# US 12,120,144 B2 · Determining the exposure level of vulnerabilities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,144 B2 - Document ID: US12120144B2 - Status: Granted - Kind: B2 - Application number: 18/495,027 - Filed: 2023-10-26 - Published: 2024-02-15 - Granted: 2024-10-15 - Earliest claimed: 2021-04-29 - Assignees: Google Inc. - Applicants: Google LLC - Inventors: Sebastian Lekies; Jean-Baptiste Cid - Web page: https://patentgrep.com/patent/US12120144B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/105: {Multiple levels of security} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method includes receiving a scan request requesting to scan a set of network-connected assets designated for a network scan. For each respective network-connected asset, the method includes scanning, at a network security scanner using a first scanning privilege level, the respective network-connected asset. The method includes determining, based on the scan using the first scanning privilege level, whether the respective network-connected asset has a vulnerability. In response, the method includes scanning, at the network security scanner using a second scanning privilege level, the respective network-connected asset. The second scanning privilege level defines a lower level of access the network security scanner has than the first scanning privilege level. The method includes determining, based on the scans, an exposure level of the vulnerability. The method includes reporting the exposure level of the vulnerability to a user of the respective network-connected asset. ## Claims ### Claim 1 A computer-implemented method when executed by data processing hardware causes the data processing hardware to perform operations comprising: scanning, using a first scanning privilege level, a plurality of network-connected assets for a first vulnerability; detecting, based on the scan using the first scanning privilege level, the first vulnerability at at least one network-connected asset of the plurality of network-connected assets; in response to detecting the first vulnerability at the at least one network-connected asset of the plurality of network-connected assets, scanning, using a second scanning privilege level, only the at least one network-connected asset of the plurality of network-connected assets for a second vulnerability; detecting, based on the scan using the second scanning privilege level, the second vulnerability at a first network-connected asset of the at least one network-connected asset; in response to detecting the second vulnerability at the first network-connected asset, determining that the first network-connected asset has a first exposure level; determining, based on the scan using the second scanning privilege level, that a second network-connected asset of the at least one network-connected asset does not comprise the second vulnerability; in response to determining that the second network-connected asset does not comprise the second vulnerability, determining that the second network-connected asset has a second exposure level that is different from the first exposure level; and reporting the first exposure level of the first network-connected asset and the second exposure level of the second network-connected asset to a user of the plurality of network-connected assets. ### Claim 2 (depends on 1) The method of claim 1, wherein the first scanning privilege level and the second scanning privilege level are each associated with a different respective network location. ### Claim 3 (depends on 2) The method of claim 2, wherein the respective network location associated with the first scanning privilege level comprises an internal network location. ### Claim 4 (depends on 2) The method of claim 2, wherein the respective network location associated with the second scanning privilege level comprises an external network location. ### Claim 5 (depends on 1) The method of claim 1, wherein the first scanning privilege level comprises a firewall bypass of a firewall associated with the plurality of network-connected assets. ### Claim 6 (depends on 1) The method of claim 1, wherein the first scanning privilege level and the second scanning privilege level are among a plurality of scanning privilege levels each defining a different level of access a network security scanner has to the plurality of network-connected assets. ### Claim 7 (depends on 6) The method of claim 6, wherein at least one of the plurality of scanning privilege levels comprises access credentials providing access to a resource of one network-connected asset of the plurality of network-connected assets. ### Claim 8 (depends on 1) The method of claim 1, wherein the first vulnerability is different from the second vulnerability. ### Claim 9 (depends on 1) The method of claim 1, wherein the operations further comprise performing, based on the first exposure level of the first network-connected asset, a remedial action to mitigate the first vulnerability and the second vulnerability. ### Claim 10 (depends on 1) The method of claim 1, wherein the operations further comprise, in response to determining that the second network-connected asset does not comprise the second vulnerability, halting any further scanning of the second network-connected asset. ### Claim 11 A system comprising: data processing hardware; and memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising: scanning, using a first scanning privilege level, a plurality of network-connected assets for a first vulnerability; detecting, based on the scan using the first scanning privilege level, the first vulnerability at at least one network-connected asset of the plurality of network-connected assets; in response to detecting the first vulnerability at the at least one network-connected asset of the plurality of network-connected assets, scanning, using a second scanning privilege level, only the at least one network-connected asset of the plurality of network-connected assets for a second vulnerability; detecting, based on the scan using the second scanning privilege level, the second vulnerability at a first network-connected asset of the at least one network-connected asset; in response to detecting the second vulnerability at the first network-connected asset, determining that the first network-connected asset has a first exposure level; determining, based on the scan using the second scanning privilege level, that a second network-connected asset of the at least one network-connected asset does not comprise the second vulnerability; in response to determining that the second network-connected asset does not comprise the second vulnerability, determining that the second network-connected asset has a second exposure level that is different from the first exposure level; and reporting the first exposure level of the first network-connected asset and the second exposure level of the second network-connected asset to a user of the plurality of network-connected assets. ### Claim 12 (depends on 11) The system of claim 11, wherein the first scanning privilege level and the second scanning privilege level are each associated with a different respective network location. ### Claim 13 (depends on 12) The system of claim 12, wherein the respective network location associated with the first scanning privilege level comprises an internal network location. ### Claim 14 (depends on 12) The system of claim 12, wherein the respective network location associated with the second scanning privilege level comprises an external network location. ### Claim 15 (depends on 11) The system of claim 11, wherein the first scanning privilege level comprises a firewall bypass of a firewall associated with the plurality of network-connected assets. ### Claim 16 (depends on 11) The system of claim 11, wherein the first scanning privilege level and the second scanning privilege level are among a plurality of scanning privilege levels each defining a different level of access a network security scanner has to the plurality of network-connected assets. ### Claim 17 (depends on 16) The system of claim 16, wherein at least one of the plurality of scanning privilege levels comprises access credentials providing access to a resource of one network-connected asset of the plurality of network-connected assets. ### Claim 18 (depends on 11) The system of claim 11, wherein the first vulnerability is different from the second vulnerability. ### Claim 19 (depends on 11) The system of claim 11, wherein the operations further comprise performing, based on the first exposure level of the first network-connected asset, a remedial action to mitigate the first vulnerability and the second vulnerability. ### Claim 20 (depends on 11) The system of claim 11, wherein the operations further comprise, in response to determining that the second network-connected asset does not comprise the second vulnerability, halting any further scanning of the second network-connected asset.