# US 12,003,529 B1 · Techniques for detecting artificial intelligence model cybersecurity risk in a computing environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,529 B1 - Document ID: US12003529B1 - Status: Granted - Kind: B1 - Application number: 18/584,659 - Filed: 2024-02-22 - Granted: 2024-06-04 - Earliest claimed: 2024-02-22 - Assignees: Wiz, Inc. - Applicants: Wiz, Inc. - Inventors: Amitai Cohen; Barak Sharoni; Shir Tamari; George Pisha; Itay Arbel; Daniel Velikanski; Yaniv Shaked - Web page: https://patentgrep.com/patent/US12003529B1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for detecting a cybersecurity risk of an artificial intelligence (AI), is presented. The method includes: inspecting a computing environment for an AI model deployed therein; generating a representation of the AI model in a security database, the security database including a representation of the computing environment; inspecting the AI model for a cybersecurity risk; generating a representation of the cybersecurity risk in the security database, the representation of the cybersecurity risk connected to the representation of the AI model in response to detecting the cybersecurity risk; and initiating a mitigation action based on the cybersecurity risk. ## Claims ### Claim 1 A method for detecting a cybersecurity risk of an artificial intelligence (AI), comprising: generating an inspectable disk based on an original disk of a resource deployed in a computing environment; inspecting the inspectable disk for an AI model; generating a representation of the AI model in a security database, the security database including a representation of the computing environment; inspecting the AI model for a cybersecurity risk; generating a representation of the cybersecurity risk in the security database, the representation of the cybersecurity risk connected to the representation of the AI model in response to detecting the cybersecurity risk; and initiating a mitigation action based on the cybersecurity risk. ### Claim 2 (depends on 1) The method of claim 1, further comprising: detecting an artifact of the AI model on the inspectable disk. ### Claim 3 (depends on 1) The method of claim 1, further comprising: inspecting the AI model to detect an AI model configured to execute a code object. ### Claim 4 (depends on 1) The method of claim 1, further comprising: detecting a metadata of the AI model, wherein the metadata indicates that the AI model is a cybersecurity risk. ### Claim 5 (depends on 1) The method of claim 1, further comprising: detecting in the AI model any one of: a secret, a certificate, a code, and any combination thereof. ### Claim 6 (depends on 1) The method of claim 1, further comprising: generating a lateral movement path, wherein the lateral movement path includes the AI model, and a representation of a resource, wherein the resource is accessible utilizing the AI model. ### Claim 7 (depends on 1) The method of claim 1, further comprising: applying a policy on the representation of the computing environment. ### Claim 8 (depends on 7) The method of claim 7, further comprising: initiating the mitigation action based on the policy. ### Claim 9 A non-transitory computer-readable medium storing a set of instructions for detecting a cybersecurity risk of an artificial intelligence (AI), the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the device to: generate an inspectable disk based on an original disk of a resource deployed in a computing environment; inspect the inspectable disk for an AI model; generate a representation of the AI model in a security database, the security database including a representation of the computing environment; inspect the AI model for a cybersecurity risk; generate a representation of the cybersecurity risk in the security database, the representation of the cybersecurity risk connected to the representation of the AI model in response to detecting the cybersecurity risk; and initiate a mitigation action based on the cybersecurity risk. ### Claim 10 A system for detecting a cybersecurity risk of an artificial intelligence (AI) comprising: a processing circuitry; a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: generate an inspectable disk based on an original disk of a resource deployed in a computing environment; inspect the inspectable disk for an AI model; generate a representation of the AI model in a security database, the security database including a representation of the computing environment; inspect the AI model for a cybersecurity risk; generate a representation of the cybersecurity risk in the security database, the representation of the cybersecurity risk connected to the representation of the AI model in response to detecting the cybersecurity risk; and initiate a mitigation action based on the cybersecurity risk. ### Claim 11 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect an artifact of the AI model on the inspectable disk. ### Claim 12 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: inspect the AI model to detect an AI model configured to execute a code object. ### Claim 13 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect a metadata of the AI model, wherein the metadata indicates that the AI model is a cybersecurity risk. ### Claim 14 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect in the AI model any one of: a secret, a certificate, a code, and any combination thereof. ### Claim 15 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate a lateral movement path, wherein the lateral movement path includes the AI model, and a representation of a resource, wherein the resource is accessible utilizing the AI model. ### Claim 16 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: apply a policy on the representation of the computing environment. ### Claim 17 (depends on 16) The system of claim 16, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: initiate the mitigation action based on the policy.