Automatically detecting multi-layer toxic combinations of application security risks in cloud environments

A computer system, comprising:

• one or more central processing units;
• one or more network interfaces that are configured to communicatively couple the one or more central processing units to a data communication network;
• and
• electronic digital random-access memory storing one or more sequences of stored program instructions configured for managing security of an application and which, when executed using the one or more central processing units, cause the one or more central processing units to execute, use a runtime security engine deployed within a computing environment:
• obtaining, from a local controller service deployed within the computing environment, telemetry data from microservices executing in the computing environment, and the telemetry data comprising security-related data;
• accessing a plurality of risk categories codifying insecure behavior across a plurality of layers in the computing environment;
• accessing a plurality of toxic combination patterns across the plurality of layers, the plurality of toxic combination patterns being generated based on the plurality of risk categories, and each of the toxic combination pattern indicating a high-severity security impact in case of an attack in the computing environment;
• evaluating the telemetry data against the plurality of risk categories and the plurality of toxic combination patterns, the evaluating producing a customized set of toxic combination patterns specific to the application within the computing environment;
• and
• displaying the customized set of toxic combination patterns in real time in a graphical user interface of a computer display device.