Darktrace Holdings Limited

A cyber threat defense system can incorporate data from multiple Software-as-a-Service (SaaS) applications hosted by multiple third-party platforms to identify cyber threats across platforms. The system can collect third-party event data describing an administrative event of a SaaS application hosted by an associated third-party platform. The system can identify a user associated with the third-party event data based on a composite user profile constructed from user context data collected across the multiple SaaS applications to identify the user across multiple third-party platforms. The system can associate the user with a user risk profile based on the composite user profile. The system can identify whether the third-party event data corresponds to a cyber threat partially based on the user risk profile. The system can execute an autonomous response in response to the cyber threat using an autonomous response module factoring in the user risk profile.

An automated sandbox generator for a cyber-attack exercise on a mimic network in a cloud environment can include various components. The cloud deployment component deploys the mimic network in a sandbox environment in the cloud environment. The mimic network can be a clone of components from a network that exists in an organization's environment and/or, predefined example components. The attack engine deploys a cyber threat to use an exploit for the wargaming cyber-attack exercise in the mimic network. The user interface displays, in real time, results of the wargaming cyber-attack exercise being conducted in the sandbox environment, to create a behavioral profile of how the cyber threat using the exploit would actually perform in that particular organization's environment as well as have human users interact with the cyber threat deployed by the attack engine during the cyber-attack on the mimic network, as it happens in real time, during the wargaming cyber-attack exercise.

The node exposure score generator and the attack path modeling component are configured to cooperate to analyze the actual detected vulnerabilities that exist for that network node in the network, the importance of network nodes in the network compared to other network nodes in the network, and the key pathways within the network and the vulnerable network nodes in the network that a cyber-attack would use during the cyber-attack in order to provide an intelligent prioritization of remediation actions to remediate the actual detected vulnerabilities for each network node from the network protected by a cyber security appliance.

A cloud security platform configured to protect a cloud environment is described. The cloud security platform features a cloud analysis logic and cloud security system. The cloud analysis logic is configured to (i) identify one or more security threats associated with a code submission for evaluation and (ii) generate a message including information associated with the one or more security threats. The cloud security system is configured to determine a difference between the one or more security threats associated with the code submission and at least one security threat associated with a prior code submission or production code that pertains, at least in part, to the code submission. The difference causes the cloud security system to refrain from release of code included in the code submission as production code.

A cyber threat defense system can incorporate data from a Software-as-a-Service (SaaS) application hosted by a third-party operator platform to identify cyber threats related to that SaaS application. The cyber threat defense module can have a SaaS module to collect third-party event data from the third-party operator platform. The cyber threat defense system can have a comparison module to compare third-party event data for a network entity to at least one machine-learning model of a network entity using a normal behavior benchmark to spot behavior deviating from normal benign behavior. The comparison module can identify whether the network entity is in a breach state. The cyber threat defense system can have a cyber threat module to identify whether the breach state and a chain of relevant behavioral parameters correspond to a cyber threat. An autonomous response module can execute an autonomous response in response to the cyber threat.

A cyber security system is adapted to contextualize and visualize cloud architectures featuring ephemeral cloud assets with generation of a cloud asset remediation plan to group alerts for handling based on security team responsibilities.

A cyber threat defense system can incorporate data from a Software-as-a-Service (SaaS) application hosted by a third-party operator platform to identify cyber threats related to that SaaS application. The cyber threat defense module can have a SaaS module to collect third-party event data from the third-party operator platform. The cyber threat defense system can have a comparison module to compare third-party event data for a network entity to at least one machine-learning model of a network entity using a normal behavior benchmark to spot behavior deviating from normal benign behavior. The comparison module can identify whether the network entity is in a breach state. The cyber threat defense system can have a cyber threat module to identify whether the breach state and a chain of relevant behavioral parameters correspond to a cyber threat. An autonomous response module can execute an autonomous response in response to the cyber threat.

An apparatus comprises a cyber security restoration engine configured to restore an asset in a computing network that is involved in a cyberattack to a trusted operational state and prioritize remediation actions for the asset in the computing network. The cyber security restoration engine is configured to receive an indication that the asset in the computing network is involved in a cyber security scenario. The cyber security restoration engine is further configured to identify, based on a property of the asset, an ordered set of instructions forming a playbook that applies to the asset to at least partially address the cyber security scenario.

A cyber security system is adapted to generate a cloud architecture assembled from a plurality of cloud resources within a customer cloud environment based on metadata associated with the plurality of cloud resources. The cyber security system features at least a plurality of components. The first component identifies the plurality of cloud resources and collects metadata associated with each of the plurality of cloud resources including a first cloud resource for storage within a storage subsystem. The second component determines how at least the first cloud resource of the plurality of cloud resources is behaving within the customer cloud environment based on analytics conducted on log data and network traffic data associated with the first cloud resource. The third component conducts analytics on information associated with the plurality of cloud resources in order to detect compliance or misconfiguration of the plurality of cloud resources forming the cloud architecture.

A cyber security system is adapted to compute enhanced metrics including resource misconfiguration and risk levels associated with a plurality of cloud resources and one or more cloud architectures formed by the plurality of cloud resources within a customer cloud environment.