# US 12,001,585 B2 · System and method for agentless detection of sensitive data in computing environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,585 B2 - Document ID: US12001585B2 - Status: Granted - Kind: B2 - Application number: 18/049,093 - Filed: 2022-10-24 - Published: 2024-03-28 - Granted: 2024-06-04 - Earliest claimed: 2022-09-28 - Assignees: Wiz, Inc. - Applicants: Wiz, Inc. - Inventors: Raaz Herzberg; Avi Tal Lichtenstein; Roy Reznik; Ami Luttwak; Moran Cohen; Yaniv Shaked; Yinon Costica; George Pisha - Web page: https://patentgrep.com/patent/US12001585B2 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 16/906: Clustering; Classification - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for agentless detection of sensitive data in a cloud computing environment. The method includes detecting a first data object including a data schema and a content in a cloud computing environment; detecting a second data object, having the data schema of the first data object; generating in a security graph: a first data object node representing the first data object, a second data object node representing the second data object, and a data schema node representing the data schema; storing a classification based on the content in the security graph, wherein the content is classified as sensitive data or non-sensitive data; and rendering an output based on the classification and the data schema node, in lieu of the first data object node and the second data object node, in response to receiving a query to detect a node representing a data object classified as sensitive data. ## Claims ### Claim 1 A method for agentless detection of sensitive data in a cloud computing environment and rendering the same for display, comprising: detecting a first data object in a first cloud computing environment, the first data object including a data schema and content; detecting a second data object in a second cloud computing environment, the second cloud computing environment associated with the first cloud computing environment, the second data object having the data schema of the first data object, wherein the first data object and the second data object are generated based on the data schema, the data schema including a plurality of integrity constraints; generating in a security graph hosted on a graph database: a first data object node representing the first data object, a second data object node representing the second data object, and a data schema node representing the data schema, wherein the security graph further includes a representation of the first cloud computing environment; storing a classification based on the content in the security graph, wherein the content is classified as either sensitive data or non-sensitive data; rendering an output based on the classification and the data schema node, in lieu of the first data object node and the second data object node, in response to receiving a query to detect a node representing a data object classified as sensitive data; generating a first cluster node in the security graph, the first cluster node representing a plurality of data objects having a shared data schema, each data object represented by a node in the security graph, wherein each data object is deployed in the cloud computing environment; and generating a second cluster node in the security graph, the second cluster node representing a second plurality of data objects having the shared data schema, each data object represented by a node in the security graph, wherein each data object is deployed in another cloud computing environment, associated with the cloud computing environment. ### Claim 2 (depends on 1) The method of claim 1, wherein the cloud computing environment is a production environment, and the another cloud computing environment is any one of: a development environment, a test environment, and a staging environment. ### Claim 3 (depends on 1) The method of claim 1, further comprising: generating the classification further based on any one of: metadata of the first data, the data schema, the content, and a combination thereof. ### Claim 4 (depends on 1) The method of claim 1, further comprising: extracting from the first data object a file header, and a plurality of data blocks. ### Claim 5 (depends on 1) The method of claim 1, further comprising: classifying sensitive data further as any one of: personal identifiable information (PII), personal health information (PHI), payment card industry (PCI), and any combination thereof. ### Claim 6 (depends on 1) The method of claim 1, wherein the first data object is a file associated with a distributed database. ### Claim 7 (depends on 1) The method of claim 1, wherein the first data object is stored on a storage service of a cloud computing platform on which the cloud computing environment is hosted. ### Claim 8 (depends on 1) The method of claim 1, further comprising: initiating a mitigation action in response to determining that the content is classified as sensitive data. ### Claim 9 (depends on 8) The method of claim 8, further comprising: initiating the mitigation action in further response to determining that the content is deployed on a data object in a cloud computing environment which is unauthorized for storing sensitive data. ### Claim 10 (depends on 8) The method of claim 8, further comprising: generating an instruction which, when executed configures a storage service to delete the first data object, in response to initiating the mitigation action. ### Claim 11 A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising: detecting a first data object in a first cloud computing environment, the first data object including a data schema and content; detecting a second data object in a second cloud computing environment, the second cloud computing environment associated with the first cloud computing environment, the second data object having the data schema of the first data object, wherein the first data object and the second data object are generated based on the data schema, the data schema including a plurality of integrity constraints; generating in a security graph hosted on a graph database: a first data object node representing the first data object, a second data object node representing the second data object, and a data schema node representing the data schema, wherein the security graph further includes a representation of the first cloud computing environment; storing a classification based on the content in the security graph, wherein the content is classified as either sensitive data or non-sensitive data; and rendering an output based on the classification and the data schema node, in lieu of the first data object node and the second data object node, in response to receiving a query to detect a node representing a data object classified as sensitive data; generating a first cluster node in the security graph, the first cluster node representing a plurality of data objects having a shared data schema, each data object represented by a node in the security graph, wherein each data object is deployed in the cloud computing environment; and generating a second cluster node in the security graph, the second cluster node representing a second plurality of data objects having the shared data schema, each data object represented by a node in the security graph, wherein each data object is deployed in another cloud computing environment, associated with the cloud computing environment. ### Claim 12 A system for agentless detection of sensitive data in a cloud computing environment and rendering the same for display, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: detect a first data object in a first cloud computing environment, the first data object including a data schema and content; detect a second data object in a second cloud computing environment, the second cloud computing environment associated with the first cloud computing environment, the second data object having the data schema of the first data object, wherein the first data object and the second data object are generated based on the data schema, the data schema including a plurality of integrity constraints; generate in a security graph hosted on a graph database: a first data object node representing the first data object, a second data object node representing the second data object, and a data schema node representing the data schema, wherein the security graph further includes a representation of the first cloud computing environment; store a classification based on the content in the security graph, wherein the content is classified as either sensitive data or non-sensitive data; and render an output based on the classification and the data schema node, in lieu of the first data object node and the second data object node, in response to receiving a query to detect a node representing a data object classified as sensitive data; generating a first cluster node in the security graph, the first cluster node representing a plurality of data objects having a shared data schema, each data object represented by a node in the security graph, wherein each data object is deployed in the cloud computing environment; and generating a second cluster node in the security graph, the second cluster node representing a second plurality of data objects having the shared data schema, each data object represented by a node in the security graph, wherein each data object is deployed in another cloud computing environment, associated with the cloud computing environment. ### Claim 13 (depends on 11) The system of claim 11, wherein the cloud computing environment is a production environment, and the another cloud computing environment is any one of: a development environment, a test environment, and a staging environment. ### Claim 14 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate the classification further based on any one of: metadata of the first data, the data schema, the content, and a combination thereof. ### Claim 15 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: extract from the first data object a file header, and a plurality of data blocks. ### Claim 16 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: classify sensitive data further as any one of: personal identifiable information (PII), personal health information (PHI), payment card industry (PCI), and any combination thereof. ### Claim 17 (depends on 12) The system of claim 12, wherein the first data object is a file associated with a distributed database. ### Claim 18 (depends on 12) The system of claim 12, wherein the first data object is stored on a storage service of a cloud computing platform on which the cloud computing environment is hosted. ### Claim 19 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: initiate a mitigation action in response to determining that the content is classified as sensitive data. ### Claim 20 (depends on 19) The system of claim 19, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: determine that the content is deployed on a data object in a cloud computing environment which is unauthorized for storing sensitive data; and initiating the mitigation action in response to the determination that the content is deployed on a data object in a cloud computing environment which is unauthorized for storing sensitive data. ### Claim 21 (depends on 19) The system of claim 19, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate an instruction which, when executed configures a storage service to delete the first data object, in response to initiating the mitigation action. ### Claim 22 (depends on 1) The method of claim 1, further comprising: receiving a query to detect a node representing a data object classified as sensitive data; and determining that the first data object includes sensitive data, based on the data schema and the content.