# US 2025/0097201 A1 · Techniques for cybersecurity risk-based firewall configuration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097201 A1 - Document ID: US20250097201A1 - Status: Published application - Kind: A1 - Application number: 18/952,512 - Filed: 2024-11-19 - Published: 2025-03-20 - Earliest claimed: 2023-09-18 - Assignees: Wiz, Inc. - Applicants: Wiz, Inc. - Inventors: Lidor GONSHOROWITZ; Oron NOAH; Ami LUTTWAK; Yinon COSTICA; Roy REZNIK - Web page: https://patentgrep.com/patent/US20250097201A1 ## CPC - H04L 63/0263: {Rule management} - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for providing dynamic network traffic policies is provided. The method includes: inspecting a workload for a cybersecurity object, the cybersecurity object indicating a cybersecurity risk, wherein the workload is deployed in a cloud computing environment having a firewall connected to an external network; detecting the cybersecurity risk on the workload based on the cybersecurity object; generating a policy for the firewall based on the cybersecurity risk; and configuring the firewall to apply the generated policy. ## Claims ### Claim 1 A method for providing dynamic network traffic policies across multiple computing environments, comprising: inspecting a workload deployed in a first computing environment for a cybersecurity object, the cybersecurity object indicating a cybersecurity risk; detecting the cybersecurity risk on the workload based on the cybersecurity object; generating a policy for a firewall based on the cybersecurity risk, wherein the firewall is deployed in a second computing environment and provides connectivity between the second computing environment and an external network; and configuring the firewall to apply the generated policy. ### Claim 2 (depends on 1) The method of claim 1, further comprising: detecting a second cybersecurity object on a second workload deployed in the second computing environment; and detecting that the cybersecurity risk is a toxic combination based on the cybersecurity object and the second cybersecurity object. ### Claim 3 (depends on 2) The method of claim 2, wherein the cybersecurity risk is any one of: a misconfiguration, a vulnerability, an exposure, an attack path, a reachability path, and any combination thereof. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining a severity of the cybersecurity risk based on a detected cybersecurity object; and generating the policy further based on the determined severity. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving runtime data from a sensor deployed on the workload; and detecting the cybersecurity risk further based on the received runtime data. ### Claim 6 (depends on 1) The method of claim 1, further comprising: generating a representation of the first computing environment and a representation of the second computing environment in a security database; detecting a representation of the cybersecurity risk in the security database, which is connected to a representation of a remediation action; and initiating the remediation action in any one of: the first computing environment, the second computing environment, and a combination thereof. ### Claim 7 (depends on 1) The method of claim 1, further comprising: inspecting the workload for the cybersecurity object at a second time; determining that the cybersecurity object is not detected at the second time; and configuring the firewall to remove the generated policy in response to determining that the cybersecurity object is not detected. ### Claim 8 (depends on 1) The method of claim 1, wherein the policy is generated based on a language model. ### Claim 9 (depends on 1) The method of claim 1, further comprising: detecting an original disk associated with the workload; cloning the original disk into an inspectable disk; and inspecting the inspectable disk for the cybersecurity object. ### Claim 10 (depends on 1) The method of claim 1, further comprising: configuring the firewall to block network traffic to the workload, in response to determining that the cybersecurity risk is of a first type. ### Claim 11 (depends on 1) The method of claim 1, further comprising: configuring the firewall to block network traffic to the workload, in response to determining that the cybersecurity object is of a first type. ### Claim 12 A non-transitory computer-readable medium storing a set of instructions for providing dynamic network traffic policies across multiple computing environments, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the device to: inspect a workload deployed in a first computing environment for a cybersecurity object, the cybersecurity object indicating a cybersecurity risk; detect the cybersecurity risk on the workload based on the cybersecurity object; generate a policy for a firewall based on the cybersecurity risk, wherein the firewall is deployed in a second computing environment and provides connectivity between the second computing environment and an external network; and configure the firewall to apply the generated policy. ### Claim 13 A system for providing dynamic network traffic policies across multiple computing environments comprising: a processing circuitry; a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: inspect a workload deployed in a first computing environment for a cybersecurity object, the cybersecurity object indicating a cybersecurity risk; detect the cybersecurity risk on the workload based on the cybersecurity object; generate a policy for a firewall based on the cybersecurity risk, wherein the firewall is deployed in a second computing environment and provides connectivity between the second computing environment and an external network; and configure the firewall to apply the generated policy. ### Claim 14 (depends on 13) The system of claim 13, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect a second cybersecurity object on a second workload deployed in the second computing environment; and detect that the cybersecurity risk is a toxic combination based on the cybersecurity object and the second cybersecurity object. ### Claim 15 (depends on 14) The system of claim 14, wherein the cybersecurity risk is any one of: a misconfiguration, a vulnerability, an exposure, an attack path, a reachability path, and any combination thereof. ### Claim 16 (depends on 13) The system of claim 13, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: determine a severity of the cybersecurity risk based on a detected cybersecurity object; and generate the policy further based on the determined severity. ### Claim 17 (depends on 13) The system of claim 13, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: receive runtime data from a sensor deployed on the workload; and detect the cybersecurity risk further based on the received runtime data. ### Claim 18 (depends on 13) The system of claim 13, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate a representation of the first computing environment and a representation of the second computing environment in a security database; detect a representation of the cybersecurity risk in the security database, which is connected to a representation of a remediation action; and initiate the remediation action in any one of: the first compute environment, the second computing environment, and a combination thereof. ### Claim 19 (depends on 13) The system of claim 13, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: inspect the workload for the cybersecurity object at a second time; determine that the cybersecurity object is not detected at the second time; and configure the firewall to remove the generated policy in response to determining that the cybersecurity object is not detected. ### Claim 20 (depends on 13) The system of claim 13, wherein the policy is generated based on a language model. ### Claim 21 (depends on 13) The system of claim 13, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect an original disk associated with the workload; clone the original disk into an inspectable disk; and inspect the inspectable disk for the cybersecurity object. ### Claim 22 (depends on 13) The system of claim 13, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: configure the firewall to block network traffic to the workload, in response to determining that the cybersecurity risk is of a first type. ### Claim 23 (depends on 13) The system of claim 13, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: configure the firewall to block network traffic to the workload, in response to determining that the cybersecurity object is of a first type.