Systems and methods for continuous threat-informed exposure management

1. A method for determining a defense surface change command to be applied to a defense surface, the method comprising:

storing threat information for a set of known threats in an adversarial technique framework data structure, wherein the stored threat information comprises one or more of adversarial tactics, techniques, and procedure information;

storing an organizational threat profile, the threat profile comprising information about networked components forming part of a network infrastructure, and wherein the networked components comprise one or more hardware or software components for monitoring a security state on a computer network;

generating baseline exposure scores for the set of known threats;

weighting the baseline exposure scores for the set of known threats based on at least the organizational threat profile to generate a prioritized exposure score for the threats in the set of known threats;

determining one or more defense surface change commands based on at least the prioritized exposure scores for the threats in the set of known threats;

wherein determining one or more defense surface change commands further comprises:

storing a set of defense surface change commands mapped for association with the set of known threats and a set of telemetry data;

mapping the stored threat information for the set of known threats against a set of received telemetry data to identify one or more security coverage gaps; and

determining the one or more defense surface change commands based on the one or more identified security coverage gaps;

transmitting the one or more defense surface change commands to the one or more hardware or software components based on the prioritized exposure scores for the threats in the set of known threats;

receiving confirmation of a defense surface change at the one or more hardware or software components in response to the one or more defense surface change commands; and

generating an updated prioritized exposure score for the one or more of the known threats.

2. The method of claim 1 , further comprising:

training a machine learning model based on a set of historical telemetry data received from the networked components and a set of historical threat information;

receiving subsequent telemetry data from the networked components and subsequent threat information; and

executing the machine learning model based on the subsequent telemetry data and the subsequent threat information to predict an occurrence of a subsequent threat and a prioritized exposure score for the subsequent threat.

3. The method of claim 1 , wherein generating the prioritized exposure score further comprises:

receiving the organizational threat profile;

generating a prioritized threat model score;

generating a prioritized defense surface score;

generating a prioritized fleet exposure score;

receiving the prioritized threat model score, the prioritized defense surface score, and the prioritized fleet exposure score as inputs to a modeling engine;

applying one or more weighting factors to one or more of the inputs to the modeling engine; and

generating by the modeling engine the prioritized exposure score based on one or more of the inputs to the modeling engine.

4. The method of claim 3 , further comprising generating the prioritized defense surface score based on one or more terrain parameters selected from one or more of: a toolset configuration, a security log, an implemented detection logic, a security control or policy, and available detection logic.

5. The method of claim 1 , further comprising generating the organizational threat profile based on one or more of: a relevance to an organization, an ability of a threat to be used within an organization environment, a country in which the organization operates, an industry in which the organization operates, a number of employees in the organization, a defense surface platform within a defended environment at the organization, and a type of data managed by the organization.

6. The method of claim 1 , further comprising receiving a set of telemetry data from one or more networked components forming part of a network infrastructure, wherein the telemetry data comprises one or more sets of log data and configuration data.

7. The method of claim 1 , wherein the baseline exposure scores apply to multiple enterprises and further comprising generating the baseline exposure scores based on one or more of a prevalence, impact, usability, and actionability value.

8. A system for determining a defense surface change command to be applied to a defense surface, the system comprising:

a computerized data store configured for storing threat information for a set of known threats in an adversarial technique framework data structure, wherein the stored threat information comprises one or more of adversarial tactics, techniques, and procedure information;

the computerized data store further configured for storing an organizational threat profile, the threat profile comprising information about networked components forming part of a network infrastructure, and wherein the networked components comprise one or more hardware or software components for monitoring a security state on a computer network;

a computerized processor configured for:

generating baseline exposure scores for the set of known threats;

weighting the baseline exposure scores for the set of known threats based on at least the organizational threat profile to generate a prioritized exposure score for the threats in the set of known threats;

determining one or more defense surface change commands based on at least the prioritized exposure scores for the threats in the set of known threats;

wherein determining one or more defense surface change commands further comprises:

storing a set of defense surface change commands mapped for association with the set of known threats and a set of telemetry data;

mapping the stored threat information for the set of known threats against a set of received telemetry data to identify one or more security coverage gaps; and

determining the one or more defense surface change commands based on the one or more identified security coverage gaps;

transmitting the one or more defense surface change commands to the one or more hardware or software components based on the prioritized exposure scores for the threats in the set of known threats;

receiving confirmation of a defense surface change at the one or more hardware or software components in response to the one or more defense surface change commands; and

generating an updated prioritized exposure score for the one or more of the known threats.

9. The system of claim 8 , wherein the computerized processor is further configured for:

training a machine learning model based on a set of historical telemetry data received from the networked components and a set of historical threat information;

receiving subsequent telemetry data from the networked components and subsequent threat information; and

executing the machine learning model based on the subsequent telemetry data and the subsequent threat information to predict an occurrence of a subsequent threat and a prioritized exposure score for the subsequent threat.

10. The system of claim 8 , wherein the computerized processor is further configured for:

receiving the organizational threat profile;

generating a prioritized threat model score;

generating a prioritized defense surface score;

generating a prioritized fleet exposure score;

receiving the prioritized threat model score, the prioritized defense surface score, and the prioritized fleet exposure score as inputs to a modeling engine;

applying one or more weighting factors to one or more of the inputs to the modeling engine; and

generating by the modeling engine the prioritized exposure score based on one or more of the inputs to the modeling engine.

11. The system of claim 10 , wherein the computerized processor is further configured for generating the prioritized defense surface score based on one or more terrain parameters selected from one or more of: a toolset configuration, a security log, an implemented detection logic, a security control or policy, and available detection logic.

12. The system of claim 8 , wherein the computerized processor is further configured for generating the organizational threat profile based on one or more of: a relevance to an organization, an ability of a threat to be used within an organization environment, a country in which the organization operates, an industry in which the organization operates, a number of employees in the organization, a defense surface platform within a defended environment at the organization, and a type of data managed by the organization.

13. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor at a compute device for determining a defense surface change command to be applied to a defense surface, the code further comprising commands for:

storing threat information for a set of known threats in an adversarial technique framework data structure, wherein the stored threat information comprises one or more of adversarial tactics, techniques, and procedure information;

storing an organizational threat profile, the threat profile comprising information about networked components forming part of a network infrastructure, and wherein the networked components comprise one or more hardware or software components for monitoring a security state on a computer network;

generating baseline exposure scores for the set of known threats;

weighting the baseline exposure scores for the set of known threats based on at least the organizational threat profile to generate a prioritized exposure score for the threats in the set of known threats;

determining one or more defense surface change commands based on at least the prioritized exposure scores for the threats in the set of known threats;

wherein determining one or more defense surface change commands further comprises:

storing a set of defense surface change commands mapped for association with the set of known threats and a set of telemetry data;

mapping the stored threat information for the set of known threats against a set of received telemetry data to identify one or more security coverage gaps; and

determining the one or more defense surface change commands based on the one or more identified security coverage gaps;

transmitting the one or more defense surface change commands to the one or more hardware or software components based on the prioritized exposure scores for the threats in the set of known threats;

receiving confirmation of a defense surface change at the one or more hardware or software components in response to the one or more defense surface change commands; and

generating an updated prioritized exposure score for the one or more of the known threats.

14. The processor-readable medium of claim 13 , further comprising commands for:

training a machine learning model based on a set of historical telemetry data received from the networked components and a set of historical threat information;

receiving subsequent telemetry data from the networked components and subsequent threat information; and

executing the machine learning model based on the subsequent telemetry data and the subsequent threat information to predict an occurrence of a subsequent threat and a prioritized exposure score for the subsequent threat.

15. The processor-readable medium of claim 13 , further comprising instructions for:

receiving the organizational threat profile;

generating a prioritized threat model score;

generating a prioritized defense surface score;

generating a prioritized fleet exposure score;

receiving the prioritized threat model score, the prioritized defense surface score, and the prioritized fleet exposure score as inputs to a modeling engine;

applying one or more weighting factors to one or more of the inputs to the modeling engine; and

generating by the modeling engine the prioritized exposure score based on one or more of the inputs to the modeling engine.

16. The processor-readable medium of claim 13 , further comprising instructions for generating the organizational threat profile based on one or more of: a relevance to an organization, an ability of a threat to be used within an organization environment, a country in which the organization operates, an industry in which the organization operates, a number of employees in the organization, a defense surface platform within a defended environment at the organization, and a type of data managed by the organization.

17. The processor-readable medium of claim 13 , further comprising instructions for receiving a set of telemetry data from one or more networked components forming part of a network infrastructure, wherein the telemetry data comprises one or more sets of log data and configuration data.