Method and system to stitch cybersecurity, measure network cyber health, generate business and network risks, enable realtime zero trust verifications, and recommend ordered, predictive risk mitigations

A system, comprising:

• a memory and a processor;
• and
• circuitry configured to:
• collect data from several data sources and generate events;
• label the events in all logs with event labels;
• create uniquely identified IDs for all entities observed in a network across the logs available;
• create a profile for each ID;
• label transference from the events to the entities through temporal and spatial label aggregation;
• extend the profile through generation of new behaviors that leverage raw data logs or existing profile attributes;
• identify one or more profiles of an organization that have changed or exhibited suspicious, malicious, or unexpected behavior to identify one or more risks associated with each profile;
• notify one or more users associated with the one or more profiles based on the one or more risks;
• generate and deliver predictive mitigations to mitigate the one or more risks with recommendations organized for easy implementation due to customization to the sources providing the raw data;
• generate and deliver protected and unprotected scenario simulation results to demonstrate impact of the predictive mitigations or impact of not acting on the predictive mitigations;
• offer a network monitoring and network health improvement system that enables the users with a single, comprehensive overview of the one or more risks in a business and the network sorted by severity of business impact and severity of impact coverage along with the predicted effective mitigation recommendations and automated, proactive execution;
• generate and deliver, sorted by severity, predicted network risks by analyzing ability of security analysts to effectively mitigate the previously predicted risks throuqh proactive action;
• generate and deliver, sorted by severity, predicted network risks by analyzing mitigative actions of security analysts and measurement of effectiveness of those actions;
• generate and deliver newly detected risks as a risk feed to the security analysts as a part of ordered risks real time feed;
• generate and deliver an aggregated, clustered, and categorized view of the risks over similarities;
• enable programmatic, proactive notifications, and on-demand queries through an application programming interface (API) to be leveraged to make real-time zero trust decisions for downstream applications that determine whether to allow user and system access to data, metadata, and services depending on a risk associated with a requesting entity and a risk generated after enabling the access;
• perform an automated search throuqh all the qenerated risks and determine clusters of entities with highest risks and identify key drivers of risks for each of the clusters along with most influential key metrics associated with each of the clusters and the key drivers of risks;
• and
• generate and deliver the most severe risky clusters along with their top drivers of risks and key influencing metrics for each of the drivers through proactive notifications to targeted security analysts and network security teams.