Wiz, Inc.

Matilda Lidgi

Roy Reznik

Shai Keren

Ami Luttwak

Raaz Herzberg

Avi Tal Lichtenstein

Eliran Marom

Liron Levin

Avihai Berkovitz

Amitai Cohen

Rotem Lipowitch

Ron David Ben Arzi

Danielle Aminov

Arik Schimmel

A system and method for near real time detection of cybersecurity threats in a computing environment. The method includes: detecting an event in a data log, the data log including a plurality of data records, each data record corresponding to at least an event; parsing a data record corresponding to the event to detect a data value; detecting a node in a security graph, the node corresponding to the detected data value, wherein the security graph includes a representation of the computing environment; initiating inspection of a resource corresponding to the node.

Near-real time dynamic cybersecurity inspection techniques

A system and method for prioritizing remediation actions for cybersecurity issues in a cloud computing environment based on a data risk score is presented. The method includes detecting a plurality of data objects in the computing environment, the computing environment including a plurality of resources and principals; determining a cybersecurity context for each detected data object; generating a representation of each data object, each resource, and each principal in a security database; detecting in the security database a resource representation connected to a data object representation, wherein a cybersecurity context is determined for the resource; generating a cybersecurity risk score based on the cybersecurity context of the data object and the cybersecurity context of the resource; prioritizing a plurality of remediation actions based on the generated cybersecurity risk score; and executing a remediation action based on the prioritization.

Techniques for prioritizing cybersecurity remediation actions based on a data risk score

A system and method for detecting stale objects in a cloud computing environment is presented. The method includes detecting a plurality of resources deployed in a cloud computing environment; generating for each resource a representation in a security database, the security database including a representation of the cloud computing environment; generating for each resource a state, based at least on a detected utilization of a respective resource; detecting, based on the state, a resource of the plurality of resources which is an underutilized resource; and initiating a mitigation action on the underutilized resource.

Detection of stale data objects and associated cybersecurity risk

A system and method for detecting an application path utilizing active inspection of a cloud computing environment, includes selecting a reachable resource having at least one network path to access the reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment; selecting a second resource having a second network path based on the network path of the reachable resource; and actively inspecting the second network path to determine if the second resource is accessible through the second network path from the reachable resource.

Techniques for detecting applications paths utilizing exposure analysis

A system and method for performing active inspection of a cloud computing environment to detect exposed sensitive data. The method also includes receiving at least one network path to access a first resource, where the first resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and generating a first instruction to access the first resource based on a plurality of reachability parameters designated in the at least one network path; causing execution of the generated first instruction to access the first resource; receiving an output, the output generated in response to execution of the generated first instruction; detecting in the output a predetermined sensitive data indicator; and initiating a mitigation action in response to detecting the sensitive data indicator in the output.

System and method for detecting sensitive data in active inspection of cloud computing resources

A system and method for performing active inspection of a computing environment utilizes optical character recognition. The method includes: receiving at least one network path to access a first resource, where the first resource is a cloud object deployed in the cloud computing environment, potentially accessible from a network which is external to the cloud computing environment; and generating a first instruction to access the first resource based on a plurality of reachability parameters designated in the at least one network path; causing execution of the generated first instruction to access the first resource; receiving a graphical output, the graphical output generated in response to execution of the generated first instruction; performing optical character recognition on the graphical output to generate a textual output; detecting in the textual output a predetermined data indicator; and initiating a second active inspection in response to detecting the data indicator in the textual output.

Techniques for active inspection of cloud computing applications utilizing optical character recognition

A system and method for performing active inspection of a cloud computing environment includes receiving at least one network path to access a first resource, wherein the first resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and actively inspecting the at least one network path to determine if the first resource is accessible through the at least one network path from a network external to the cloud computing environment.

Techniques for analyzing external exposure in cloud environments

A system and method for applying a policy on a network path is presented. The method includes: selecting a reachable resource having a network path to access the reachable resource, wherein the reachable resource is deployed in a cloud computing environment, having access to an external network; actively inspecting an external network path to determine if the network path of the reachable resource is accessible from the external network; determining that the network path is a valid path, in response to determining that the reachable resource is accessible from the external network path; applying a policy on the valid path; and initiating a mitigation action, in response to determining that the policy is violated.

System and method for applying a policy on a network path

A system and method for performing authorization based active inspection of network paths for a resource, deployed in a cloud computing environment, includes receiving at least one network path to access the resource, wherein the resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and actively inspecting the at least one network path to determine if the resource is accessible through the at least one network path from a network external to the cloud computing environment and requires access authorization.

Techniques for detecting resources without authentication using exposure analysis

A system and method for performing active inspection of vulnerability exploitation in a cloud computing environment. The method includes receiving at least one network path to access a first resource, wherein the first resource is a cloud object is deployed in the cloud computing environment and having a known vulnerability, wherein the first resource is potentially accessible from a network which is external to the cloud computing environment; actively inspecting the at least one network path to determine if the first resource is accessible through the at least one network path from a network external to the cloud computing environment; and triggering the known vulnerability to determine if the first resource can be exploited with the known vulnerability, in response to determining that the first resource is accessible through the external network.

Techniques for active inspection of vulnerability exploitation using exposure

A system and method for application endpoint validation and securement is presented. The method includes: detecting an application endpoint on a resource deployed in a computing environment; generating in a security database: a representation of the application endpoint, and a representation of the resource, wherein the security database includes a representation of the computing environment; determining a network path between the resource and an external network, the network path including the application endpoint and a reachability parameter; initiating active inspection of the application endpoint over the network path; and initiating a mitigation action in the computing environment in response to determining through active inspection that the application endpoint is exposed to the external network.

Application endpoint cybersecurity techniques

A system and method for applying a policy on a network path is disclosed. The method includes: selecting a reachable resource having a network path to access the reachable resource, wherein the reachable resource is a cloud object deployed in a cloud computing environment, having access to an external network which is external to the cloud computing environment; actively inspecting the network path to determine if the network path of the reachable resource is accessible from the external network; applying a policy on the accessible network path, wherein the policy includes a conditional rule; initiating a mitigation action, in response to determining that the conditional rule is not met; and applying the policy on another network path, in response to determining that the conditional rule is met.

Growing community of inventors

Tel Aviv, Israel

Matilda Lidgi