Non-intrusive techniques for discovering and using organizational relationships

A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• non-intrusively searching for information that is indicative of a relationship between a company and a vendor, wherein the vendor and the company are different entities, wherein non-intrusively searching for information comprises:
• obtaining network data, wherein the network data is generated by taking snapshots of portions of an Internet;
• applying searches to the network data for specific device fingerprints within a network footprint of the company;
• determining, based on searching the network data for specific device fingerprints, a presence of signatures and patterns for specific device fingerprints known to be associated with a particular firewall software provider, wherein the particular firewall software provider is associated with the company;
• and
• identifying the information that is indicative of a relationship between the company and the vendor based on determining the presence of signatures and patterns for specific device fingerprints;
• combining, based on the information that is indicative of a relationship between the company and the vendor, first information corresponding to a website attributable to the vendor and second information corresponding to the company to generate a candidate universal resource locator (URL), wherein the candidate URL is generated based on at least one of a plurality of URL templates generated with a template generation block comprising a search engine;
• and
• validating whether the candidate URL resolves to a second website that is valid and attributable to the vendor, wherein the validating is based on whether the second website includes an indication that the company uses a service offered by the vendor wherein the validating comprises:
• using a machine learning algorithm to prune false positives from a set of candidate URLs that includes the candidate URL;
• calculating a cutoff point based on a total count of candidate URLs included in the set of candidate URLs as a fraction of a list for the same template;
• and
• validating URL templates based on a dynamically configured threshold, wherein the threshold is dynamically configured based on historical data analysis associated with URL templates and candidate URLs, and wherein the threshold is dynamically adjusted based on changes in counts and changes in a determined number of relationships over time for the vendor;
• modeling the relationship between the company and the vendor in a graph of an Internet ecosystem based on an output of validating whether the candidate URL resolves to a second website that is valid and attributable to the vendor;
• in response to validation of the candidate URL:
• adjusting, based on the graph of the Internet ecosystem, a cybersecurity risk score of the company based on a cybersecurity posture for the vendor;
• and
• in response to adjusting the cybersecurity risk score of the company based on the cybersecurity posture for the vendor, proactively preventing a cybersecurity risk;
• in response to a failure to validate the candidate URL:
• maintaining the cybersecurity risk score of the company.

A system for adjusting cybersecurity risk scores of companies based on cybersecurity postures of vendors, the system comprising:

• a memory;
• and
• one or more processors coupled to the memory, the one or more processors configured to:
• non-intrusively search for information that is indicative of a relationship between a company and a vendor, wherein the vendor and the company are different entities, wherein non-intrusively searching for information comprises:
• obtaining network data, wherein the network data is generated by taking snapshots of portions of an Internet;
• applying searches to the network data for specific device fingerprints within a network footprint of the company;
• determining, based on searching the network data for specific device fingerprints, a presence of signatures and patterns for specific device fingerprints known to be associated with a particular content delivery network, wherein the particular content delivery network is associated with the company;
• and
• identifying the information that is indicative of a relationship between the company and the vendor based on determining the presence of signatures and patterns for specific device fingerprints;
• combine, based on the information that is indicative of a relationship between the company and the vendor, first information corresponding to a website attributable to the vendor and second information corresponding to the company to generate a candidate universal resource locator (URL), wherein the candidate URL is generated based on at least one of a plurality of URL templates;
• validate whether the candidate URL resolves to a second website that is valid and attributable to the vendor, wherein the validating is based on whether the second website includes an indication that the company uses a service offered by the vendor, wherein the validating comprises:
• using a first machine learning algorithm to prune false positives from a set of candidate URLs that includes the candidate URL;
• calculating a cutoff point based on a total count of candidate URLs included in the set of candidate URLs as a fraction of a list for the same template;
• and
• validating URL templates based on a dynamically configured threshold, wherein the threshold is dynamically configured by a second machine learning algorithm based on historical data analysis associated with URL templates and candidate URLs, and wherein the threshold is dynamically adjusted based on changes in counts and changes in a determined number of relationships over time for the vendor;
• wherein the validating is further based on analysis of source code of the second website, image content of the second website, text content of the second website, or a combination thereof to determine a presence of patterns for fingerprints known to be associated with at least one of a particular firewall hardware or a particular software provider;
• modeling the relationship between the company and the vendor in a graph of an Internet ecosystem based on an output of validating whether the candidate URL resolves to a second website that is valid and attributable to the vendor;
• in response to validation of the candidate URL:
• adjust, based on the graph of the Internet ecosystem, a cybersecurity risk score of the company based on a cybersecurity posture for the vendor;
• and
• in response to adjusting the cybersecurity risk score of the company based on the cybersecurity posture for the vendor, proactively preventing a cybersecurity risk;
• in response to a failure to validate the candidate URL:
• maintain the cybersecurity risk score of the company.