System and method for detecting cybersecurity risks in managed artificial intelligence models
A system and method for detecting a combined cybersecurity risk for an artificial intelligence (AI) model is presented. The method includes: inspecting a computing environment for an AI model deployed therein; generating a representation of the AI model in a security database, the security database including a representation of the computing environment; detecting a first cybersecurity risk respective of the AI model; inspecting the computing environment for a cybersecurity object; determining that the AI model is exposed to a toxic combination cybersecurity risk based on the detected first cybersecurity risk and the cybersecurity object; and initiating a mitigation action based on the toxic combination cybersecurity risk.
1. A method for detecting a combined cybersecurity risk for an artificial intelligence (AI) model, comprising:
inspecting a computing environment for an AI model deployed therein by querying an application programming interface (API) of the computing environment to detect the AI model deployed therein;
receiving a list of AI model identifiers in response to the API query;
generating a representation of the AI model in a security database, the security database including a representation of the computing environment;
detecting a first cybersecurity risk respective of the AI model;
inspecting the computing environment for a cybersecurity object;
determining that the AI model is exposed to a toxic combination cybersecurity risk based on the detected first cybersecurity risk and the cybersecurity object; and
initiating a mitigation action based on the toxic combination cybersecurity risk.
2. The method of claim 1 , further comprising:
initiating the mitigation action further based on any one of: the first cybersecurity risk, the cybersecurity object, and a combination thereof.
3. The method of claim 1 , further comprising:
generating an inspectable disk based on an original disk of a resource deployed in the computing environment; and
inspecting the inspectable disk for any one of: the AI model, the cybersecurity object, and a combination thereof.
4. The method of claim 3 , further comprising:
detecting an artifact of the AI model on the inspectable disk.
5. The method of claim 1 , further comprising:
inspecting the AI model to detect an AI model configured to execute a code object.
6. The method of claim 1 , further comprising:
detecting a metadata of the AI model, wherein the metadata indicates that the AI model is a cybersecurity risk.
7. The method of claim 1 , further comprising:
detecting in the AI model any one of: a secret, a certificate, a code, and any combination thereof.
8. The method of claim 1 , further comprising:
applying a policy on the representation of the computing environment.
9. The method of claim 8 , further comprising:
initiating the mitigation action based on the policy.
10. The method of claim 1 , wherein the cybersecurity object indicates any one of: a vulnerability, an exposure, a misconfiguration, and a combination thereof.
11. A non-transitory computer-readable medium storing a set of instructions for detecting a combined cybersecurity risk for an artificial intelligence (AI) model, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
inspect a computing environment for an AI model deployed therein by querying an application programming interface (API) of the computing environment to detect the AI model deployed therein;
receive a list of AI model identifiers in response to the API query;
generate a representation of the AI model in a security database, the security database including a representation of the computing environment;
detect a first cybersecurity risk respective of the AI model;
inspect the computing environment for a cybersecurity object;
determine that the AI model is exposed to a toxic combination cybersecurity risk based on the detected first cybersecurity risk and the cybersecurity object; and
initiate a mitigation action based on the toxic combination cybersecurity risk.
12. A system for detecting a combined cybersecurity risk for an artificial intelligence (AI) model comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
inspect a computing environment for an AI model deployed therein by querying an application programming interface (API) of the computing environment to detect the AI model deployed therein;
receive a list of AI model identifiers in response to the API query;
generate a representation of the AI model in a security database, the security database including a representation of the computing environment;
detect a first cybersecurity risk respective of the AI model;
inspect the computing environment for a cybersecurity object;
determine that the AI model is exposed to a toxic combination cybersecurity risk based on the detected first cybersecurity risk and the cybersecurity object; and
initiate a mitigation action based on the toxic combination cybersecurity risk.
13. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate the mitigation action further based on any one of:
the first cybersecurity risk, the cybersecurity object, and a combination thereof.
14. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate an inspectable disk based on an original disk of a resource deployed in the computing environment; and
inspect the inspectable disk for any one of:
the AI model, the cybersecurity object, and a combination thereof.
15. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect an artifact of the AI model on the inspectable disk.
16. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
inspect the AI model to detect an AI model configured to execute a code object.
17. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect a metadata of the AI model, wherein the metadata indicates that the AI model is a cybersecurity risk.
18. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect in the AI model any one of:
a secret, a certificate, a code, and any combination thereof.
19. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
apply a policy on the representation of the computing environment.
20. The system of claim 19 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate the mitigation action based on the policy.
21. The system of claim 12 , wherein the cybersecurity object indicates any one of:
a vulnerability, an exposure, a misconfiguration, and a combination thereof.