# US 12,003,520 B1 · Techniques for multi-tenant vulnerability scanning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,520 B1 - Document ID: US12003520B1 - Status: Granted - Kind: B1 - Application number: 18/468,149 - Filed: 2023-09-15 - Granted: 2024-06-04 - Earliest claimed: 2020-12-09 - Assignees: Wiz, Inc. - Applicants: Wiz, Inc. - Inventors: Yarin Miran; Ami Luttwak; Roy Reznik; Avihai Berkovitz; Moran Cohen; Yaniv Shaked; Yaniv Joseph Oliver - Web page: https://patentgrep.com/patent/US12003520B1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 9/5011: {the resources being hardware resources other than CPUs, Servers and Terminals} - G06F 9/505: {considering the load} - G06F 9/5061: {Partitioning or combining of resources} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for scalable vulnerability detection is provided. The method includes selecting at least a workload of a plurality of workloads deployed in a first cloud environment for inspection, wherein the workload includes a first volume; generating in a remote cluster an inspection node, the inspection node including at least a first disk, wherein the remote cluster provisions inspection nodes in response to demand for inspection nodes; generating a persistent volume (PV) on which the at least a first disk is mounted, wherein the at least a first disk is generated from a snapshot of the first volume; and generating a persistent volume claim (PVC) of the PV for an inspector workload, wherein the inspector workload is configured to inspect the PV for an object, and wherein inspector workloads are provisioned in response to demand for inspector workloads. ## Claims ### Claim 1 A method for scalable vulnerability detection, comprising: selecting a workload of a plurality of workloads deployed in a first cloud environment for inspection, wherein the workload includes a first disk; generating in a remote orchestration system an inspection node, the inspection node including an inspection disk, wherein the inspection node is provisioned in response to demand for an inspection node; generating a volume on which the inspection disk is mounted, wherein the inspection disk is generated from the first disk; providing access to the volume for the inspection node; and inspecting the volume for an object, the object indicating a vulnerability. ### Claim 2 (depends on 1) The method of claim 1 wherein the object is any one of: a container, a virtual machine, a serverless function, a network component, a certificate, a key, a secret, and a user account. ### Claim 3 (depends on 1) The method of claim 1, further comprising: generating a remote orchestration system, in response to determining that the remote orchestration system is not deployed. ### Claim 4 (depends on 1) The method of claim 1, further comprising: providing access to the volume for a second inspector, wherein the second inspector is configured to inspect the volume for a second object, wherein the second object is different from the object. ### Claim 5 (depends on 1) The method of claim 1, further comprising: detecting the object on the volume; and generating a node in a security database corresponding to the object, in response to detecting the object in the volume. ### Claim 6 (depends on 1) The method of claim 1, further comprising: querying a database to determine what workloads should be inspected, wherein the database includes any one of: a workload identifier, a remote orchestration identifier, a network address, and a combination thereof. ### Claim 7 A non-transitory computer-readable medium storing a set of instructions for scalable vulnerability detection, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the device to: select a workload of a plurality of workloads deployed in a first cloud environment for inspection, wherein the workload includes a first disk; generate in a remote orchestration system an inspection node, the inspection node including an inspection disk, wherein the inspection node is provisioned in response to demand for an inspection node; generate a volume on which the inspection disk is mounted, wherein the inspection disk is generated from the first disk; provide access to the volume for the inspection node; and inspecting the volume for an object, the object indicating a vulnerability. ### Claim 8 A system for scalable vulnerability detection comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: select a workload of a plurality of workloads deployed in a first cloud environment for inspection, wherein the workload includes a first disk; generate in a remote orchestration system an inspection node, the inspection node including an inspection disk, wherein the inspection node is provisioned in response to demand for an inspection node; generate a volume on which the inspection disk is mounted, wherein the inspection disk is generated from the first disk; provide access to the volume for the inspection node; and inspect the volume for an object, the object indicating a vulnerability. ### Claim 9 (depends on 8) The system of claim 8, wherein the object is any one of: a container, a virtual machine, a serverless function, a network component, a certificate, a key, a secret, and a user account. ### Claim 10 (depends on 8) The system of claim 8, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate a remote orchestration system, in response to determining that the remote orchestration system is not deployed. ### Claim 11 (depends on 8) The system of claim 8, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: provide access to the volume for a second inspector, wherein the second inspector is configured to inspect the volume for a second object, wherein the second object is different from the object. ### Claim 12 (depends on 8) The system of claim 8, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect the object on the volume; and generate a node in a security database corresponding to the object, in response to detecting the object in the volume. ### Claim 13 (depends on 8) The system of claim 8, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: query a database to determine what workloads should be inspected, wherein the database includes any one of: a workload identifier, a remote orchestration identifier, a network address, and a combination thereof.