Agentless runtime cybersecurity analysis

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• identifying a first set of paths to a first asset, wherein each path of the first set of paths is defined with respect to at least one first application programming interface (API) used in order to access the first asset, the first set of paths including a first path which allows for uploading inspection code, a second path which allows for running the inspection code, and a third path which allows for obtaining results of running the inspection code;
• wherein the first set of paths is selected such that at least a portion of the at least one first API is shared with at least a portion of at least one second API of a second set of paths to a second asset, wherein the first set of paths is selected based further on at least one request processing attribute of the at least one first API;
• uploading the inspection code via the first path, wherein the inspection code is configured to analyze runtime behavior with respect to the first asset when executed;
• running the inspection code via the second path, wherein the inspection code includes instructions that, when executed by a processing circuitry, configure the processing circuitry to cause a unique identifier to be attached to the instances of the first asset represented in the data from a plurality of data sources;
• obtaining results of running the inspection code via the third path, wherein the results of running the inspection code include outputs of the inspection code;
• correlating instances of the first asset represented in data from the plurality of data sources in order to verify that the second path leads to the first asset, wherein the data from the plurality of data sources includes the results of running the inspection code;
• and
• analyzing the results of running the inspection code.

A system for cybersecurity analysis, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• identify a first set of paths to a first asset, wherein each path of the first set of paths is defined with respect to at least one first application programming interface (API) used in order to access the first asset, the first set of paths including a first path which allows for uploading inspection code, a second path which allows for running the inspection code, and a third path which allows for obtaining results of running the inspection code;
• wherein the first set of paths is selected such that at least a portion of the at least one first API is shared with at least a portion of at least one second API of a second set of paths to a second asset, wherein the first set of paths is selected based further on at least one request processing attribute of the at least one first API;
• upload the inspection code via the first path, wherein the inspection code is configured to analyze runtime behavior with respect to the first asset when executed;
• run the inspection code via the second path, wherein the inspection code includes instructions that, when executed, cause a unique identifier to be attached to the instances of the first asset represented in the data from a plurality of data sources;
• obtain results of running the inspection code via the third path, wherein the results of running the inspection code include outputs of the inspection code;
• correlate instances of the first asset represented in data from the plurality of data sources in order to verify that the second path leads to the first asset, wherein the data from the plurality of data sources includes the results of running the inspection code;
• and
• analyze the results of running the inspection code.