Wiz, Inc.

Microsoft Technology Licensing, LLC

Microsoft Israel Research and Development (2002) Ltd

Adallom Technologies, Ltd.

Ami Luttwak

Roy Reznik

Yinon Costica

Yaniv Shaked

Avi Tal Lichtenstein

Daniel Hershko Shemesh

Yarin Miran

Raaz Herzberg

Alon Schindel

Avihai Berkovitz

Shai Keren

Gal Kozoshnik

Yaniv Joseph Oliver

Mattan Shalev

Matilda Lidgi

Moran Cohen

Oron Noah

Niv Roit Ben David

Oren Elisha

Adar Kahana

George Pisha

Amir Lande Blau

Shir Tamari

Udi Reitblat

Hila Yehuda

Osher Hazan

Amitai Cohen

Elad Gabay

Maya Bechler-Speicher

Ron David Ben Arzi

Omri Kornblau

Ron Cohen

Aviel Fogel

Barak Sharoni

Liran Moysi

Daniel Klein

Aviram Cohen

Assaf Segal

Arnon Trabelsi

Eyal Moscovici

Greg Vishnepolsky

Alok Kumar Srivastava

Nir Levy

Vitaly Khait

Irit Kantor

Eyal Livne

Avner Shahar-Kashtan

Eli Arbel

Alexander Vakaluk

Alexander Pshul

Moaid Hathot

Michael Andrew Foynes

Eli Schwartz

Or Heller

Lidor Gonshorowitz

Eli Ben-David

Merav Davidson

Rona Mayk

Ariel Ben-Horesh

Guy Rozendorn

Tal Gilady

Danny Shemesh

Tal Arieh Be'ery

Guy Lewin

Adi Diamant

Yossi Haber

Yuval Eldar

Itay Arbel

Alexander Esibov

Gregory Vishnepolsky

Shahar Rand

Eric Abramov

Karen Master Ben-dor

Itamar Gilad

Erez Eyal

Eliazer Carmon

Arik Schimmel

Or Tzabary

Maya Bechler Speicher

Ariel Stolovich

Assaf Rappaport

Methods, systems and computer program products are described to improve machine learning (ML) model-based classification of data items by identifying and removing inaccurate training data. Inaccurate training samples may be identified, for example, based on excessive variance in vector space between a training sample and a mean of category training samples, and based on a variance between an assigned category and a predicted category for a training sample. Suspect or erroneous samples may be selectively removed based on, for example, vector space variance and/or prediction confidence level. As a result, ML model accuracy may be improved by training on a more accurate revised training set. ML model accuracy may (e.g., also) be improved, for example, by identifying and removing suspect categories with excessive (e.g., weighted) vector space variance. Suspect categories may be retained or revised. Users may (e.g., also) specify a prediction confidence level and/or coverage (e.g., to control accuracy).

System and method for improving machine learning models by detecting and removing inaccurate training data

A system and method for inspecting multiple instances across cloud computing environments for a cybersecurity issue is configured to detect a code object in a configuration code file, the code object utilized to deploy a virtual instance in a cloud computing environment; generate in a security graph a code object node representing the code object; generate in the security graph a resource node representing a virtual instance deployed in a first cloud computing environment based on the code object, wherein the resource node is connected to the code object node; detect a cybersecurity issue on the virtual instance; and generate an instruction to inspect a second virtual instance deployed in a second cloud computing environment based on the code object, the second virtual instance represented by a second resource node connected to the code object node.

System and method for recursive inspection of workloads from configuration code to production environments

A cybersecurity system provides the ability to detect security risks in a cross-platform cloud solution. A unified data schema is used to abstract resources, principals and others across multiple platforms. A security graph is generated to present a unified view of cloud environments, which are then easily queried using the structure of the data schema. The solution allows a compact representation of cloud environments, which is scalable and multi-layered. Various enrichments may be added to the security graph, which are generated for example based on policies, and inspection of workloads in the cloud environment. The security graph allows for representation of production environments, staging environments, as well as code for deploying workloads in the cloud environment. Thus the solution is also able to present a complete picture of a user's entire cloud environment.

System and method for generating a security graph in a cloud computing environment

A system and method for inspecting live virtual instance in a cloud computing environment for cybersecurity threats utilizes a disk cloning technique. The method includes selecting a live virtual instance in a cloud computing environment, wherein the live virtual instance includes a disk having a disk descriptor with an address in a cloud storage system. An instruction to clone the disk of the live virtual instance is generated, and when executed causes generation of a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the live virtual instance. The cloned disk is inspected for a cybersecurity threat and the cloned disk is released in response to completing the inspection of the disk.

Techniques for improved virtual instance inspection utilizing disk cloning

A system and method for technology stack discovery by performing active inspection of a cloud computing environment utilizing disk cloning is described. The method includes: generating an inspectable disk based on an original disk of a reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment; detecting a cybersecurity object on the inspectable disk, the cybersecurity object indicating a cybersecurity issue; selecting a network path including a network protocol to access the reachable resource; and actively inspecting the network path to detect the cybersecurity issue.

Technology discovery techniques in cloud computing environments utilizing disk cloning

A system and method for detecting sensitive data vulnerability in a cloud computing environment detects sensitive data in the cloud computing environment, and determines reachability parameters of a workload having access to the sensitive data. The method includes detecting sensitive data associated with a cloud entity in a cloud computing environment, the cloud computing environment is being deployed with a plurality of cloud entities; querying a graph database storing a security graph to detect a node associated with the cloud entity, wherein the security graph represents the cloud computing environment; determining a reachability path to the node, wherein the reachability path allows access to the cloud entity from a network external to the cloud computing environment; and generating an instruction to secure the sensitive data in response to determining the reachability path.

System and method for detecting vulnerability of data in a cloud computing environment

A system and method for detecting privilege escalation on a resource deployed in a computing environment is disclosed. The method includes: configuring the resource to deploy thereon a sensor, the sensor configured to listen on a data link layer of the resource for an event; receiving from the sensor a permission-based event based on a first actor, the permission-based event indicating a first permission set of the first actor; querying a database to detect a second permission set of the first actor; detecting that the first permission set includes a permission which is not in the second permission set; determining that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set; and initiating a mitigation action in response to the determined privilege escalation event.

Techniques for utilizing a sensor in detecting privilege escalation

A system and method for detecting lateral movement in a cloud computing environment is based on configuration code. The method includes: accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a cloud entity deployed in the cloud computing environment; selecting an identifier of an exposed cloud entity, the cloud entity associated with a secret; querying a security graph based on the identifier to detect a node representing the secret, wherein the node representing the secret is connected to a node representing the exposed cloud entity; traversing the security graph to detect a second node connected to the node representing the secret, the second node representing a second cloud entity deployed based on the code object of the plurality of code objects; and generating a mitigation action based on the second cloud entity.

Techniques for lateral movement detection in a cloud computing environment

A system and method for iterative cybersecurity remediation based on a digital forensic finding is disclosed. In an embodiment, the method includes detecting a forensic finding, the forensic finding based on a forensic artifact detected on a disk of a resource in a computing environment; generating an inspectable disk based on the disk of the resource; inspecting the inspectable disk for a cybersecurity object based on the forensic artifact; and initiating a remediation action on the disk based on the cybersecurity object detected on the inspectable disk.

Techniques for system feedback in remediating cybersecurity risks

A system and method for applying a cybersecurity control on a cloud native routing service is presented. The method includes detecting a cloud native routing component in a cloud computing environment; inspecting network traffic associated with the routing component; detecting routing configuration rules based at least on the inspected network traffic associated with the routing component; storing the detected routing configuration rules as representations on a security database, wherein the security database further includes a representation of the cloud computing environment; and applying a control on the detected routing configuration rules.

System and method for applying cybersecurity controls on cloud native routing services

A system and method for generating a contextual cloud risk assessment of a cloud computing environment. The method includes accessing a plurality of cloud assessment policies, wherein a policy including a query executable on a security graph; applying the plurality of cloud assessment policies to the representation of the first cloud computing environment; generating a risk assessment report based on an output generated by applying a policy of the plurality of cloud assessment polices; and initiating a mitigation action based on a cybersecurity risk from the risk assessment report.

System and method for risk monitoring of cloud based computing environments

A system and method for agentless detection of network exposure of a software appliance is presented. The method includes detecting a software appliance in a cloud computing environment, wherein the software appliance includes an immutable preconfigured, self-contained software application; inspecting the software appliance for a proxy-type application; detecting network traffic associated with the software appliance; generating a network path based on the network traffic and a network identifier of a component of the cloud computing environment based on detecting the proxy-type application and an identifier of the component in the detected network traffic; actively inspecting the generated network path through an external network, wherein the external network is external to the cloud computing environment; determining that the network path exposes the component based on a result of actively inspecting the generated network path; and initiating a remediation action based on the result of the active inspection.

Techniques for active inspection detection of effective network exposure through a cloud-native proxy appliance

A system and method for agentless detection of network exposure of a software appliance is presented. The method includes detecting a software appliance in a cloud computing environment, wherein the software appliance includes an immutable preconfigured, self-contained software application; inspecting the software appliance utilizing agentless inspection for a proxy-type application; detecting network traffic associated with the software appliance; determining that the software appliance exposes at least a component of the cloud computing environment based on detecting the proxy-type application and an identifier of the at least a component in the detected network traffic; and initiating a remediation action based on the determined exposure.

Techniques for detecting effective network exposure of a cloud-native proxy appliance utilizing agentless inspection

A system and method for detecting effective exposure of private API endpoints in a cloud computing environment is presented. The method includes inspecting a resource in a cloud computing environment utilizing agentless inspection; detecting a cybersecurity object on the inspected resource, the cybersecurity object indicating that the resource is a proxy-type appliance; detecting a private endpoint in the cloud computing environment, wherein the resource is configured to access the private endpoint, and the resource is further configured to access an external network, and wherein the external network is external to the cloud computing environment; determining that the private endpoint is potentially exposed via a network path which includes at least the resource; actively inspecting the network path to determine that the private endpoint is exposed to the external network; and initiating a remediation action based on a result of the active inspection.

Techniques for effective network exposure detection of private endpoints through a cloud-native router

A system and method for applying a unified security policy across a technology stack, includes detecting a cloud object in a first cloud computing environment, the cloud object including a plurality of attributes, each attribute having a corresponding value; detecting a node in a security graph having a data field value which matches an attribute value of the cloud object, wherein the security graph includes a representation of a cloud environment; applying a policy based on the data field value to the detected cloud object; and applying the policy to another cloud object in a second cloud computing environment, in response to determining that a node representing the cloud object in the security graph is connected to a node representing the another cloud object.

Detecting vulnerabilities in configuration code of a cloud environment utilizing infrastructure as code

Growing community of inventors

Binyamina, Israel

Ami Luttwak