# US 12,217,079 B2 · Detecting security exceptions across multiple compute environments

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,217,079 B2
- Document ID: US12217079B2
- Status: Granted
- Kind: B2
- Application number: 18/400,705
- Filed: 2023-12-29
- Published: 2024-05-23
- Granted: 2025-02-04
- Earliest claimed: 2022-05-23
- Assignees: Wiz, Inc.
- Applicants: Wiz, Inc.
- Inventors: Daniel Hershko Shemesh; Yarin Miran; Roy Reznik; Ami Luttwak; Yinon Costica; Raaz Herzberg; Yaniv Joseph Oliver; Osher Hazan; Niv Roit Ben David
- Web page: https://patentgrep.com/patent/US12217079B2

## CPC

- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 2009/45562: {Creating, deleting, cloning virtual machine instances}
- G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing}
- G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45591: {Monitoring or debugging support}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and method for applying cybersecurity policies across multiple computing environments is presented. The method includes: generating an inspectable disk from a disk of a first workload deployed in a first computing environment, the computing environment including a cybersecurity policy applicable to a cybersecurity object; detecting the cybersecurity object on the inspectable disk; generating a policy exception; generating a representation of the cybersecurity object and the first workload in a security database, wherein the security database includes a representation of the first computing environment and a representation of a second computing environment which is associated with the first computing environment; detecting in the representation of the second computing environment a representation of a second workload associated with the representation of the first workload; and applying the policy exception to the second workload based on detecting that the second workload is associated with the first workload.

## Claims

### Claim 1

A method for applying cybersecurity policies across multiple computing environments, comprising:
generating an inspectable disk from a disk of a first workload deployed in a first computing environment, the computing environment including a cybersecurity policy applicable to a cybersecurity object;
detecting the cybersecurity object on the inspectable disk;
generating a policy exception based on the cybersecurity object and the first workload;
generating a representation of the cybersecurity object and the first workload in a security database, wherein the security database includes a representation of the first computing environment and a representation of a second computing environment which is associated with the first computing environment;
detecting in the representation of the second computing environment a representation of a second workload associated with the representation of the first workload;
applying the policy exception to the second workload based on detecting that the second workload is associated with the first workload;
traversing a security graph to find a first node representing the first workload, wherein the security graph is the representation in the security database; and
traversing the security graph to find a second node representing the second workload.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
detecting a first code object in a configuration code file, the configuration code file including a plurality of code objects;
determining that the first workload is deployed based on the first code object; and
applying the generated exception to the first code object.

### Claim 3 (depends on 1)

The method of claim 1, wherein generating the inspectable disk further comprises:
cloning the disk of the workload into a cloned disk.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
releasing the inspectable disk in response to determining that inspection is complete.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
detecting a second cybersecurity object, the second cybersecurity object failing a policy of the first computing environment; and
failing the first workload, in response to detecting the second cybersecurity object.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
detecting in the representation a representation of a first object, the first object deployed in the first computing environment;
detecting in the representation a representation of a second object, the second object deployed in the second computing environment;
detecting in the representation a connection between the representation of the first object and the representation of the second object; and
applying a policy of the first computing environment to the first object and the second object in response to detecting the connection.

### Claim 7

A non-transitory computer-readable medium storing a set of instructions for applying cybersecurity policies across multiple computing environments, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
generate an inspectable disk from a disk of a first workload deployed in a first computing environment, the computing environment including a cybersecurity policy applicable to a cybersecurity object;
detect the cybersecurity object on the inspectable disk;
generate a policy exception based on the cybersecurity object and the first workload;
generate a representation of the cybersecurity object and the first workload in a security database, wherein the security database includes a representation of the first computing environment and a representation of a second computing environment which is associated with the first computing environment;
detect in the representation of the second computing environment a representation of a second workload associated with the representation of the first workload; and
apply the policy exception to the second workload based on detecting that the second workload is associated with the first workload;
traverse a security graph to find a first node representing the first workload, wherein the security graph is the representation in the security database; and
traverse the security graph to find a second node representing the second workload.

### Claim 8

A system for applying cybersecurity policies across multiple computing environments comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
generate an inspectable disk from a disk of a first workload deployed in a first computing environment, the computing environment including a cybersecurity policy applicable to a cybersecurity object;
detect the cybersecurity object on the inspectable disk;
generate a policy exception based on the cybersecurity object and the first workload;
generate a representation of the cybersecurity object and the first workload in a security database, wherein the security database includes a representation of the first computing environment and a representation of a second computing environment which is associated with the first computing environment;
detect in the representation of the second computing environment a representation of a second workload associated with the representation of the first workload; and
apply the policy exception to the second workload based on detecting that the second workload is associated with the first workload;
traverse a security graph to find a first node representing the first workload, wherein the security graph is the representation in the security database; and
traverse the security graph to find a second node representing the second workload.

### Claim 9 (depends on 8)

The system of claim 8, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect a first code object in a configuration code file, the configuration code file including a plurality of code objects;
determine that the first workload is deployed based on the first code object; and
apply the generated exception to the first code object.

### Claim 10 (depends on 8)

The system of claim 8, wherein the memory contains further instructions that, when executed by the processing circuitry for generating the inspectable disk, further configure the system to:
clone the disk of the workload into a cloned disk.

### Claim 11 (depends on 8)

The system of claim 8, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to
release the inspectable disk in response to determining that inspection is complete.

### Claim 12 (depends on 8)

The system of claim 8, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect a second cybersecurity object, the second cybersecurity object failing a policy of the first computing environment; and
fail the first workload, in response to detecting the second cybersecurity object.

### Claim 13 (depends on 8)

The system of claim 8, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect in the representation a representation of a first object, the first object deployed in the first computing environment;
detect in the representation a representation of a second object, the second object deployed in the second computing environment;
detect in the representation a connection between the representation of the first object and the representation of the second object; and
apply a policy of the first computing environment to the first object and the second object in response to detecting the connection.