612 results about "Cybersafety" patented technology

Described herein are systems and methods for identifying security vulnerabilities. The systems and methods herein can utilize security vulnerability information to identify potential security threats and can utilize this information to generate an attack using a machine learning model, such as a large language model. Generated attacks can be carried out to assess impact of a security vulnerability. An output can be provided that represents the assessed impact. In some implementations, the systems and methods herein generate patches or other mitigations for security vulnerabilities, which can be tested and deployed to address security vulnerabilities.

The disclosed embodiments provide systems and methods for automated mapping of raw data into a data fabric. An innovative approach leveraging Artificial Intelligence (AI)-powered tools and a data fabric to automate the ingestion, transformation, and integration of raw data into a unified model is introduced. By automating the data mapping process, organizations can reduce reliance on manual methods and accelerate their ability to utilize robust insights for exposure management and attack surface reduction. The disclosed solution provides a scalable architecture for unifying cybersecurity signals across cloud and hybrid environments, enabling real-time decision-making and improved organizational resilience against cyber threats

A neural classifier model is used to detect cybersecurity vulnerabilities in the source code predicted by a deep learning code generation model having been trained on source code possibly containing security bugs. Upon the classifier model classifying a given source code snippet as likely containing a cybersecurity vulnerability, a proposed repair for the cybersecurity vulnerability is predicted from a neural decoder transformer model having been trained on non-vulnerable source code. The neural decoder transformer model is used to predict source code that repairs the cybersecurity vulnerability given the source code classified with a cybersecurity vulnerability.

Disclosed embodiments provide techniques for cybersecurity AI-driven workflow modifications. A security orchestration, automation, and response (SOAR) platform used to manage a plurality of cybersecurity threat protection applications deployed across a cybersecurity network is accessed. A cybersecurity workflow is executed using the SOAR platform and one or more cybersecurity actions related to the workflow are captured and analyzed for workflow relevance. The cybersecurity actions can include steps taken by security operations center staff and automated cybersecurity threat protection applications. The analysis can be performed by machine learning, and can include evaluations of repeated cybersecurity incidents, operation regression exercises, and suggested remedial steps. The workflow analysis can include identifying recidivistic security operations responses. Based on the analysis, the cybersecurity workflow is updated to improve workflow quality. The updating can include reordering the workflow steps, automating responses of operations staff, or executing actions recommended by separate AI cybersecurity systems.

A natural language to database query converter (converter) receives a natural language query from a user (i.e., a user utterance) and identifies a cybersecurity domain related to intent of the natural language query. The converter then generates a database query for a query language of the cybersecurity domain corresponding to the natural language query with a large language model (LLM). An initial prompt to the LLM generated by the converter specifies a grammar of the query language and instructs the LLM to generate an initial database query that functions like the natural language query and satisfies the grammar. If a lint program determines that the initial database query is not valid for the query language, the converter generates a follow-up prompt to the LLM that indicates valid database queries from which to generate a follow-up database query. A query parser retrieves data that satisfy the initial or follow-up database query and a visualization / summarization module generates graph visualizations and summaries of the retrieved data.

Provided is a generative sequence processing model that is specifically finetuned for cybersecurity applications. This specialized generative sequence processing model can be finetuned on a comprehensive range of cybersecurity data and associated finetuning tasks, providing the model with rich capabilities for analyzing, understanding, describing, and taking action with respect to the real-time cybersecurity data generated by one or more cybersecurity operations tools. Thus, the creation and use of the generative sequence processing model represents a solution to the technical challenge of usefully analyzing and acting upon a large volume of data generated by a number of disparate cybersecurity operations tools deployed by an organization.

An organization-specific cybersecurity dialogue system (“system”) intelligently generates responses to user utterances for cybersecurity by employing documentation and playbook agents for an associated cybersecurity organization. The system extracts an intent and an intent category from a user utterance, extracts relevant entities from the intent and uses them to determine relevant user telemetry data, and matches the intent, intent category, and user telemetry data to documents of the cybersecurity organization. The system then determines whether to generate a response based on matching document, matching playbook agents, or to prompt a user to create a ticket according to logic applied to the intent, intent category, user telemetry data, and matching documents and generates a corresponding response with large language models.

Systems, methods, and computer-readable storage media for providing a composable cyber resilience object. A method can include identifying, by one or more processing circuits, a posture state of at least one entity, generating or selecting a first plurality of code blocks corresponding with a parameters of at least one third-party, and determining the entity qualifies for protection based on the posture state and the rules or conditions. The method can include generating or selecting a second plurality of code blocks including functions to provide the protection based on the rules or conditions and generating the composable cyber resilience object by integrating a portion of the first plurality of code blocks and the second plurality of code blocks into at least one data structure. The method can include linking the composable cyber resilience object and a computing or networking infrastructure of the entity using a communication interface or structure.

Systems and methods for verifying an applicant. An example method includes, receiving, from a user device, an application that includes an identifier associated with an applicant; determining a digital profile for the applicant based on the identifier, processing the digital profile through an assessment model to determine a metric for the applicant; and providing, to the user device, validation data for the application based on the metric for the applicant.

A system and method for detecting cybersecurity risk on a resource in a computing environment utilizes static analysis of a cloned resource and runtime data from the live resource. The method includes: configuring a resource deployed in a computing environment to deploy thereon a sensor, the sensor configured to detect runtime data; detecting runtime data from the sensor of the resource; generating an inspectable disk based on an original disk of the resource; initiating inspection based on the detected runtime data for a cybersecurity object on the inspectable disk; detecting the cybersecurity object on an inspectable disk; and initiating a mitigation action on the resource.

A system and method for generating a cybersecurity risk profile based on an identity in a computing environment is disclosed. The method includes: detecting a plurality of identities in a computing environment, each identity including a permission to initiate an action in the computing environment; querying an identity and access management service to detect a permission associated with a first identity of the plurality of identities; accessing an activity log of the computing environment; parsing the activity log to detect an event based on the first identity; and generating an identity risk profile based on: the detected event, and the detected permission.

A system and method for improved endpoint detection and response (EDR) in a cloud computing environment initiates inspection based on data received from a sensor deployed on a workload. The method includes: configuring a resource, deployed in a cloud computing environment, to deploy thereon a sensor, the sensor configured to detect runtime data; detecting a potential cybersecurity threat on the resource based on detected runtime data received from the sensor; and initiating inspection of the resource for the potential cybersecurity threat.

The present disclosure presents methods and systems for determining cybersecurity risk exposure for entities. In one aspect, a method is provided that includes providing first text data to a trained LLM to identify data associated with a first candidate cybersecurity event for an entity, comparing the entity's identifier to domain information to verify the entity's identifier, determining if the first candidate cybersecurity event represents a new cybersecurity event based on com with previous data, and updating a cybersecurity risk score for the entity based on this determination. Further enhancements include training the LLM with cybersecurity event data, outputting documentation of the event source, and various methods for evaluating the novelty and severity of the cybersecurity event, including similarity measures and manual review triggers. The techniques leverage LLMs, machine learning models, and automated actions to provide a comprehensive approach to cybersecurity risk assessment and response. Other aspects are also provided.

Cost-effective cyber security risk countermeasure systems and methods enable LLM-based automated security testing for managed cybersecurity services, without leaking sensitive information about target systems. In embodiments, this is accomplished by utilizing flexible local language models that identify and filter target system specific information when communicating with a public large language model to obtain highly accurate security testing patterns.

As cybersecurity alerts are detected and logged as formatted descriptors across an organization, a text converter converts the formatted descriptors into natural language descriptors by extracting and inserting metadata fields into natural language templates corresponding to user personas for the organization. In response to an alert-based query from a user, a persona classifier predicts a persona of the user from historical chat logs and retrieves natural language descriptors for alerts related to the user and predicted persona. A prompt generator receives the retrieved natural language descriptors and generates a prompt that instructs a large language model (LLM) to respond to the user with data from the natural language descriptors. Once prompted, the LLM establishes a conversation with the user via an interface for alert resolution.

A cloud-based, machine-learned cybersecurity command line interpretation service simplifies complex command lines using plain language. Command lines are input to the cybersecurity command line interpretation service for an interpretation by a machine learning model. If, however, a command line is known and been previously interpreted, then the cybersecurity command line interpretation service may conserve hardware and software resources by retrieving a historical command line interpretation. If the command line is unknown or not historically logged, then the cybersecurity command line interpretation service may generate a current command line interpretation using the machine learning model. The cybersecurity command line interpretation service may then generate a cybersecurity prediction associated with the command line based on the historical or current command line interpretation. The cybersecurity command line interpretation service thus provides a much faster interpretation and cybersecurity prediction for assessing command lines as malicious or benign.

Systems and methods for managing cybersecurity for an entity are disclosed. An example method includes providing a content portal to a user configured to display a security risk profile via a generated GUI; receiving, via the generated GUI, a first input from the user comprising a selection of a component identified in the security risk profile and a response parameter; providing, via the generated GUI, parameters for a targeted scan of the selected component; receiving, via the generated GUI, a second input from the user comprising a selection of a confirmation of the parameters; identifying a vulnerability associated with a first property or a second property from device connectivity data based on the parameters; initiating the targeted scan of the selected component associated with the vulnerability; determining a result of the targeted scan; updating the security risk profile; and updating a multi-dimensional score based on the updated security risk profile.

A system, method, and computer-program product includes obtaining raw event data associated with a subscriber, automatically selecting an automated event ingestion instruction of a plurality of distinct automated event ingestion instructions for processing the raw event data, automatically generating a pre-normalized security event that includes the raw event data in a first structured data object in response to executing the automated event ingestion instruction, automatically transforming the pre-normalized security event to at least one normalized security event, automatically assessing a corpus of computer-executable detection instructions against the at least one normalized security event, generating a security alert based on the at least one normalized security event satisfying a set of alerting conditions of a subject computer-executable detection instruction of the corpus of computer-executable detection instructions, and executing a threat mitigation response that mitigates a security threat associated with the security alert.

Systems and methods are disclosed for providing a cyber resilience rating. A method can include obtaining a plurality of entity indicators. The method can include determining a peer group of entities for the entity based on the entity indicators. The method can include obtaining a plurality of loss event records for the peer group. The method can include executing, based on the loss event records, a plurality of Monte Carlo simulations to generate loss simulation data. The method can include identifying, based on the loss simulation data, an expected probability value. The method can include providing a risk factor score indicative of a cyber security risk of the entity based on the identified expected probability value. The method can include providing a cyber resilience rating for the entity based on a combination of the risk factor score, a fortitude factor score, and a governance factor score.

An intelligent orchestration module can facilitate an AI augmented and adaptive interactive response loop between multiple AI-based engines. A cyber threat detection uses AI to detect a cyber threat. An autonomous response engine uses AI to mitigate the detected cyber threat. A cyber-security restoration engine uses AI to remediate nodes in the system to a trusted operational state. The prediction engine uses AI to conduct simulations of cyberattacks to assist in determining how a simulated cyberattack might occur in the system, and how to use the simulated cyberattack information to preempt possible escalations of an ongoing actual cyberattack. The multiple AI-based engines bilaterally exchange behavioral metrics between the AI-based engines to work together to provide an overall cyber threat response during the ongoing cyberattack in light of continuing attack activities and simulations of the cyberattack to predict what might occur in the nodes based on the mitigation actions taken and / or the restoration actions taken.

A system and method for cybersecurity threat detection using an activity baseline generated based on sensor-detected runtime execution data is presented. The method includes: receiving aggregated runtime data from a sensor deployed on a resource in a cloud computing environment; generating an event log based on the aggregated runtime data, each event in the event log generated by extracting data from the aggregated runtime data; generating an activity baseline for a process executed on the resource based on the event log; receiving a new event from the sensor; and determining that the new event is anomalous based on the generated activity baseline.

Methods, systems, and computer storage media for providing a modular cybersecurity platform are described. The modular cybersecurity platform is implemented using a modular cybersecurity engine that operates based on an analytical framework for dynamic data analysis and data management in a data intelligence system. In particular, the analytical framework is based on complementary modular components that are designed to interoperate in the modular cybersecurity engine. The modular cybersecurity engine includes a modular distributed system, a credential detection system, and a credential semantic graph system. The modular cybersecurity engine supports cybersecurity and sensitive data management scenarios that can empower investigators in various investigations, and provide automated flows that are highly scalable and support different types of functionality (e.g., priority embedding pipeline, credential scanning, and credential semantic graph analysis). The utility of the modular cybersecurity engine is demonstrated by its wide-ranging application in addressing complex cybersecurity challenges and sensitive data management tasks.

A method comprises communicating training data to a computing device to in situ train a user on how to identify potential security incidents; tracking performance of the user based on the training data; and storing a profile of the user in a database, the profile indicating a level of performance of the user.

In one embodiment, a method includes identifying first entities by a first root authority entity, authorizing one or more first entities to be certificate authorities by the first root authority entity, wherein each certificate authority is configured to audit a smart contract in a development environment before it is deployed on a first blockchain network and authorized to issue a certificate for each smart contract audited in the development environment based on a determination that the corresponding smart contract deployed on the first blockchain network matches the smart contract that was audited in the development environment, determining certificate authority authorization parameters are not satisfied for at least a first certificate authority, and revoking the certificate authority authorization for the first certificate authority by the first root authority entity, wherein each certificate issued by the first certificate authority prior to the revocation remains valid after the revocation.

A system and method are provided for generating a cybersecurity behavioral graph from a log files and / or other telemetry data, which can be unstructured or semi-structured data. The log files are applied to a machine learning (ML) model (e.g., a large language model (LLM)) that generates / extract from the log files entities and relationships between said entities. The entities and relationships can be constrained using a cybersecurity ontology or schema to ensure that the results are meaningful to a cybersecurity context. A graph is then generated by mapping the extracted entities to nodes in the graph and the relationships to edges connecting nodes. To more efficiently extract the entities and relationships from the data file, an LLM is used to generate regular expressions for the format of the log files. Once generated, the regular expressions can rapidly parse the log files to extract the entities and relationships.

A system and method for utilizing a generative adversarial model for training in a cybersecurity range is presented. The method includes: generating a plurality of scenarios based on a plurality of predetermined actions in a cloud computing environment; initiating a cybersecurity range, the cybersecurity range including a secure cloud computing environment and a plurality of workloads deployed therein; generating a prompt for a large language model (LLM) based on a template, a scenario of the plurality of scenarios, and an identifier of a workload of the plurality of workloads; and initiating an action in the cybersecurity range based on an output generated by the LLM in response to the prompt.

A method can include determining, by one or more processing circuits, a cybersecurity resilience posture of an entity. The method can include identifying or generating, by the one or more processing circuits, at least one token comprising a proof or a posture state corresponding with the cybersecurity resilience posture of the entity. The method can include determining, by the one or more processing circuits using a cyber threat intelligence (CTI) model, at least one of a quantitative value or a qualitative value corresponding to the at least one token. The method can include updating, by the one or more processing circuits, a cybersecurity profile of the entity corresponding to at least one protection product.

A business poly-intelligence application enabling the secure collection, warehousing, analysis, and reporting of manually shared and publicly sourced business strategy data is presented with systems, methods, and computer-readable media with a specific focus on crowdsourced cybersecurity strategy development.

An artificial intelligence (AI)-powered system for policy evaluation, bias mitigation, and regulatory compliance. The system retrieves AI policies from multiple sources, including APIs, document parsing, and structured web scraping, ensuring real-time updates. It applies machine learning and natural language processing (NLP) to generate unbiased policy summaries and detect cybersecurity, ethics, and compliance gaps. A policy optimization engine analyzes governance trends and refines recommendations based on adoption feasibility. The system includes a sandbox testing framework that simulates regulatory and societal impacts to assess policy effectiveness. This AI-driven approach enhances fairness, transparency, and cybersecurity resilience in AI governance, enabling policymakers to proactively align with global regulatory frameworks and mitigate policy risks.

Some embodiments bridge a gap between focusing on security alerts raised by conditions and events that have already occurred, and focusing on vulnerabilities that might be exploited in the future. Alerts are organized into alert categories, vulnerabilities are organized into vulnerability categories, and are optionally supplemented with misconfiguration categories. Correlations are identified between alert categories and vulnerability or misconfiguration categories, and the correlation values noted, to produce category association rules. The alerts, vulnerabilities, and other security findings are gathered in some situations from multiple similar environments, and in some cases are filtered to pertain to similar resources or similar configurations. The category association rules are utilized to perform cybersecurity prioritizations such as assigning priority levels to alerts and assigning likelihood levels to potential breaches. Graphs showing resources and data flow paths are annotated with risk scores or with security findings relevant to the applicable category association rules.