Wiz, Inc.

Microsoft Technology Licensing, LLC

Shai Keren

Roy Reznik

Ami Luttwak

Daniel Hershko Shemesh

Matilda Lidgi

Avihai Berkovitz

Raaz Herzberg

Avi Tal Lichtenstein

Liran Moysi

Eliran Marom

Danny Shemesh

Yinon Costica

Yonatan Most

Udi Reitblat

Shai Kaplan

Ido Barav

Gal De Leon

Eliad Peller

Arik Nemtsov

Yonatan Doron

Arik Schimmel

A system and method for near real time detection of cybersecurity threats in a computing environment. The method includes: detecting an event in a data log, the data log including a plurality of data records, each data record corresponding to at least an event; parsing a data record corresponding to the event to detect a data value; detecting a node in a security graph, the node corresponding to the detected data value, wherein the security graph includes a representation of the computing environment; initiating inspection of a resource corresponding to the node.

Near-real time dynamic cybersecurity inspection techniques

A system and method for detecting an application path utilizing active inspection of a cloud computing environment, includes selecting a reachable resource having at least one network path to access the reachable resource, wherein the reachable resource is a cloud object deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment; selecting a second resource having a second network path based on the network path of the reachable resource; and actively inspecting the second network path to determine if the second resource is accessible through the second network path from the reachable resource.

Techniques for detecting applications paths utilizing exposure analysis

A system and method for generation of unified graph models for network entities are provided. The method includes collecting, for at least one network entity of a plurality of network entities, at least one network entity data feature, wherein the at least one network entity data feature is a network entity property; genericizing the collected at least one network entity; generating at least a network graph, wherein the generated network graph is a multi-dimensional data structure providing a representation of the plurality of network entities and relations between the network entities of the plurality of network entities; and storing the generated at least a network graph.

System and method for generation of unified graph models for network entities

A system and method for performing active inspection of a cloud computing environment to detect exposed sensitive data. The method also includes receiving at least one network path to access a first resource, where the first resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and generating a first instruction to access the first resource based on a plurality of reachability parameters designated in the at least one network path; causing execution of the generated first instruction to access the first resource; receiving an output, the output generated in response to execution of the generated first instruction; detecting in the output a predetermined sensitive data indicator; and initiating a mitigation action in response to detecting the sensitive data indicator in the output.

System and method for detecting sensitive data in active inspection of cloud computing resources

A system and method for performing active inspection of a computing environment utilizes optical character recognition. The method includes: receiving at least one network path to access a first resource, where the first resource is a cloud object deployed in the cloud computing environment, potentially accessible from a network which is external to the cloud computing environment; and generating a first instruction to access the first resource based on a plurality of reachability parameters designated in the at least one network path; causing execution of the generated first instruction to access the first resource; receiving a graphical output, the graphical output generated in response to execution of the generated first instruction; performing optical character recognition on the graphical output to generate a textual output; detecting in the textual output a predetermined data indicator; and initiating a second active inspection in response to detecting the data indicator in the textual output.

Techniques for active inspection of cloud computing applications utilizing optical character recognition

A system and method for performing active inspection of a cloud computing environment includes receiving at least one network path to access a first resource, wherein the first resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and actively inspecting the at least one network path to determine if the first resource is accessible through the at least one network path from a network external to the cloud computing environment.

Techniques for analyzing external exposure in cloud environments

A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing.

System and method for analyzing network objects in a cloud environment

A cybersecurity system provides the ability to detect security risks in a cross-platform cloud solution. A unified data schema is used to abstract resources, principals and others across multiple platforms. A security graph is generated to present a unified view of cloud environments, which are then easily queried using the structure of the data schema. The solution allows a compact representation of cloud environments, which is scalable and multi-layered. The security graph allows for representation of production environments, staging environments, as well as code for deploying workloads in the cloud environment. Thus the solution is also able to present a complete picture of a user's entire cloud environment. The solution further allows to generate subgraph views, by associating a tag to certain nodes, then rendering a view based on nodes which include the tag, and all children nodes thereof.

System and method for generating a partitioned view of a security graph in a cloud computing environment

A system and method for applying a policy on a network path is presented. The method includes: selecting a reachable resource having a network path to access the reachable resource, wherein the reachable resource is deployed in a cloud computing environment, having access to an external network; actively inspecting an external network path to determine if the network path of the reachable resource is accessible from the external network; determining that the network path is a valid path, in response to determining that the reachable resource is accessible from the external network path; applying a policy on the valid path; and initiating a mitigation action, in response to determining that the policy is violated.

System and method for applying a policy on a network path

A method and system for modeling a cloud environment as a security graph are provided. The method includes identifying security objects in the cloud environment; collecting object data of the identified security objects; constructing security graph based on collected object data of the identified security objects; determining relationships among the identified security objects, wherein the relationships are determined based on the collected object data of the identified security objects and using a static analysis process; updating the constructed security graph with the determined relationships among the identified security objects; and storing the constructed security graph in a graph database.

Static analysis techniques for determining reachability properties of network and computing objects

A system and method for performing authorization based active inspection of network paths for a resource, deployed in a cloud computing environment, includes receiving at least one network path to access the resource, wherein the resource is a cloud object deployed in the cloud computing environment, and potentially accessible from a network which is external to the cloud computing environment; and actively inspecting the at least one network path to determine if the resource is accessible through the at least one network path from a network external to the cloud computing environment and requires access authorization.

Techniques for detecting resources without authentication using exposure analysis

A system and method for performing active inspection of vulnerability exploitation in a cloud computing environment. The method includes receiving at least one network path to access a first resource, wherein the first resource is a cloud object is deployed in the cloud computing environment and having a known vulnerability, wherein the first resource is potentially accessible from a network which is external to the cloud computing environment; actively inspecting the at least one network path to determine if the first resource is accessible through the at least one network path from a network external to the cloud computing environment; and triggering the known vulnerability to determine if the first resource can be exploited with the known vulnerability, in response to determining that the first resource is accessible through the external network.

Techniques for active inspection of vulnerability exploitation using exposure

A system and method for validating cybersecurity issues utilizing runtime data is disclosed. In an embodiment the method includes: inspecting a workload deployed in a computing environment for a cybersecurity issue; deploying a sensor on the workload, the sensor configured to collect runtime data from the workload; initiating a first mitigation action with a first priority in the computing environment in response to validating the cybersecurity issue from the collected runtime data; initiating a second mitigation action with a second priority, which is lower than the first priority, in response to failing to validate the cybersecurity issue from the collected runtime data.

Growing community of inventors

Tel Aviv, Israel

Shai Keren