Zscaler, Inc.

Systems and methods for utilizing Large Language Models (LLMs) for improving machine learning models in network and computer security include obtaining tabular data related to an aspect of networking and computer security; converting the tabular data to natural language for each row in the tabular data; inputting the natural language for each row in the tabular data into a Large Language Model (LLM); obtaining an output from the LLM for each row in the tabular data with embedded data therewith; and utilizing the output to train a machine learning model related to the aspect of networking and computer security.

Systems and methods for executing an evolving threat campaign discovery pipeline are provided. A method, according to one implementation, includes a step of utilizing a harvester stage of an evolving threat campaign discovery pipeline, the harvester stage configured to perform a continuous open web crawling action to obtain initial threat information from external sources. The method also includes a step of utilizing an examiner stage of the evolving threat campaign discovery pipeline, the examiner stage configured to perform automated and human-assisted vetting of the initial threat information to obtain verified threat data. Also, the method includes utilizing a curator stage of the evolving threat campaign discovery pipeline, the curator stage configured to record the verified threat data in a threat campaign database to monitor and maintain knowledge of an evolving threat campaign.

Breach prediction via machine learning includes, responsive to (1) training one or more machine learning models in a breach prediction engine, (2) monitoring one or more users associated with an enterprise, and (3) detecting an incident that is one or more of a threat and a policy violation for a first user of the one or more users, analyzing details related to the incident with the breach prediction engine; displaying a breach prediction likelihood score for the enterprise based on the analyzing; and providing one or more recommendations for the enterprise based on the incident and the analyzing.

Systems and methods for an advanced query building system include receiving a natural language query from a user, the query including a request for data from one or more data repositories; generating a Structured Query Language (SQL) query based on the natural language query; converting the SQL query to JSON-Logic; and utilizing the JSON-Logic to perform a query, and providing results of the query to the user.

Systems and methods for learning from mistakes to improve detection rates of Machine Learning (ML) models. The systems and methods including receiving data with labels; running the data through a trained ML model for predictions; identifying errors in the predictions based on the labels received with the data; adjusting weights associated with samples in the data based on the identified errors; and retraining the ML model with the adjusted weights.

Systems and methods are provided for performing risk assessment activities and preparing attained risk data for display on one or more user interfaces. In one implementation, a method may include the step of detecting one or more cybersecurity risk factors associated with an organization to determine a risk posture of the organization. The method may further include the step of attaining one or more remediation recommendations for enabling a person associated with the organization to select one or more actions for mitigating the one or more cybersecurity risk factors and improving the risk posture of the organization. Then, the method is configured to communicate display information to a user device associated with the organization, the display information including at least the one or more cybersecurity risk factors and the one or more remediation recommendations to be exhibited on a Graphical User Interface (GUI) of the user device.

Cloud-based deception systems and methods include monitoring activity associated with a plurality of decoys hosted in a decoy cloud environment for a customer, wherein the decoy cloud environment is separate from a real environment of the customer, and wherein the activity is between one or more fake assets on user devices of users associated with the customer; scoring the activity based on various steps taken between a fake asset and a decoy; and detecting a breach of the customer based on the scoring of the activity. The scoring includes increasing a score based on any activity by an attacker between the fake asset and the decoy.

Systems and methods for analyzing cybersecurity data to determine financial risk include obtaining cybersecurity monitoring data for an organization where the cybersecurity monitoring data is from a plurality of sources including from cybersecurity monitoring of a plurality of users associated with the organization; determining a current cyber risk posture of the organization based on the cybersecurity monitoring data; determining inputs for a Monte Carlo simulation to characterize financial losses of the organization due to a cyber event in a predetermined time period based on (1) an associated industry of the organization, (2) a size of the organization, and (3) the current cyber risk posture of the organization; performing a plurality of trials of the Monte Carlo simulation utilizing the inputs; and displaying a risk distribution curve based on results of the plurality of trials where the risk distribution curve plots a curve of losses versus a probability.

Systems and methods for AI agent intent classification and taxonomy management include operating an Artificial Intelligence (AI) agent system that includes an agent core connected to memory, one or more tools, and a planner; providing the AI agent with a request; performing intent classification based on the request; and generating an answer to the request based on the intent classification. The intent taxonomy management can include, responsive to adding an intent, reviewing the one or more intents for ambiguity; generating one or more test cases for each of the one or more intents; running a regression test with the one or more test cases; checking for failure cases introduced by the one or more new intents; and providing one or more suggestions to edit the one or more new intents.

Systems and methods for inline Uniform Resource Locator (URL) categorization include training a lightweight machine learning model to score content associated with unknown Uniform Resource Locators (URLs) to determine a category of the plurality of categories for each of the unknown URLs; deploying the trained lightweight machine learning model to a node in a cloud-based system for use in production; and utilizing the trained lightweight machine learning model to monitor traffic inline to categorize unknown URLs.