Wiz, Inc.

George Pisha

Yaniv Shaked

Amitai Cohen

Ami Luttwak

Roy Reznik

Yinon Costica

Avi Tal Lichtenstein

Barak Sharoni

Itay Arbel

Alon Schindel

Raaz Herzberg

Avihai Berkovitz

Yaniv Joseph Oliver

Shir Tamari

Udi Reitblat

Moran Cohen

Liran Moysi

Daniel Velikanski

Daniel Hershko Shemesh

Yarin Miran

Liron Levin

Itay Vanzetti

Maayan Laav

Niv Roit Ben David

Osher Hazan

Or Heller

Tal Gilady

Alon Weiss

Michael Aminov

Alma Raziel

A system and method for detecting sensitive data vulnerability in a cloud computing environment detects sensitive data in the cloud computing environment, and determines reachability parameters of a workload having access to the sensitive data. The method includes detecting sensitive data associated with a cloud entity in a cloud computing environment, the cloud computing environment is being deployed with a plurality of cloud entities; querying a graph database storing a security graph to detect a node associated with the cloud entity, wherein the security graph represents the cloud computing environment; determining a reachability path to the node, wherein the reachability path allows access to the cloud entity from a network external to the cloud computing environment; and generating an instruction to secure the sensitive data in response to determining the reachability path.

System and method for detecting vulnerability of data in a cloud computing environment

A system and method for dynamically applying controls on a representation of a computing environment utilizing a large language model is presented. The method includes generating a representation of the computing environment, the representation based on a unified data schema; receiving a natural language query directed to the computing environment; generating a first prompt for the large language model (LLM), which when processed outputs an identifier of a policy from a policy engine; generating a second prompt for the LLM, which when processed outputs a generated policy, based on: the unified data schema, and the natural language query; and applying the generated policy on the representation of the computing environment.

Techniques for efficient querying of a database utilizing a large language model and dynamic policy generation

A system and method for detecting a cybersecurity risk of an artificial intelligence (AI), is presented. The method includes: inspecting a computing environment for an AI model deployed therein; generating a representation of the AI model in a security database, the security database including a representation of the computing environment; inspecting the AI model for a cybersecurity risk; generating a representation of the cybersecurity risk in the security database, the representation of the cybersecurity risk connected to the representation of the AI model in response to detecting the cybersecurity risk; and initiating a mitigation action based on the cybersecurity risk.

Techniques for detecting artificial intelligence model cybersecurity risk in a computing environment

A system and method improves cloud detection and response by generating a normalized event log from a plurality of cloud computing layers. The method includes receiving a plurality of events, wherein a first event is generated in a first cloud layer of a cloud computing environment provided by a cloud service provider (CSP) and a second event is generated in a second cloud layer of the cloud computing environment; extracting data from each event; generating a normalized event based on the extracted data and further based on a predefined data schema, the predefined schema including a plurality of data fields, at least a portion of which are related to cloud layers; storing the normalized event in a transactional database having stored therein a normalized event log; and applying a rule from a rule engine on the normalized event to detect a cybersecurity threat in the cloud computing environment.

System and method for generating normalized event logs for cloud detection and response in a multi-layered cloud environment

A system and method improves cloud detection and response by generating a normalized event log from a plurality of cloud service providers (CSPs). The method includes receiving a plurality of events, wherein a first event of the plurality of events is generated in a cloud computing environment provided by a first CSP and a second event of the plurality of events is generated in a cloud computing environment provided by a second CSP; extracting data from an event of the plurality of events; generating a normalized event based on the extracted data and a predefined data schema, the predefined data schema including a plurality of data fields; storing the normalized event in a transactional database having stored therein a normalized event log; and applying a rule from a rule engine on a normalized event stored in the transactional database to detect a cybersecurity threat in any of the CSPs.

System and method for threat detection across multiple cloud environments utilizing normalized event logs

A system and method for agentless detection of sensitive data in a cloud computing environment is disclosed. The method includes: generating an inspectable disk from a clone of an original disk in a cloud computing environment; inspecting the inspectable disk for a cybersecurity object, the cybersecurity object indicating a sensitive data, the disk deployed in a cloud computing environment; extracting a data schema from the cybersecurity object, in response to detecting the cybersecurity object on the disk; generating a classification of the data schema; detecting in the disk a plurality of data files, each data file including the classified data schema; determining that the data schema corresponds to sensitive data based on the generated classification; generating in a security database: a representation of the data schema, and a representation of each data file; and rendering a visual representation of the cloud computing environment including a representation of the data schema.

Techniques for detecting sensitive data in cloud computing environments utilizing cloning

A system and method for detecting effective permissions of a principal in a cloud computing environment, includes detecting a group of principal nodes, each principal node representing a principal in a cloud computing environment, in a security graph, the security graph storing therein a representation of the cloud computing environment; selecting a first principal node from the group of principal nodes; determining a permission between the first principal node and a resource node, wherein the resource node represents a resource deployed in the cloud computing environment; and associating the group of principal nodes with the determined permission.

Cybersecurity threat detection utilizing unified identity mapping and permission detection

A system and method for generating a security graph utilizing a unified model based on multiple cloud environments are provided. The method includes receiving data from a first cloud environment pertaining to: resources, principals, and permissions; generating for each resource a corresponding resource node in the security graph, the corresponding resource node including an identifier of the resource, wherein the resource is a cloud entity deployed in the first cloud environment; generating for each principal a corresponding principal node in the security graph, the corresponding principal node including an identifier of the principal, wherein the principal is a cloud entity in the first cloud environment that generates an operation request in the first cloud environment; and generating a connection between at least a principal node and at least a resource node in the security graph, in response to detecting a permission indicating that a principal can access a resource.

Efficient representation of multiple cloud computing environments through unified identity mapping

A system and method for detecting a combined cybersecurity risk for an artificial intelligence (AI) model is presented. The method includes: inspecting a computing environment for an AI model deployed therein; generating a representation of the AI model in a security database, the security database including a representation of the computing environment; detecting a first cybersecurity risk respective of the AI model; inspecting the computing environment for a cybersecurity object; determining that the AI model is exposed to a toxic combination cybersecurity risk based on the detected first cybersecurity risk and the cybersecurity object; and initiating a mitigation action based on the toxic combination cybersecurity risk.

System and method for detecting cybersecurity risks in managed artificial intelligence models

A system and method for detecting a permission escalation event in a computing environment is disclosed. The method includes: generating a cloned disk based on an original disk of a resource deployed in a computing environment; detecting an identifier of a first principal on the cloned disk; detecting a second principal in the computing environment, the first principal authorized to assume the first principal; storing a representation of the computing environment in a security database, including: a first principal node representing the first principal, and a second principal node representing the second principal, further associated with a permission; querying the representation to determine a permission of the first principal; determining that the second principal includes a permission which the first principal does not include based on a result of querying the representation; and generating a permission escalation event.

Techniques for cybersecurity identity risk detection utilizing disk cloning and unified identity mapping

A system and method for agentless detection of sensitive data in a cloud computing environment includes generating a snapshot from a managed database service, the snapshot including a plurality of data files stored in a bucket on a cloud computing environment; detecting a data object in the plurality of data files, the data object including a data schema and a content; classifying the first data object based on the content, wherein the content is classified as sensitive data or non-sensitive data; and generating a node on a security graph stored in a graph database to represent the first data object and the classification thereof, wherein the security graph further includes a representation of the cloud computing environment.

System and method for agentless detection of sensitive data on managed databases

A system and method for detecting an attack path in a computing environment is presented. The method includes: detecting a forensic artifact in a computing environment, the forensic artifact including an identifier of a resource deployed in the computing environment; inspecting the resource for a cybersecurity object, the cybersecurity object indicating a cybersecurity issue; generating a representation of: the detected forensic artifact, the resource, and the cybersecurity object, in a security database, wherein the security database includes a representation of the computing environment; generating a potential lateral movement path between the resource and another resource; and generating a visualization based on the potential lateral movement, the forensic artifact, and the cybersecurity object.

Techniques for incident response and static analysis representation in computing environments

A system and method for agentless detection of sensitive data in a cloud computing environment. The method includes detecting a first data object including a data schema and a content in a cloud computing environment; detecting a second data object, having the data schema of the first data object; generating in a security graph: a first data object node representing the first data object, a second data object node representing the second data object, and a data schema node representing the data schema; storing a classification based on the content in the security graph, wherein the content is classified as sensitive data or non-sensitive data; and rendering an output based on the classification and the data schema node, in lieu of the first data object node and the second data object node, in response to receiving a query to detect a node representing a data object classified as sensitive data.

Growing community of inventors

Giv'atayim, Israel

George Pisha