Wiz, Inc.

Shir Tamari

Ami Luttwak

Alon Schindel

Ron Cohen

Yaniv Shaked

George Pisha

Amitai Cohen

Barak Sharoni

Itay Arbel

Assaf Segal

Daniel Velikanski

Amir Lande Blau

Arnon Trabelsi

A method and system for API path discovery utilizing a managed API gateway is presented. The method includes detecting an API gateway, wherein the API gateway is a managed API router deployed externally to a cloud computing environment, providing an API routing service to at least a workload in the cloud computing environment; requesting a configuration object of the API gateway, wherein the configuration object includes at least a hint of an API path, wherein the API path is a logical path of a query; detecting a hint of an API path, in the configuration object wherein the hint indicates a potential API path in the cloud computing environment; generating an access instruction based on the potential API path; executing the access instruction in the cloud computing environment; and determining that the potential API path is a validated API path based on a response of executing a network access instruction.

API discovery techniques utilizing a managed router service

A method and system for detecting an exposed software service in a cloud computing environment is presented. The method includes detecting a plurality of resources in the cloud computing environment, wherein each resource is deployed in the cloud computing environment; associating each resource of the plurality of resources with a software service; detecting a plurality of Application Programming Interface (API) endpoints, each API endpoint associated with at least a resource of the plurality of resources; detecting an exposed API endpoint from the plurality of API endpoints based on executing a network access instruction on an API endpoint; determining that the software service is exposed in response to determining that a resource associated with the exposed API endpoint is associated with the software service; and initiating a mitigation action in response to determining that the software service is exposed.

System and method for exposed software service detection

A system and method for detecting a cybersecurity risk of an artificial intelligence (AI), is presented. The method includes: inspecting a computing environment for an AI model deployed therein; generating a representation of the AI model in a security database, the security database including a representation of the computing environment; inspecting the AI model for a cybersecurity risk; generating a representation of the cybersecurity risk in the security database, the representation of the cybersecurity risk connected to the representation of the AI model in response to detecting the cybersecurity risk; and initiating a mitigation action based on the cybersecurity risk.

Techniques for detecting artificial intelligence model cybersecurity risk in a computing environment

A system and method for detecting cloud identity misuse in a cloud computing environment is presented. The method includes: deploying a runtime sensor on a workload in a cloud computing environment; continuously receiving data from the runtime sensor; generating an activity baseline based on the continuously received data, wherein the runtime sensor is configured to detect runtime processes on the workload; detecting an event in a cloud log, the event including an identifier of the workload; associating a runtime process detected by the runtime sensor on the workload with the event detected in the cloud log; and determining that the event is an anomalous event based on the generated activity baseline.

Techniques for detecting cloud identity misuse leveraging runtime context

A system and method for performing inspection of a reachable code object of a cloud computing environment is presented. The method includes detecting a network path for each resource of a plurality of resources deployed in a cloud computing environment, wherein the network path includes at least a portion between an external network and the cloud computing environment; determining reachability parameters of each resource of the plurality of resources for which a network path is detected; accessing a code repository including a plurality of code objects; actively inspecting the network path of a resource to determine if the network path is a viable network path; mapping each resource having a viable network path to a code object of the plurality of code objects; inspecting a mapped code object for a cybersecurity object; and initiating a remediation action based on the cybersecurity object.

System and method for determining code reachability in a networked computing environment

A system and method for preventing cloud identity misuse in a cloud computing environment is presented. The method includes: deploying a runtime sensor on a workload in a cloud computing environment; detecting an event in a cloud log, the event including an identifier of the workload; associating a runtime process detected by the runtime sensor on the workload with the event detected in the cloud log; generating an enriched event based on: the detected event, and an identifier of the associated runtime process; applying a policy on the enriched event; and initiating a mitigation action in the cloud computing environment based on a result of applying the policy on the enriched event.

Techniques for preventing cloud identity misuse leveraging runtime context

A system and method for associating an event in a cloud computing log to a process running on a workload is presented. The method includes: configuring a workload deployed in a cloud computing environment to deploy thereon a sensor, the sensor configured to detect a runtime process on the workload, the runtime process utilizing an identity; detecting in a log of the cloud computing environment an event based on an identifier of the workload, the log including a plurality of events; inspecting a code object for a cybersecurity object, the code object utilized in deploying the workload in the cloud computing environment; associating the runtime process with the event based on an identifier of the workload and the cybersecurity object, wherein the cybersecurity object indicates the identity; and generating an enriched log including an identifier of the runtime process associated with the event and the cybersecurity object.

Techniques for cybersecurity investigation of cloud entity misuse leveraging runtime context

A system and method for identifying cloud identity misuse based on run-time time data and static analysis is presented. The method includes: detecting a workload in a cloud computing environment; configuring the workload to deploy a sensor configured to detect data respective of a runtime process executed on the workload; detecting an original disk associated with the workload; generating an inspectable disk based on the original disk; inspecting the inspectable disk for a cybersecurity object; detecting in a log of the cloud computing environment an event based on an identifier of the workload; inspecting a code object for an identity object, the code object utilized in deploying the workload in the cloud computing environment; associating the runtime process with the event based on: an identifier of the workload, the identity object, and the cybersecurity object; and generating an enriched log including an identifier of the runtime process.

Growing community of inventors

Tel Aviv, Israel

Shir Tamari