Granted Patent B1

US 12,401,683 · App. 18/647,876 · Granted Aug 26, 2025

Inventors: Amitai Cohen (Kfar Saba, IL); Barak Sharoni (Tel Aviv, IL); Shir Tamari (Tel Aviv, IL); George Pisha (Giv'atayim, IL); Itay Arbel (Tel Aviv, IL); Daniel Velikanski (Tel Aviv, IL); Yaniv Shaked (Tel Aviv, IL)

Assignee: Wiz, Inc.

H04L63/1441H04L63/1433

Abstract

Claims (55)

1. A method for detecting a cybersecurity risk of an artificial intelligence (AI), comprising:

inspecting a resource in a computing environment for an AI model deployed therein;

cloning an original disk of the resource deployed in the computing environment into a cloned disk;

inspecting the cloned disk for the AI model;

generating a representation of the AI model in a security database, the security database including a representation of the computing environment;

inspecting the AI model for a cybersecurity object, the cybersecurity object indicating a cybersecurity issue;

generating a representation of the cybersecurity object in the security database, the representation of the cybersecurity object connected to the representation of the AI model in response to detecting the cybersecurity object; and

initiating a mitigation action based on the cybersecurity issue.

2. The method of claim 1 , further comprising:

detecting an artifact of the AI model on the cloned disk.

3. The method of claim 1 , further comprising:

inspecting the AI model for an executable code object.

4. The method of claim 1 , further comprising:

detecting a metadata of the AI model, wherein the metadata indicates that the AI model includes a cybersecurity issue.

5. The method of claim 1 , further comprising:

detecting in the AI model any one of: a secret, a certificate, an executable code, and any combination thereof.

6. The method of claim 1 , further comprising:

generating a lateral movement path, wherein the lateral movement path includes the AI model, and a representation of another resource, wherein the another resource is accessible utilizing the AI model.

7. The method of claim 1 , further comprising:

applying a policy on the representation of the computing environment.

8. The method of claim 7 , further comprising:

initiating the mitigation action based on the policy.

9. A non-transitory computer-readable medium storing a set of instructions for detecting a cybersecurity risk of an artificial intelligence (AI), the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

inspect a resource in a computing environment for an AI model deployed therein;

clone an original disk of the resource deployed in the computing environment into a cloned disk;

inspect the cloned disk for the AI model;

generate a representation of the AI model in a security database, the security database including a representation of the computing environment;

inspect the AI model for a cybersecurity object, the cybersecurity object indicating a cybersecurity issue;

generate a representation of the cybersecurity object in the security database, the representation of the cybersecurity object connected to the representation of the AI model in response to detecting the cybersecurity object; and

initiate a mitigation action based on the cybersecurity issue.

10. A system for detecting a cybersecurity risk of an artificial intelligence (AI) comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

inspect a resource in a computing environment for an AI model deployed therein;

clone an original disk of the resource deployed in the computing environment into a cloned disk;

inspect the cloned disk for the AI model;

generate a representation of the AI model in a security database, the security database including a representation of the computing environment;

inspect the AI model for a cybersecurity object, the cybersecurity object indicating a cybersecurity issue;

generate a representation of the cybersecurity object in the security database, the representation of the cybersecurity object connected to the representation of the AI model in response to detecting the cybersecurity object; and

initiate a mitigation action based on the cybersecurity issue.

11. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect an artifact of the AI model on the cloned disk.

12. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

inspect the AI model for an executable code object.

13. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect a metadata of the AI model, wherein the metadata indicates that the AI model includes a cybersecurity issue.

14. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect in the AI model any one of: a secret, a certificate, an executable code, and any combination thereof.

15. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate a lateral movement path, wherein the lateral movement path includes the AI model, and a representation of another resource, wherein the another resource is accessible utilizing the AI model.

16. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

apply a policy on the representation of the computing environment.

17. The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate the mitigation action based on the policy.

Continuity (1)

References Cited (70)