Detecting vulnerabilities in virtual instances in a cloud environment utilizing infrastructure as code

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• extracting a code object, of a deployment code, from a state file, the state file including a mapping between the code object to a first workload deployed in the cloud computing environment and a second workload deployed in the cloud computing environment;
• generating a node representing the code object in the security graph, wherein the security graph includes a representation of the cloud computing environment;
• generating a connection in the security graph between the node representing the code object and a node representing the first workload;
• generating a connection in the security graph between the node representing the code object and a node representing the second workload;
• and
• determining that the second workload is a vulnerable workload which includes a cybersecurity threat, in response to detecting that the first workload node is associated with a cybersecurity threat, and that the node representing the second workload and the node representing the first workload are each connected to the node representing the code object.

A system for detecting a vulnerable workload deployed from an object in code in a cloud computing environment, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• extract a code object, of a deployment code, from a state file, the state file including a mapping between the code object to a first workload deployed in the cloud computing environment and a second workload deployed in the cloud computing environment;
• generate a node representing the code object in the security graph, wherein the security graph includes a representation of the cloud computing environment;
• generate a connection in the security graph between the node representing the code object and a node representing the first workload;
• generate a connection in the security graph between the node representing the code object and a node representing the second workload;
• and
• determine that the second workload is a vulnerable workload which includes a cybersecurity threat, in response to detecting that the first workload node is associated with a cybersecurity threat, and that the node representing the second workload and the node representing the first workload are each connected to the node representing the code object.