Techniques for detecting endpoint exposures in cloud computing environments

A non-transitory computer-readable medium storing a set of instructions for detecting endpoint exposure in a cloud computing environment, the set of instructions comprising:

• one or more instructions that, when executed by one or more processing circuitries of a device, cause the device to:
• inspect a plurality of resources deployed in the cloud computing environment;
• detect an endpoint based on a result of inspecting the plurality of resources;
• associate the endpoint with a cloud object based on a result of inspecting a resource of the plurality of resources;
• detect a network path between the cloud object and an external network;
• generate a plurality of potential network paths in response to detecting the network path, each potential network path including the cloud object;
• actively inspect a potential network path of the plurality of potential network paths;
• determine that the potential network path is a valid network path based on a result of active inspection;
• determine that the endpoint is an exposed endpoint in response to determining that the potential network path is a valid network path;
• and
• initiate a remediation action for the exposed endpoint.

A system for detecting endpoint exposure in a cloud computing environment comprising:

• a processing circuitry;
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• inspect a plurality of resources deployed in the cloud computing environment;
• detect an endpoint based on a result of inspecting the plurality of resources;
• associate the endpoint with a cloud object based on a result of inspecting a resource of the plurality of resources;
• detect a network path between the cloud object and an external network;
• generate a plurality of potential network paths in response to detecting the network path, each potential network path including the cloud object;
• actively inspect a potential network path of the plurality of potential network paths;
• determine that the potential network path is a valid network path based on a result of active inspection;
• determine that the endpoint is an exposed endpoint in response to determining that the potential network path is a valid network path;
• and
• initiate a remediation action for the exposed endpoint.