selected content is retrieved from a hosting remote device via the search server.