Wiz, Inc.

Microsoft Technology Licensing, LLC

Microsoft Israel Research and Development (2002) Ltd

Adallom Technologies, Ltd.

Ami Luttwak

Roy Reznik

Yinon Costica

Yaniv Shaked

Avi Tal Lichtenstein

Daniel Hershko Shemesh

Yarin Miran

Raaz Herzberg

Alon Schindel

Avihai Berkovitz

Shai Keren

Gal Kozoshnik

Mattan Shalev

Yaniv Joseph Oliver

Moran Cohen

Matilda Lidgi

Oron Noah

Amir Lande Blau

Shir Tamari

Niv Roit Ben David

Oren Elisha

Hila Yehuda

Adar Kahana

George Pisha

Amitai Cohen

Udi Reitblat

Elad Gabay

Osher Hazan

Maya Bechler-Speicher

Omri Kornblau

Ron David Ben Arzi

Ron Cohen

Liran Moysi

Barak Sharoni

Daniel Klein

Assaf Segal

Arnon Trabelsi

Aviram Cohen

Greg Vishnepolsky

Aviel Fogel

Eyal Moscovici

Alok Kumar Srivastava

Nir Levy

Vitaly Khait

Irit Kantor

Eyal Livne

Eli Arbel

Alexander Pshul

Eli Schwartz

Moaid Hathot

Michael Andrew Foynes

Avner Shahar-Kashtan

Alexander Vakaluk

Or Heller

Danny Shemesh

Guy Rozendorn

Rona Mayk

Tal Gilady

Ariel Ben-Horesh

Eli Ben-David

Merav Davidson

Lidor Gonshorowitz

Tal Arieh Be'ery

Guy Lewin

Adi Diamant

Yossi Haber

Yuval Eldar

Itay Arbel

Alexander Esibov

Eric Abramov

Shahar Rand

Gregory Vishnepolsky

Erez Eyal

Karen Master Ben-dor

Maya Bechler Speicher

Or Tzabary

Arik Schimmel

Ariel Stolovich

Assaf Rappaport

Eliazer Carmon

A system and method for detecting lateral movement in a cloud computing environment is based on configuration code. The method includes: accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a cloud entity deployed in the cloud computing environment; selecting an identifier of an exposed cloud entity, the cloud entity associated with a secret; querying a security graph based on the identifier to detect a node representing the secret, wherein the node representing the secret is connected to a node representing the exposed cloud entity; traversing the security graph to detect a second node connected to the node representing the secret, the second node representing a second cloud entity deployed based on the code object of the plurality of code objects; and generating a mitigation action based on the second cloud entity.

Techniques for lateral movement detection in a cloud computing environment

A system and method for iterative cybersecurity remediation based on a digital forensic finding is disclosed. In an embodiment, the method includes detecting a forensic finding, the forensic finding based on a forensic artifact detected on a disk of a resource in a computing environment; generating an inspectable disk based on the disk of the resource; inspecting the inspectable disk for a cybersecurity object based on the forensic artifact; and initiating a remediation action on the disk based on the cybersecurity object detected on the inspectable disk.

Techniques for system feedback in remediating cybersecurity risks

A system and method for applying a cybersecurity control on a cloud native routing service is presented. The method includes detecting a cloud native routing component in a cloud computing environment; inspecting network traffic associated with the routing component; detecting routing configuration rules based at least on the inspected network traffic associated with the routing component; storing the detected routing configuration rules as representations on a security database, wherein the security database further includes a representation of the cloud computing environment; and applying a control on the detected routing configuration rules.

System and method for applying cybersecurity controls on cloud native routing services

A system and method for generating a contextual cloud risk assessment of a cloud computing environment. The method includes accessing a plurality of cloud assessment policies, wherein a policy including a query executable on a security graph; applying the plurality of cloud assessment policies to the representation of the first cloud computing environment; generating a risk assessment report based on an output generated by applying a policy of the plurality of cloud assessment polices; and initiating a mitigation action based on a cybersecurity risk from the risk assessment report.

System and method for risk monitoring of cloud based computing environments

A system and method for agentless detection of network exposure of a software appliance is presented. The method includes detecting a software appliance in a cloud computing environment, wherein the software appliance includes an immutable preconfigured, self-contained software application; inspecting the software appliance for a proxy-type application; detecting network traffic associated with the software appliance; generating a network path based on the network traffic and a network identifier of a component of the cloud computing environment based on detecting the proxy-type application and an identifier of the component in the detected network traffic; actively inspecting the generated network path through an external network, wherein the external network is external to the cloud computing environment; determining that the network path exposes the component based on a result of actively inspecting the generated network path; and initiating a remediation action based on the result of the active inspection.

Techniques for active inspection detection of effective network exposure through a cloud-native proxy appliance

A system and method for agentless detection of network exposure of a software appliance is presented. The method includes detecting a software appliance in a cloud computing environment, wherein the software appliance includes an immutable preconfigured, self-contained software application; inspecting the software appliance utilizing agentless inspection for a proxy-type application; detecting network traffic associated with the software appliance; determining that the software appliance exposes at least a component of the cloud computing environment based on detecting the proxy-type application and an identifier of the at least a component in the detected network traffic; and initiating a remediation action based on the determined exposure.

Techniques for detecting effective network exposure of a cloud-native proxy appliance utilizing agentless inspection

A system and method for detecting effective exposure of private API endpoints in a cloud computing environment is presented. The method includes inspecting a resource in a cloud computing environment utilizing agentless inspection; detecting a cybersecurity object on the inspected resource, the cybersecurity object indicating that the resource is a proxy-type appliance; detecting a private endpoint in the cloud computing environment, wherein the resource is configured to access the private endpoint, and the resource is further configured to access an external network, and wherein the external network is external to the cloud computing environment; determining that the private endpoint is potentially exposed via a network path which includes at least the resource; actively inspecting the network path to determine that the private endpoint is exposed to the external network; and initiating a remediation action based on a result of the active inspection.

Techniques for effective network exposure detection of private endpoints through a cloud-native router

A system and method for applying a unified security policy across a technology stack, includes detecting a cloud object in a first cloud computing environment, the cloud object including a plurality of attributes, each attribute having a corresponding value; detecting a node in a security graph having a data field value which matches an attribute value of the cloud object, wherein the security graph includes a representation of a cloud environment; applying a policy based on the data field value to the detected cloud object; and applying the policy to another cloud object in a second cloud computing environment, in response to determining that a node representing the cloud object in the security graph is connected to a node representing the another cloud object.

Detecting vulnerabilities in configuration code of a cloud environment utilizing infrastructure as code

A system and method for detecting an application path utilizing active inspection of a cloud computing environment, includes selecting a reachable resource having at least one network path to access the reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment; selecting a second resource having a second network path based on the network path of the reachable resource; and actively inspecting the second network path to determine if the second resource is accessible through the second network path from the reachable resource.

Techniques for detecting applications paths utilizing exposure analysis

A system and method for improving inspection of software containers is presented. The method includes detecting a plurality of configuration files, each corresponding to a software container image corresponding to a software container deployed in the cloud computing environment; parsing a first configuration file to detect a first plurality of commands; generating a first fingerprint based on the detected first plurality of commands; parsing a second configuration file to detect a second plurality of commands; generating a second fingerprint based on the detected second plurality of commands; determining that the first configuration file matches the second configuration file in response to detecting a match based on the fingerprints; determining that the first configuration file mismatches the second configuration file in response to detecting a mismatch; and inspecting the first configuration file for a cybersecurity object in response to determining that the first configuration file matches the second configuration file.

System and method for tracing cloud computing environment deployments to code objects utilizing unique fingerprints

A system and method for performing active inspection of a cloud computing environment to detect exposed sensitive data. The method also includes receiving at least one network path to access a first resource, where the first resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and generating a first instruction to access the first resource based on a plurality of reachability parameters designated in the at least one network path; causing execution of the generated first instruction to access the first resource; receiving an output, the output generated in response to execution of the generated first instruction; detecting in the output a predetermined sensitive data indicator; and initiating a mitigation action in response to detecting the sensitive data indicator in the output.

System and method for detecting sensitive data in active inspection of cloud computing resources

A system and method for performing active inspection of a computing environment utilizes optical character recognition. The method includes: receiving at least one network path to access a first resource, where the first resource is a cloud object deployed in the cloud computing environment, potentially accessible from a network which is external to the cloud computing environment; and generating a first instruction to access the first resource based on a plurality of reachability parameters designated in the at least one network path; causing execution of the generated first instruction to access the first resource; receiving a graphical output, the graphical output generated in response to execution of the generated first instruction; performing optical character recognition on the graphical output to generate a textual output; detecting in the textual output a predetermined data indicator; and initiating a second active inspection in response to detecting the data indicator in the textual output.

Techniques for active inspection of cloud computing applications utilizing optical character recognition

A system and method for performing active inspection of a cloud computing environment includes receiving at least one network path to access a first resource, wherein the first resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and actively inspecting the at least one network path to determine if the first resource is accessible through the at least one network path from a network external to the cloud computing environment.

Techniques for analyzing external exposure in cloud environments

A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing.

System and method for analyzing network objects in a cloud environment

A system and method for risk and constraint-based cybersecurity inspection of a computing environment is presented. The method includes querying an application programming interface (API) of a computing environment to detect a plurality of workloads deployed therein; determining a constraint for inspection of the computing environment; provisioning resources of the computing environment to an inspection account based on the determined constraint; and initiating inspection of the plurality of workloads utilizing the provisioned resources.

Techniques for risk and constraint-based inspection

Growing community of inventors

Binyamina, Israel

Ami Luttwak