Granted Patent B2

US 12,505,200 · App. 17/664,508 · Granted Dec 23, 2025

Inventors: Daniel Hershko Shemesh (Givat-Shmuel, IL); Yarin Miran (Rishon Lezion, IL); Roy Reznik (Tel Aviv, IL); Ami Luttwak (Binyamina, IL); Yinon Costica (Tel Aviv, IL)

Assignee: Wiz, Inc.

G06F21/53G06F3/067G06F2009/45562

Abstract

Claims (47)

1 . A method for inspecting live virtual instances in a cloud computing environment for cybersecurity threats, comprising:

selecting a live virtual instance in a cloud computing environment, wherein the live virtual instance includes a disk having a disk descriptor with an address in a cloud storage system;

generating an instruction to clone the disk of the live virtual instance;

dereferencing a pointer of the disk of the live virtual instance;

generating a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the live virtual instance, wherein the cloned disk descriptor causes a cloned disk to become instantly available for inspection;

generating a pointer for the cloned disk descriptor based on the dereferenced pointer of the disk of the live virtual instance;

inspecting the cloned disk for a cybersecurity threat; and

releasing the cloned disk in response to completing the inspection of the disk.

2 . The method of claim 1 , further comprising:

generating a pointer for the cloned disk descriptor to an encryption key, the encryption key used for encrypting the disk.

3 . The method of claim 1 , wherein the cloned disk descriptor includes a pointer to an address of a storage block in a managed storage of the cloud computing environment.

4 . The method of claim 1 , wherein inspecting the cloned disk for the cybersecurity threat further comprises: inspecting the cloned disk for any one of: an exposure, a vulnerability, a malware, a ransomware, a spyware, a bot, a weak password, an exposed password, an exposed certificate, a misconfiguration, a suspicious event, and any combination thereof.

5 . The method of claim 1 , further comprising:

deprovisioning the cloned disk descriptor, in response to completing inspecting the at least a disk.

6 . The method of claim 1 , wherein the virtual instance remains live during the inspection.

7 . The method of claim 1 , wherein the live virtual instance is detected in the cloud computing environment.

8 . The method of claim 1 , further comprising:

querying a security graph to detect a disk node representing a disk, the disk node connected to a virtual instance node representing the live virtual instance, wherein the security graph represents the cloud computing environment.

9 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

selecting a live virtual instance in a cloud computing environment, wherein the live virtual instance includes a disk having a disk descriptor with an address in a cloud storage system;

generating an instruction to clone the disk of the live virtual instance;

dereferencing a pointer of the disk of the live virtual instance;

generating a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the live virtual instance, wherein the cloned disk descriptor causes a cloned disk to become instantly available for inspection;

generating a pointer for the cloned disk descriptor based on the dereferenced pointer of the disk of the live virtual instance;

inspecting the cloned disk for a cybersecurity threat; and

releasing the cloned disk in response to completing the inspection of the disk.

10 . A system for inspecting live virtual instances in a cloud computing environment for cybersecurity threats, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

select a live virtual instance in a cloud computing environment, wherein the live virtual instance includes a disk having a disk descriptor with an address in a cloud storage system;

generate an instruction to clone the disk of the live virtual instance;

dereference a pointer of the disk of the live virtual instance;

generate a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the live virtual instance, wherein the cloned disk descriptor causes a cloned disk to become instantly available for inspection;

generate a pointer for the cloned disk descriptor based on the dereferenced pointer of the disk of the live virtual instance;

inspect the cloned disk for a cybersecurity threat; and

release the cloned disk in response to completing the inspection of the disk.

11 . The system of claim 10 , wherein the memory further contains instructions which when executed by the processing circuitry further configure the system to:

generate a pointer for the cloned disk descriptor to an encryption key, the encryption key used for encrypting the disk.

12 . The system of claim 10 , wherein the cloned disk descriptor includes a pointer to an address of a storage block in a managed storage of the cloud computing environment.

13 . The system of claim 10 , wherein the memory further contains instructions which when executed by the processing circuitry further configure the system to:

inspect the cloned disk for any one of: an exposure, a vulnerability, a malware, a ransomware, a spyware, a bot, a weak password, an exposed password, an exposed certificate, a misconfiguration, a suspicious event, and any combination thereof.

14 . The system of claim 10 , wherein the memory further contains instructions which when executed by the processing circuitry further configure the system to:

deprovision the cloned disk descriptor, in response to completing inspecting the at least a disk.

15 . The system of claim 10 , wherein the virtual instance remains live during the inspection.

16 . The system of claim 10 , wherein the live virtual instance is detected in the cloud computing environment.

17 . The system of claim 10 , wherein the memory further contains instructions which when executed by the processing circuitry further configure the system to:

query a security graph to detect a disk node representing a disk, the disk node connected to a virtual instance node representing the live virtual instance, wherein the security graph represents the cloud computing environment.

Assignments (1)

Continuity (1)

References Cited (400)