Wiz, Inc.

Microsoft Technology Licensing, LLC

Microsoft Israel Research and Development (2002) Ltd

Adallom Technologies, Ltd.

Ami Luttwak

Roy Reznik

Yinon Costica

Yaniv Shaked

Avi Tal Lichtenstein

Daniel Hershko Shemesh

Yarin Miran

Alon Schindel

Raaz Herzberg

Avihai Berkovitz

Shai Keren

Gal Kozoshnik

Mattan Shalev

Yaniv Joseph Oliver

Moran Cohen

Matilda Lidgi

Oron Noah

George Pisha

Amir Lande Blau

Shir Tamari

Udi Reitblat

Niv Roit Ben David

Oren Elisha

Hila Yehuda

Adar Kahana

Amitai Cohen

Elad Gabay

Osher Hazan

Ron Cohen

Omri Kornblau

Ron David Ben Arzi

Aviel Fogel

Maya Bechler-Speicher

Barak Sharoni

Liran Moysi

Daniel Klein

Assaf Segal

Arnon Trabelsi

Aviram Cohen

Greg Vishnepolsky

Eyal Moscovici

Alok Kumar Srivastava

Nir Levy

Vitaly Khait

Irit Kantor

Eyal Livne

Eli Arbel

Alexander Pshul

Moaid Hathot

Eli Schwartz

Avner Shahar-Kashtan

Michael Andrew Foynes

Alexander Vakaluk

Or Heller

Danny Shemesh

Guy Rozendorn

Rona Mayk

Ariel Ben-Horesh

Tal Gilady

Eli Ben-David

Merav Davidson

Lidor Gonshorowitz

Tal Arieh Be'ery

Guy Lewin

Adi Diamant

Yossi Haber

Yuval Eldar

Itay Arbel

Alexander Esibov

Eric Abramov

Shahar Rand

Gregory Vishnepolsky

Erez Eyal

Itamar Gilad

Karen Master Ben-dor

Maya Bechler Speicher

Or Tzabary

Arik Schimmel

Ariel Stolovich

Assaf Rappaport

Eliazer Carmon

A system and method for inspecting live virtual instance in a cloud computing environment for cybersecurity threats utilizes a disk cloning technique. The method includes selecting a live virtual instance in a cloud computing environment, wherein the live virtual instance includes a disk having a disk descriptor with an address in a cloud storage system. An instruction to clone the disk of the live virtual instance is generated, and when executed causes generation of a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the live virtual instance. The cloned disk is inspected for a cybersecurity threat and the cloned disk is released in response to completing the inspection of the disk.

Techniques for improved virtual instance inspection utilizing disk cloning

A system and method for detecting sensitive data vulnerability in a cloud computing environment detects sensitive data in the cloud computing environment, and determines reachability parameters of a workload having access to the sensitive data. The method includes detecting sensitive data associated with a cloud entity in a cloud computing environment, the cloud computing environment is being deployed with a plurality of cloud entities; querying a graph database storing a security graph to detect a node associated with the cloud entity, wherein the security graph represents the cloud computing environment; determining a reachability path to the node, wherein the reachability path allows access to the cloud entity from a network external to the cloud computing environment; and generating an instruction to secure the sensitive data in response to determining the reachability path.

System and method for detecting vulnerability of data in a cloud computing environment

A system and method for detecting privilege escalation on a resource deployed in a computing environment is disclosed. The method includes: configuring the resource to deploy thereon a sensor, the sensor configured to listen on a data link layer of the resource for an event; receiving from the sensor a permission-based event based on a first actor, the permission-based event indicating a first permission set of the first actor; querying a database to detect a second permission set of the first actor; detecting that the first permission set includes a permission which is not in the second permission set; determining that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set; and initiating a mitigation action in response to the determined privilege escalation event.

Techniques for utilizing a sensor in detecting privilege escalation

A system and method for detecting lateral movement in a cloud computing environment is based on configuration code. The method includes: accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a cloud entity deployed in the cloud computing environment; selecting an identifier of an exposed cloud entity, the cloud entity associated with a secret; querying a security graph based on the identifier to detect a node representing the secret, wherein the node representing the secret is connected to a node representing the exposed cloud entity; traversing the security graph to detect a second node connected to the node representing the secret, the second node representing a second cloud entity deployed based on the code object of the plurality of code objects; and generating a mitigation action based on the second cloud entity.

Techniques for lateral movement detection in a cloud computing environment

A system and method for iterative cybersecurity remediation based on a digital forensic finding is disclosed. In an embodiment, the method includes detecting a forensic finding, the forensic finding based on a forensic artifact detected on a disk of a resource in a computing environment; generating an inspectable disk based on the disk of the resource; inspecting the inspectable disk for a cybersecurity object based on the forensic artifact; and initiating a remediation action on the disk based on the cybersecurity object detected on the inspectable disk.

Techniques for system feedback in remediating cybersecurity risks

A system and method for applying a cybersecurity control on a cloud native routing service is presented. The method includes detecting a cloud native routing component in a cloud computing environment; inspecting network traffic associated with the routing component; detecting routing configuration rules based at least on the inspected network traffic associated with the routing component; storing the detected routing configuration rules as representations on a security database, wherein the security database further includes a representation of the cloud computing environment; and applying a control on the detected routing configuration rules.

System and method for applying cybersecurity controls on cloud native routing services

A system and method for generating a contextual cloud risk assessment of a cloud computing environment. The method includes accessing a plurality of cloud assessment policies, wherein a policy including a query executable on a security graph; applying the plurality of cloud assessment policies to the representation of the first cloud computing environment; generating a risk assessment report based on an output generated by applying a policy of the plurality of cloud assessment polices; and initiating a mitigation action based on a cybersecurity risk from the risk assessment report.

System and method for risk monitoring of cloud based computing environments

A system and method for agentless detection of network exposure of a software appliance is presented. The method includes detecting a software appliance in a cloud computing environment, wherein the software appliance includes an immutable preconfigured, self-contained software application; inspecting the software appliance for a proxy-type application; detecting network traffic associated with the software appliance; generating a network path based on the network traffic and a network identifier of a component of the cloud computing environment based on detecting the proxy-type application and an identifier of the component in the detected network traffic; actively inspecting the generated network path through an external network, wherein the external network is external to the cloud computing environment; determining that the network path exposes the component based on a result of actively inspecting the generated network path; and initiating a remediation action based on the result of the active inspection.

Techniques for active inspection detection of effective network exposure through a cloud-native proxy appliance

A system and method for agentless detection of network exposure of a software appliance is presented. The method includes detecting a software appliance in a cloud computing environment, wherein the software appliance includes an immutable preconfigured, self-contained software application; inspecting the software appliance utilizing agentless inspection for a proxy-type application; detecting network traffic associated with the software appliance; determining that the software appliance exposes at least a component of the cloud computing environment based on detecting the proxy-type application and an identifier of the at least a component in the detected network traffic; and initiating a remediation action based on the determined exposure.

Techniques for detecting effective network exposure of a cloud-native proxy appliance utilizing agentless inspection

A system and method for detecting effective exposure of private API endpoints in a cloud computing environment is presented. The method includes inspecting a resource in a cloud computing environment utilizing agentless inspection; detecting a cybersecurity object on the inspected resource, the cybersecurity object indicating that the resource is a proxy-type appliance; detecting a private endpoint in the cloud computing environment, wherein the resource is configured to access the private endpoint, and the resource is further configured to access an external network, and wherein the external network is external to the cloud computing environment; determining that the private endpoint is potentially exposed via a network path which includes at least the resource; actively inspecting the network path to determine that the private endpoint is exposed to the external network; and initiating a remediation action based on a result of the active inspection.

Techniques for effective network exposure detection of private endpoints through a cloud-native router

A system and method for applying a unified security policy across a technology stack, includes detecting a cloud object in a first cloud computing environment, the cloud object including a plurality of attributes, each attribute having a corresponding value; detecting a node in a security graph having a data field value which matches an attribute value of the cloud object, wherein the security graph includes a representation of a cloud environment; applying a policy based on the data field value to the detected cloud object; and applying the policy to another cloud object in a second cloud computing environment, in response to determining that a node representing the cloud object in the security graph is connected to a node representing the another cloud object.

Detecting vulnerabilities in configuration code of a cloud environment utilizing infrastructure as code

A system and method for detecting an application path utilizing active inspection of a cloud computing environment, includes selecting a reachable resource having at least one network path to access the reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment; selecting a second resource having a second network path based on the network path of the reachable resource; and actively inspecting the second network path to determine if the second resource is accessible through the second network path from the reachable resource.

Techniques for detecting applications paths utilizing exposure analysis

A system and method for improving inspection of software containers is presented. The method includes detecting a plurality of configuration files, each corresponding to a software container image corresponding to a software container deployed in the cloud computing environment; parsing a first configuration file to detect a first plurality of commands; generating a first fingerprint based on the detected first plurality of commands; parsing a second configuration file to detect a second plurality of commands; generating a second fingerprint based on the detected second plurality of commands; determining that the first configuration file matches the second configuration file in response to detecting a match based on the fingerprints; determining that the first configuration file mismatches the second configuration file in response to detecting a mismatch; and inspecting the first configuration file for a cybersecurity object in response to determining that the first configuration file matches the second configuration file.

System and method for tracing cloud computing environment deployments to code objects utilizing unique fingerprints

A system and method for performing active inspection of a cloud computing environment to detect exposed sensitive data. The method also includes receiving at least one network path to access a first resource, where the first resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and generating a first instruction to access the first resource based on a plurality of reachability parameters designated in the at least one network path; causing execution of the generated first instruction to access the first resource; receiving an output, the output generated in response to execution of the generated first instruction; detecting in the output a predetermined sensitive data indicator; and initiating a mitigation action in response to detecting the sensitive data indicator in the output.

System and method for detecting sensitive data in active inspection of cloud computing resources

A system and method for performing active inspection of a computing environment utilizes optical character recognition. The method includes: receiving at least one network path to access a first resource, where the first resource is a cloud object deployed in the cloud computing environment, potentially accessible from a network which is external to the cloud computing environment; and generating a first instruction to access the first resource based on a plurality of reachability parameters designated in the at least one network path; causing execution of the generated first instruction to access the first resource; receiving a graphical output, the graphical output generated in response to execution of the generated first instruction; performing optical character recognition on the graphical output to generate a textual output; detecting in the textual output a predetermined data indicator; and initiating a second active inspection in response to detecting the data indicator in the textual output.

Techniques for active inspection of cloud computing applications utilizing optical character recognition

Growing community of inventors

Binyamina, Israel

Ami Luttwak