Fortinet, Inc.

Lacework Inc.

Theodore M Reed

Yijou Chen

Sowmya A Karmali

Xiaofei Guo

Pamela Bhattacharya

Njall Skarphedinsson

Kenneth Beasley

Nolan K Karpinski

Matti A Vanninen

John Payyappillil John

Adin Aoki

Joshua L Vertes

Bao Nguyen

Christopher E Pedigo

Ravi Kiran Kumar

Brandon Maister

Carsten Varming

Ammar G Ekbote

Mary L Singh

Christien R Rioux

Robert Schoening

Peter W O'hearn

Daniel B Graves

Whitney L Smith

Jacob A Kilby

Nicholas W Mcnutt

Christopher Hall

An illustrative method includes identifying, based on static workload data associated with a compute environment, one or more attack paths from a network to one or more datasets associated with an entity, accessing runtime workload data associated with the compute environment, and performing, based on the runtime workload data, a risk mitigation operation associated with the one or more attack paths.

Attack path risk mitigation by a data platform using static and runtime data

An illustrative method includes accessing data representative of a first role associated with a set of permissions with respect to resources within the compute environment and specifying a group of identities assigned to the first role, determining that a first subgroup of one or more identities included the group of identities only uses a first subset of permissions included in the set of permissions to access the resources within the compute environment without using a second subset of permissions, and performing, based on the determining that the first subgroup of one or more identities only uses the first subset of permissions, an operation to reduce permissions usable by the first subgroup of one or more identities.

Role-based permission by a data platform

An illustrative method includes scanning a compute environment associated with an entity and identifying one or more attack paths from a network to one or more datasets associated with the entity. The one or more attack paths each include a series of risk artifacts within the compute environment that can be exploited by an attacker to access the one or more datasets. The method further includes generating one or more attack path risk scores associated with the one or more attack paths and indicative of one or more levels of risk that the one or more attack paths could be exploited to access the one or more datasets. A risk mitigation operation associated with the one or more attack paths is performed based on the one or more attack path risk scores.

Attack path risk mitigation by a data platform

An illustrative method includes accessing, by a data platform configured to monitor a compute environment, permissions data representative of a set of permissions that specify how an entity is entitled to interact with resources within the compute environment; collecting, by the data platform, runtime workload data representative of an actual interaction by the entity with the resources over a period of time; and performing, by the data platform based on the runtime workload data, an operation associated with modifying the set of permissions for the entity.

Runtime workload data-based modification of permissions for an entity

Guiding query creation for a generative artificial intelligence (AI)-enabled assistant, including: receiving, via a natural language interface for a security framework monitoring a cloud deployment, a natural language input comprising one or more entity identifiers; gathering information based on the one or more entity identifiers; providing, to a generative artificial intelligence (AI) model, a prompt based on the natural language input and comprising the gathered information; and receiving, from the generative AI model, a response to the prompt.

Guiding query creation for a generative artificial intelligence (AI)-enabled assistant

An illustrative method includes tracking, by a data platform configured to monitor a compute environment, a plurality of identity transitions that occur over time with respect to an entity, wherein each of the identity transitions includes a transition by the entity from being associated with one identity to being associated with another identity, the one identity and the another identity having different permission sets with respect to resources within the compute environment; determining, by the data platform while performing the tracking, that an attribute of the plurality of identity transitions satisfies a predetermined criterion; and performing, by the data platform based on the attribute of the plurality of transitions satisfying the predetermined criterion, a remedial action associated with the entity.

Transitive identity usage tracking by a data platform

An illustrative method includes a scanning driver providing an interface between data included in a data structure located within a compute environment and one or more scan modules included in an unprivileged agentless workload scanning configuration executing within the compute environment, the one or more scan modules configured to concurrently analyze the data in accordance with one or more respective scan use cases; receiving a request to add a new scan module to the unprivileged agentless workload scanning configuration, the new scan module associated with a new scan use case different than the one or more respective scan use cases, and dynamically loading, based on the request and while the one or more scan modules are concurrently analyzing the data, the new scan module into the unprivileged agentless workload scanning configuration.

Modular agentless scanning of cloud workloads

An illustrative method for operating an agent configuration may include providing an unprivileged agentless workload scanning configuration to collect non-runtime workload data associated with a workload deployed within a cloud environment, determining one or more properties of the workload based on the non-runtime workload data, and performing an operation with respect to a privileged agent configuration deployed within the cloud environment and configured to collect runtime workload data associated with the workload. Likewise, an illustrative method for operating an agentless configuration may include providing a privileged agent configuration to collect runtime workload data associated with a workload deployed within a cloud environment, determining one or more properties of the workload based on the runtime workload data, and performing an operation with respect to an unprivileged agentless scanning configuration deployed within the cloud environment and configured to collect non-runtime workload data associated with the workload.

Interdependence of agentless and agent-based operations by way of a data platform

Methods, apparatuses, and products for providing a code analysis feedback loop for code created using generative AI, including: performing a code analysis on code generated by a generative AI model; determining, based on the code analysis, whether the code satisfies one or more conditions; responsive to the code failing to satisfy the one or more conditions, until the code satisfies the one or more conditions, repeatedly updating the code by receiving, from the generative AI model, updated code based on a previously performed code analysis; and providing the code generated by the generative AI model.

Code analysis feedback loop for code created using generative artificial intelligence ('AI')

Architecture for a generative artificial intelligence (AI)-enabled assistant, including: receiving, via a natural language interface for a security framework monitoring a cloud deployment, a natural language input; selecting, by a delegator generative artificial intelligence (AI) model and based on the natural language input, a particular generative AI model from a plurality of selectable generative AI models; prompting the particular generative AI model based on the natural language input; and providing, via the natural language interface and in response to the natural language input, a response from the particular generative AI model.

Architecture for a generative artificial intelligence (AI)-enabled assistant

Using static analysis for vulnerability detection, including: inspecting, using an underapproximate static code analysis, a non-executable representation of an application to identify one or more vulnerabilities in the application; and providing an indication of the one or more vulnerabilities, wherein the underapproximate static code analysis can include a taint analysis that is based on one or more of symbolic execution or incorrectness logic.

Using static analysis for vulnerability detection

An illustrative method includes accessing data representative of a first role associated with a set of permissions with respect to resources within the compute environment and specifying a group of identities assigned to the first role, determining that a first subgroup of one or more identities included the group of identities only uses a first subset of permissions included in the set of permissions to access the resources within the compute environment without using a second subset of permissions, and performing, based on the determining that the first subgroup of one or more identities only uses the first subset of permissions, an operation to reduce permissions usable by the one or more identities.

Growing community of inventors

Berkeley Heights, NJ, United States of America

Theodore M Reed