US 2025/0233884 A1 · Exposure and Attack Surface Management Using a Data Fabric

Abstract

The disclosed embodiments provide systems and methods for continuous exposure and attack surface management using a data fabric. Data from multiple heterogeneous cybersecurity sources, including vulnerability scanners, threat intelligence, cloud security tools, and endpoint monitoring systems, is ingested and integrated into a semantically harmonized representation, such as a security knowledge graph. This unified data model normalizes, correlates, and contextualizes diverse cybersecurity information, enabling comprehensive and real-time assessment of an organization's cybersecurity risk posture. Automated workflows trigger proactive remediation actions based on dynamically calculated exposure metrics. Additional embodiments leverage the same data fabric architecture to support specialized cybersecurity use cases, including unified vulnerability management (UVM), cyber asset attack surface management (CAASM), continuous threat exposure management (CTEM), and asset exposure management (AEM).

Claims20

Dependent claims

A method for continuous exposure management in a computing environment, comprising:

ingesting cybersecurity data from a plurality of heterogeneous sources into a data fabric, wherein the sources comprise cybersecurity monitoring systems, cloud service providers, configuration management databases (CMDBs), and endpoint telemetry feeds;
normalizing and correlating the ingested data into a semantically harmonized representation using a security knowledge graph implemented in the data fabric, the representation comprising entities including users, devices, applications, vulnerabilities, misconfigurations, or policies;
continuously evaluating harmonized data in the security knowledge graph to detect potential exposures based on predefined controls and graph traversal logic;
generating a risk posture by aggregating exposure metrics associated with entities in the security knowledge graph, wherein the risk posture is dynamically updated in response to newly ingested data;
and
triggering automated remediation workflows based on policy-defined thresholds, wherein the workflows are executed in response to detected exposures to reduce an attack surface of the computing environment.

3 more elements

A system for continuous exposure management in a computing environment, comprising:

one or more processors and memory storing instructions that, when executed, cause the one or more processors to:
ingest cybersecurity data from a plurality of heterogeneous sources into a data fabric, wherein the sources comprise cybersecurity monitoring systems, cloud service providers, configuration management databases (CMDBs), and endpoint telemetry feeds;
normalize and correlate the ingested data into a semantically harmonized representation using a security knowledge graph implemented in the data fabric, the representation comprising entities including users, devices, applications, vulnerabilities, misconfigurations, or policies;
continuously evaluate harmonized data in the security knowledge graph to detect potential exposures based on predefined controls and graph traversal logic;
generate a risk posture by aggregating exposure metrics associated with entities in the security knowledge graph, wherein the risk posture is dynamically updated in response to newly ingested data;
and
trigger automated remediation workflows based on policy-defined thresholds, wherein the workflows are executed in response to detected exposures to reduce an attack surface of the computing environment.

4 more elements

Dependencies are inferred from the claim text.

Exposure and Attack Surface Management Using a Data Fabric

Life of this patent

Exposure and Attack Surface Management Using a Data Fabric

Life of this patent

Abstract

Claims20