Cybersecurity vulnerability validation techniques utilizing runtime data, static analysis and dynamic inspection

1. A method for validating cybersecurity issues utilizing runtime data, comprising:

inspecting a workload deployed in a computing environment for a cybersecurity issue using at least a static analysis technique;

deploying a sensor on the workload, the sensor configured to collect runtime data from the workload;

determining reachability properties of the workload;

generating a network path between an external network and the workload;

initiating active inspection of the network path to determine if the workload is a reachable workload;

initiating a first mitigation action with a first priority in the computing environment in response to validating the cybersecurity issue from the collected runtime data; and

initiating a second mitigation action with a second priority, which is lower than the first priority, in response to failing to validate the cybersecurity issue from the collected runtime data and determining that the workload is not a reachable workload.

2. The method of claim 1 , further comprising:

generating an inspectable disk based on a disk of the workload; and

inspecting the inspectable disk for a cybersecurity object, wherein the cybersecurity object indicates the cybersecurity issue.

3. The method of claim 1 , further comprising:

initiating the first mitigation action with a third priority, higher than the first priority, in response to determining that the workload is a reachable workload.

4. The method of claim 1 , further comprising:

configuring the sensor to collect: an artifact, an event, a datalink layer communication, a permission, a list of applications loaded in memory, a list of libraries loaded in memory, and a combination thereof.

5. The method of claim 1 , further comprising:

initiating the first mitigation action including any one of: generating an alert, revoking a permission, revoking access to a workload, revoking access from a workload, sandboxing a workload, generating an alert, installing a software patch, uninstalling a software application, updating a priority of an alert, and any combination thereof.

6. A non-transitory computer-readable medium storing a set of instructions for validating cybersecurity issues utilizing runtime data, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

inspect a workload deployed in a computing environment for a cybersecurity issue using at least a static analysis technique;

deploy a sensor on the workload, the sensor configured to collect runtime data from the workload;

determine reachability properties of the workload;

generate a network path between an external network and the workload;

initiate active inspection of the network path to determine if the workload is a reachable workload;

initiate a first mitigation action with a first priority in the computing environment in response to validating the cybersecurity issue from the collected runtime data; and

initiate a second mitigation action with a second priority, which is lower than the first priority, in response to failing to validate the cybersecurity issue from the collected runtime data and determining that the workload is not a reachable workload.

7. A system for validating cybersecurity issues utilizing runtime data comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

inspect a workload deployed in a computing environment for a cybersecurity issue using at least a static analysis technique;

deploy a sensor on the workload, the sensor configured to collect runtime data from the workload;

determine reachability properties of the workload;

generate a network path between an external network and the workload;

initiate active inspection of the network path to determine if the workload is a reachable workload;

initiate a first mitigation action with a first priority in the computing environment in response to validating the cybersecurity issue from the collected runtime data; and

initiate a second mitigation action with a second priority, which is lower than the first priority, in response to failing to validate the cybersecurity issue from the collected runtime data and determining that the workload is not a reachable workload.

8. The system of claim 7 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate an inspectable disk based on a disk of the workload; and

inspect the inspectable disk for a cybersecurity object, wherein the cybersecurity object indicates the cybersecurity issue.

9. The system of claim 7 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate the first mitigation action with a third priority, higher than the first priority, in response to determining that the workload is a reachable workload.

10. The system of claim 7 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

configure the sensor to collect:

an artifact, an event, a datalink layer communication, a permission, a list of applications loaded in memory, a list of libraries loaded in memory, and a combination thereof.

11. The system of claim 7 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate the first mitigation action including any one of:

generate an alert, revoking a permission, revoking access to a workload, revoking access from a workload, sandboxing a workload, generating an alert, installing a software patch, uninstalling a software application, updating a priority of an alert, and any combination thereof.