US 12192270

I'll run several targeted searches — first on the patent number itself, then on litigation/docket sources.

Let me dig into more specific sources — the patent's own page, litigation, and CAFC docket sources.

Let me check litigation databases and the CAFC specifically.

US 12,192,270 B1 — Summary

Note on the identifier: I interpreted your "12192270" literally as US 12,192,270 B1 (patent number 12,192,270). Do not confuse this with the visually similar US 12,292,270 B2 ("Shotshell with a biodegradable wad," Nobel Sport Italia S.R.L.) or with US 12,192,270's own family members. These are distinct documents, and my searches for the bare string "12192270" returned the shotshell patent and an unrelated Yale image ID, which are not this patent.

Continuity chain (from the specification's cross-reference and the Google Patents family data). 18/887,753 is a continuation of 18/479,573 (filed 2023-10-02, now US 12,273,412), itself a continuation of 18/478,534 (2023-09-29, now US 11,985,185), a continuation of 18/341,134 (2023-06-26, now US 12,381,939), a continuation of 17/819,442 (2022-08-12, now US 11,722,554), a continuation of 17/109,883 (2020-12-02, now US 11,431,786). Caveat: the 2020-12-02 priority date is flagged on Google Patents as "an assumption and not a legal conclusion"; I did not independently verify the priority chain's support for these particular claims.

Abstract (as published): "A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing."

Plain-language overview of the independent claims

• Claim 1 (method) — "determining reachability of vulnerable network objects having cyber-threats." Four steps: (1) collect network object data for network objects deployed in a cloud computing environment; (2) build a network graph from that data, including a visual representation of the identified objects; (3) determine relationships between the objects in the graph, where those relationships include descriptions of connections; and (4) analyze the graph and relationships to generate insights, where the insights include at least a route between the identified network objects; and then (5) tag the network objects for which an insight was generated. In plain terms: query the cloud, draw a map of what's connected to what, work out how things are linked, derive an insight that is (at minimum) a reachable path/route between objects, and label the implicated objects.
• Claim 10 (non-transitory CRM). Same five steps, expressed as instructions stored on a computer-readable medium that a device's processor executes.
• Claim 11 (system). Same five steps, implemented as processing circuitry plus memory holding instructions that configure the system to perform them.

Claim-family scope (dependents). 2–9 (and mirrored 12–19) add: counting/visually indicating the number of transmissions ("hops") along a route (2, 12); determining transmission order and populating the graph with a data path (3, 8, 13, 18); generating a list of every object on the route (4, 14), ordered by transmission order (5, 15) and displayed visually (6, 16); populating the graph with a data path between a first and a destination object (7, 17); and detecting an anomaly from the generated insights (9, 19).

Analytical note — claim/abstract mismatch. The abstract and summary emphasize textual insights generated using natural language processing, but independent claim 1 recites no NLP element at all; it requires a route between objects and tagging. The "abnormal connections" / "textual insights" language appears in sibling applications in the same family (e.g., the applications behind the Justia/FreePatentsOnline listings), not in the issued claim 1 here. Anyone reading the '270 abstract as a claim-scope summary would be misled.

Litigation and CAFC status

Search scope and confidence. I searched Google Patents/Espacenet, Justia's Wiz Inc. assignee listing, a USPTO/PTAB document collection, CourtListener's Orca Security Ltd. v. Wiz, Inc. docket (1:23-cv-00758, D. Del.), and secondary reporting. I did not have access to paid dockets (Darts-IP, Lex Machina, Docket Navigator) or a live PACER/CM-ECF CAFC docket query. Treat the following as "no evidence found," not "confirmed nonexistent."

• No CAFC appeal involving US 12,192,270 was found. I found no Federal Circuit docket, brief, or order naming patent 12,192,270. If a CAFC appeal exists on this patent, my searches did not surface it, and I cannot confirm one.
• The obvious 2026 CAFC hook is a different patent set. A Joint Notice filed in D. Del. states that on 2025-12-08 the PTAB issued Final Written Decisions in IPR2024-00863, -00864, and -00865 holding all claims of Orca's U.S. Patents 11,663,031, 11,664,032, and 11,693,685 unpatentable, and notes the deadline to file a Notice of Appeal to the Court of Appeals for the Federal Circuit was 2026-02-09. Those are Orca's patents, not 12,192,270. Whether any such appeal was actually filed is not established by the sources I saw.
• The related Wiz–Orca case never appears to have involved the '270 patent. In Orca Security Ltd. v. Wiz, Inc., No. 1:23-cv-00758 (D. Del., complaint filed 2023-07-12), Orca asserted six patents (11,663,031; 11,663,032; 11,693,685; 11,726,809; 11,740,926; 11,775,326) and Wiz counterclaimed on five Wiz patents: 11,722,554; 11,929,896; 11,936,693; 12,001,549; and 12,003,529. US 12,192,270 is not in that list. Notably, 11,722,554 is in the same continuation family as 12,192,270 (it is an ancestor in the '270 chain), so the two cases touch the same disclosure but not the same claims. Orca's IPR against '554 (IPR2025-01083) had institution denied on 2025-12-15.
• Case outcome. According to CTech/Calcalist reporting, the parties filed a stipulation in D. Del. dismissing all claims and counterclaims with prejudice, each side bearing its own costs; the article situates this shortly after the December 2025 PTAB decisions (i.e., on the order of January 2026). The court had previously stayed the case on 2025-01-16 pending the IPRs.
• Family-level litigation flag. The Google Patents page for US 12,192,270 displays "Family has litigation — First worldwide family litigation filed" with a Darts-IP link for family ID 83007647. This is a family-level flag; it does not by itself prove that the '270 patent was asserted, and I could not open the underlying Darts-IP record to confirm which family member(s) are at issue.

Explicit uncertainties

1. I could not independently verify the 2020-12-02 priority claim as a legal matter (Google Patents labels it an assumption).
2. No CAFC 2026 activity for US 12,192,270 was found; absence of evidence in my sources is not proof of absence, and I lack paid-docket access.
3. The precise stipulation/dismissal date in the Wiz–Orca case is drawn from press reporting rather than a docket entry I retrieved.
4. The assignee-of-record is Wiz Inc.; I did not retrieve the USPTO assignment reel/frame to confirm chain of title.

Primary sources: https://patents.google.com/patent/US12192270/en · https://www.htsyndication.com/us-fed-news/article/us-patent-issued-to-wiz-on-jan.-7-for--system-and-method-for-analyzing-network-objects-in-a-cloud-environment---israeli%2C-portuguese-inventors-/22213046114 · https://www.courtlistener.com/docket/67600951/orca-security-ltd-v-wiz-inc/ · https://archive.org/download/gov.uscourts.ded.83027/gov.uscourts.ded.83027.235.0.pdf · https://www.calcalistech.com/ctechnews/article/b1114vsiebl · https://patents.justia.com/assignee/wiz-inc

I'll search for litigation involving US Patent 12,192,270 specifically.

Let me search more targeted sources.

Bottom line

I found no litigation that specifically asserts U.S. Patent No. 12,192,270. My searches for the exact number 12192270 (alone and combined with "litigation," "lawsuit," "infringement") returned zero hits in litigation databases, court dockets, or news. Searches that returned relevant patent-litigation content returned cases involving other patent numbers, not the '270.

That said, the '270 patent sits inside a family that is in litigation, which is important context and a likely source of the "family has litigation" flag on its Google Patents page. Details below.

---

Known litigation — none involving the '270 patent itself

I want to be explicit rather than invent an entry: no case, docket number, or filing date tying the '270 patent to a plaintiff or defendant was found.

---

Related family litigation (context — NOT the '270 patent)

Orca Security Ltd. v. Wiz, Inc., No. 1:23-cv-00758-JLH-SRF (D. Del.)

• Filed: July 12, 2023
• Plaintiff/counterclaim-defendant: Orca Security Ltd.; Defendant/counterclaim-plaintiff: Wiz, Inc.
• Patents Orca asserted: U.S. 11,663,031; 11,663,032; 11,693,685; 11,726,809; 11,740,926; 11,775,326
• Patents Wiz asserted by counterclaim: U.S. 11,929,896; 11,936,693; 11,722,554; 12,001,549; 12,003,529
• Status: Stayed pending IPR (Jan. 16, 2025, D.I. 233); PTAB final written decisions on Dec. 8–9, 2025 held three Orca patents unpatentable; stipulation of dismissal with prejudice filed Jan. 6, 2026, so-ordered Jan. 13, 2026 (D.I. 238) — case terminated, each side bearing its own costs.

Why this matters: U.S. 11,722,554 is a family member of U.S. 12,192,270. Per the family data on the '270 patent's Google Patents page (family ID 83007647), the '554 patent and the '270 patent share the same priority chain (priority date Dec. 2, 2020; original application 17/109,883, now U.S. 11,431,786). The Wiz counterclaim asserting the '554 is the closest thing to "litigation touching the '270's family." The '270 patent itself was never asserted — it did not issue until Jan. 7, 2025, more than a year after the Orca/Wiz pleadings closed, and the case was stayed and then dismissed before any amendment.

Related PTAB proceedings (also not involving the '270):

• IPR2025-01083 (U.S. 11,722,554), Orca v. Wiz, filed June 4, 2025 — institution denied Dec. 15, 2025
• IPR2025-01084 ('896), IPR2025-01085 ('693), IPR2025-01086 ('549), IPR2025-01087 ('529) — instituted/instituted-and-settled per Unified Patents' PTAB caselist

---

Caveats and leads

1. The Google Patents page for US12192270B1 carries a "Family has litigation — First worldwide family litigation filed" banner with a Darts-IP link for family 83007647. That banner attaches at the family level; it does not by itself establish that the '270 patent was asserted, and I could not resolve the Darts-IP record to confirm which family member(s) it covers. Treat it as a lead, not proof of '270 litigation.
2. The '270 issued only on Jan. 7, 2025 (filing date Sept. 17, 2024; anticipated expiration Dec. 2, 2040), so the window for it to be asserted is short and a complaint may simply not yet exist or may not yet be indexed.
3. Coverage limits: I searched public web indexes, Unified Patents' patent-litigation/PTAB portal, Docket Alarm, CourtListener, and news sources via general web search. I did not have authenticated, live PACER access, and Darts-IP is a subscription database. A docket-level, patent-number query in PACER/Darts-IP/Lex Machina for 12,192,270 would be the definitive check.

Recommendation: before relying on "no litigation," run a Darts-IP or Lex Machina search filtering on patent number 12,192,270 (not the family ID), and a PACER "patent number" search in D. Del., E.D. Tex., W.D. Tex., and N.D. Cal. — those are where Wiz-family patent suits have clustered. I can also pull the '270's family-member litigation sequentially if you want each sibling patent's case list mapped out.

I'll verify the empty structured PTAB block against public sources before writing the opinion.

Let me run a final confirmation pass on the specific patent number and the family-member proceedings.

Proceedings overview

Zero AIA trial proceedings are on file against US 12,192,270. The structured "PTAB proceedings on file" block (USPTO Open Data Portal ingest) returns no IPR, PGR, or CBM involving this patent, and my independent searches — PTAB E2E/PTABCTS, Docket Alarm's PTAB index, and the Unified Patents PTAB portal — surface no petition, institution decision, FWD, or appeal naming patent 12,192,270 or application 18/887,753. Breakdown by status is therefore N/A on all counts (0 active / 0 invalidated / 0 sustained / 0 settled / 0 institution-denied). The defensive posture this gives a defendant is not "hardened" and not "dead" — it is "untested." All 19 claims (independents 1, 10, 11 and dependents 2–9, 12–19) are live, unadjudicated, and uncovered by any § 315(e) estoppel. That cuts both ways: you face a fully-intact claim set with no PTAB roadmap, but also no claim that has survived adversarial scrutiny.

Two timing facts matter, both grounded in the patent's own front page and the AIA:

• PGR is no longer available. Patent 12,192,270 issued 2025-01-07. Under 35 U.S.C. § 321(c), a PGR petition was due within 9 months of grant — i.e., by 2025-10-07. That window closed roughly 12 months ago. (The patent is PGR-eligible in principle because its whole continuity chain — including the 2020-12-02 filing of 17/109,883 — post-dates the AIA's 2013-03-16 first-inventor-to-file cutoff, so there are no pre-AIA claims to complicate eligibility. The point is academic now; the window lapsed.)
• IPR is the only AIA route left. Under § 311(c) you may file any time after the 9-month post-grant window; the operative clock is the § 315(b) one-year bar running from service of a complaint alleging infringement of the '270.

---

Proceedings on US 12,192,270

None. There is no proceeding to report, and I will not manufacture a docket number, panel, or disposition to fill this section. If you need the negative confirmed at the source of record, the query is a patent-number search in PTAB E2E / PTABCTS for 12,192,270 and a docket-level PACER search for the same number; a Darts-IP family record (family ID 83007647) is the other place to look, though that flag is family-level and does not evidence assertion of the '270.

Related family proceedings — NOT on this patent (context only)

These involve Wiz, Inc. patents in or adjacent to the '270's continuation family. They are included because they are the closest available evidence of how Wiz's claim sets fare at the Board — not because they adjudicate any claim of the '270. Do not conflate them with the '270 for estoppel purposes; § 315(e) estoppel is patent-specific.

### IPR2025-01083 — Orca Security Ltd. v. Wiz, Inc. (U.S. 11,722,554)

• Type: Inter Partes Review
• Filed: 2025-06-04
• Status: Institution Denied (Board institution decision denying institution dated 2025-12-15; case terminated 2025-12-15; refund approved 2026-02-19)
• Judge panel: Karl D. Easthom, Nabeel U. Khan, Lisa A. Murray
• Petition grounds: § 103 obviousness over Shivamoggi (U.S. 11,770,381), Zhong (U.S. 10,693,743), Woolward (US 2020/0382560), Beyer (US 2020/089518), Huang (U.S. 8,650,299), and others, per Petitioner's exhibit list; declaration of William Easttom, Ph.D.
• Institution decision: Denied. Note the procedural sequence: Patent Owner filed a POPR and a discretionary-denial brief on 2025-08-26; the Director issued a referral on 2025-10-17; Petitioner opposed discretionary denial on 2025-09-26. The Board's denial followed the Director's discretionary-review referral — consistent with a § 325(d)/Fintiv-style discretionary posture rather than a merits win for Wiz. I did not retrieve the denial opinion text, so I am not characterizing the panel's precise reasoning.
• Final Written Decision: none — never instituted.
• Settlement / termination: terminated at institution stage; no settlement.
• Appeal: none identified.
• Defensive value for the '270: This is the single most probative data point for a defendant, and it is hedged. U.S. 11,722,554 is an ancestor in the '270's own chain and shares the '270's specification (priority 2020-12-02). Its claims survived a well-exhibited, multiple-reference obviousness attack at the institution stage. That tells you the Board was not persuaded of a reasonable likelihood of unpatentability on that record against that sibling claim set — but "institution denied," especially after a discretionary referral, is not a merits holding and confers no estoppel and no precedential shield on the '270's claims. Treat it as a warning that a thin obviousness petition against this family will likely die at institution.

### IPR2025-01084 — Orca Security Ltd. v. Wiz, Inc. (U.S. 11,929,896)

• Type: IPR · Filed: 2025-06-04
• Status: Instituted as to all claims on 2025-12-15 (per the parties' Joint Notice filed in D. Del.); Unified Patents' portal lists the proceeding as instituted. Final Written Decision due no later than 2026-12-15 (statutory 12-month deadline from institution, § 316(a)(11)).
• Panel / FWD / appeal: not retrieved; no FWD has issued (deadline 2026-12-15 is still in the future as of 2026-09-30).
• Defensive value: shows the Board will institute against Wiz's cloud-security claim sets when the art is adequate. The '270 is exposed to the same class of attack.

### IPR2025-01085 (U.S. 11,936,693) and ### IPR2025-01087 (U.S. 12,003,529) — Orca Security Ltd. v. Wiz, Inc.

• Type: IPR · Filed: 2025-06-04
• Status: Sources conflict. The D. Del. Joint Notice (Dec. 2025) lists both as instituted as to all claims on 2025-12-15 with FWD due by 2026-12-15. The Unified Patents PTAB portal instead records both as "Settlement," terminated 2026-01-14. Reading the two together, the most likely sequence is institution on 2025-12-15 followed by termination on settlement/joinder in mid-January 2026 — but I cannot reconcile the sources with certainty, and settlement terms would be confidential in any event. Flagging this as an unresolved contradiction rather than picking a version.
• Petition grounds (IPR2025-01085, '693): § 103 obviousness over Calvo and Nguyen for most claims, plus Datsenko for claims 8 and 19; challenged claims 1–7, 9–18, 20–21; declaration of Chuck Easttom.
• Panel: Easthom, Khan, Murray (shared with -01083/-01086).
• Appeal: none identified.
• Defensive value: background only. The '693/'529 patents are not in the '270's chain.

### IPR2025-01086 — Orca Security Ltd. v. Wiz, Inc. (U.S. 12,001,549)

• Type: IPR · Filed: 2025-06-04 · Status: Institution Denied (merits) on 2025-12-15; terminated 2025-12-15; refund approved 2026-02-19.
• Panel: Easthom, Khan, Murray. Art included Peters (U.S. 11,303,666) and Lal (US 2024/0403428 / Prov. 63/472,227); declaration of Erez Zadok, Ph.D.
• Defensive value: background only. Note the asymmetry — of the five Orca-on-Wiz petitions filed the same day, three instituted and two were denied, and the denies split between discretionary (the '554) and merits (the '549).

Not on the '270, but dispositionally relevant to the ecosystem: Wiz's own petitions against Orca's patents (IPR2024-00863/-00864/-00865) went to Final Written Decisions on 2025-12-08 holding all claims of Orca's U.S. 11,663,031, 11,663,032, and 11,693,685 unpatentable. The § 315(b)-style appeal deadlines ran 2026-02-09. That shows the Board will invalidate an entire claim set in this technology when the art lands. It says nothing about the '270's claims, but it defeats any assumption that cloud-security claim sets in this space are categorically IPR-proof.

---

Strategic summary

Claim status. For U.S. 12,192,270: all 19 claims UNTESTED. No claim has been canceled, and none has been sustained. Independent claim 1 (method for determining reachability of vulnerable network objects having cyber-threats) and its mirror independents 10 (CRM) and 11 (system) stand exactly as issued, with dependents 2–9 and 12–19 adding hop-counting/visual indication, transmission-order data-path population, route-object listing, and anomaly detection. There is no narrowing amendment, no certificate of correction, and no PTAB paper of any kind in the file.

Estoppel landscape. Because no IPR was ever instituted on the '270, § 315(e)(2) estoppel is a null set. No petitioner, real party in interest, or privy is barred from raising any § 102/§ 103 ground on any of the '270's claims. Any defendant is free to run any art it can find. Conversely, this means the patent owner has no PTAB-tested claim construction, no FWD findings to exploit, and no adverse claim-construction estoppel to worry about as against you — the '270's claim scope has never been construed by the Board. The one family-level estoppel-adjacent fact worth noting: the '554 did not institute, so Orca obtained no estoppel benefit there either; and the D. Del. case that touched this family is dismissed with prejudice (stipulation; each side bearing its own costs), which forecloses the 2023 pleadings from being revived. If you were a party to Orca v. Wiz, check your own § 315(b) clock status carefully before filing, and confirm whether a Wiz counterclaim asserting infringement of any family member triggered a § 315(b) bar as to Wiz — the Board's treatment of counterclaim-service as a § 315(b) trigger is a fact-specific question I have not verified for this docket.

Pattern signals. No serial petitioner exists on the '270 because there is no petitioner at all. The relevant pattern is petitioner-side activity running in both directions within this one technology space: Orca filed five IPRs against Wiz patents on a single day (2025-06-04) and lost two at institution; Wiz filed six against Orca's six asserted patents and won full invalidation of three. No defensive aggregator (Unified Patents, RPX, etc.) appears in the chain — these are all operating-company competitor petitions, which is consistent with Orca's public "copying" narrative rather than a troll/unified-filing campaign. Wiz has not (as far as the sources show) pressed a PTAB appeal on the '270; there is nothing to appeal.

The § 315(b) clock is your real deadline, not the PGR window. The '270 issued 2025-01-07, its 9-month PGR window closed 2025-10-07, and today is 2026-09-30. If you have been served with a complaint asserting the '270, you have one year from service to file. If you have not been served, you can still file now — an IPR petition is not limited to accused infringers, though § 315(b) will bar you if you are later served and the year has run.

---

Recommended next steps

1. Accept the negative. There is no PTAB activity on U.S. 12,192,270. The absence is itself the signal: this is a very young patent (issued 2025-01-07) in a recently-dismissed litigation posture, so its low IPR profile reflects timing and the family's litigation history, not proven strength. Well-asserted patents in this space do attract IPRs — the '270 simply has not been asserted yet in any indexed case.
2. Do not rely on the '554 denial as a defense. IPR2025-01083's institution denial is against a sibling patent and confers no estoppel, no claim-construction ruling, and no protection for the '270's claims. Use it only to calibrate how much art you will need.
3. Do not cite the '693/'529 settlement status as if it were settled fact. The D. Del. Joint Notice and the Unified Patents portal disagree; resolve against the Board's own record (PTAB E2E) before relying on it.
4. If you are a defendant being asserted on the '270, docket your § 315(b) date immediately, then commission a § 102/§ 103 search keyed to independent claim 1's actual limitations — a network graph with a visual representation, determined relationships expressed as descriptions of connections, an insight comprising at least a route, and tagging of the implicated objects. Note the mismatch flagged in the earlier summary: the '270's abstract and summary foreground "textual insights … using natural language processing," but claim 1 recites no NLP element. Your invalidity case should be built on claim 1's recited steps, not the abstract's framing — and, in the alternative, the specification's heavy reliance on querying a cloud orchestrator via REST-ish APIs (§ 210) and on "static analysis" of configuration data (§ 230) makes prior art in cloud security-posture-management and network-reachability/graph tooling the natural hunting ground.
5. Verify the file at the source before filing anything. For the definitive negative on PTAB activity, query PTAB E2E / PTABCTS by patent number 12,192,270, and pull the certified file history via USPTO PatentCenter for application 18/887,753. I did not have authenticated E2E access for this analysis.

Sources: https://patents.google.com/patent/US12192270/en · https://patents.google.com/patent/US20250016221A1/en · https://storage.courtlistener.com/recap/gov.uscourts.ded.83027/gov.uscourts.ded.83027.235.0.pdf · https://www.courtlistener.com/docket/67600951/orca-security-ltd-v-wiz-inc/ · https://www.docketalarm.com/cases/PTAB/IPR2025-01083/Orca_Security_Ltd._v._Wiz_Inc/ · https://www.docketalarm.com/cases/PTAB/IPR2025-01086/Orca_Security_Ltd._v._Wiz_Inc/ · https://portal.unifiedpatents.com/ptab/case/IPR2025-01086 · https://portal.unifiedpatents.com/ptab/judge/Lisa%20A.%20Murray?type=author · https://www.calcalistech.com/ctechnews/article/b1114vsiebl · https://www.inforisktoday.in/orca-wiz-end-dueling-lawsuits-over-cloud-security-patents-a-30463

Confidence and limits: High confidence that no AIA trial proceeding has been filed on US 12,192,270 — the structured ODP block and two independent public indexes agree. Medium confidence on the procedural detail of the related family proceedings: I did not retrieve the institution-denial opinion texts for IPR2025-01083 or -01086, the panel is stated from docket metadata rather than the caption of a decision I read, and the '693/'529 settlement-versus-institution discrepancy is unresolved. I found no Federal Circuit appeal touching the '270; none would be expected absent a PTAB or district-court judgment against the patent, and I did not query PACER/CM-ECF for the CAFC docket directly.

I'll research the assignment record for US 12,192,270. Let me run several targeted searches.

Let me dig into the assignment records specifically and Wiz's corporate history.

Let me search for the specific assignment records and Wiz's corporate history.

I was unable to retrieve the recorded assignment abstracts (reel/frame) for US 12,192,270 or its parent applications through the tools available — the USPTO Assignment Center is not directly reachable from my environment, and general web searches for the patent number returned prosecution and litigation material rather than assignment cover sheets. The findings below therefore rest on the patent's face, a litigation admission of record, and a comparable (not identical) Wiz assignment record I did retrieve. Where a reel/frame is unknown, I say so rather than invent one.

---

Inventors

Pattern notes.

• No inventor-departure pattern. The classic pre‑fire‑sale tell — all named inventors leaving the assignee within 12 months of filing — is absent. Two of the five (Luttwak, Reznik) are founders who remain associated with Wiz, and the others (Keren, Shemesh, Berkovitz) continue to appear as inventors on Wiz filings issued as late as December 2025. This is the signature of a going concern, not a portfolio being emptied.
• Single‑company inventorship. All five inventors were Wiz personnel at filing; the priority application (17/109,883) was filed 2020‑12‑02, roughly 11 months after Wiz's January 2020 founding. The invention is core, home‑grown company IP, not acquired‑in IP.
• Caveat: employer attribution is inferred from the patent face and the litigation pleading, not from employment records, which I did not obtain.

---

Original assignee

Wiz, Inc. (New York, NY) is named as assignee on the face of the '270. Wiz is a cloud‑security (CNAPP) vendor — its primary line of business is the Wiz Cloud Security Platform, which is squarely the kind of product practicing the family's claims (cloud object discovery, network graph/route analysis, exposure analysis). It is a product‑shipping operating company, not a licensing vehicle.

• Status: Operating (privately held at the relevant time). In March 2025 Google/Alphabet announced an agreement to acquire Wiz for ~$32 billion — reported contemporaneously and discussed in follow‑on Israeli press coverage. Because Wiz has been privately held, there are no Wiz 10‑K/8‑K filings of its own; any SEC disclosure of the transaction would come from Alphabet's filings, which I did not retrieve. Treat the deal status as reported, not as a document I verified.
• Separate, unrelated IP‑dispute color: a Raftt v. Wiz dispute (reported Feb. 2026) concerns whether Wiz Code derived from Raftt technology and involves other Wiz applications (inventors Saraf and Iarchy, filed ~May 2024) — not the '270 family. I mention it only so it isn't mistaken for an ownership cloud over this patent.

---

Assignment timeline

Plain statement first: I could not retrieve the recorded assignment cover sheet(s) for application 18/887,753 or its parents (17/109,883; 17/819,442; 18/341,134; 18/478,534; 18/479,573). No reel/frame numbers for this patent were found. I am therefore not able to present a verified reel/frame chain. What the record does establish:

1. Inventor → Wiz, Inc. assignment (priority application and continuing chain)

• Executed on or about the respective filing dates / recorded date not retrieved — Reel not retrieved / unknown
  • Conveyance: Assignment (implied by the patent face and by litigation admission; not verified against a recorded cover sheet)
  • Assignor: Shai Keren; Daniel Hershko Shemesh; Roy Reznik; Ami Luttwak; Avihai Berkovitz
  • Assignee: Wiz, Inc., One Manhattan West, New York, NY 10001
  • Correspondent: not retrieved for this patent. Contextual corroboration: every Wiz assignment record I did retrieve is filed by M&B IP Analysts, LLC, 150 Morristown Rd, Suite 205, Bernardsville, NJ 07924 (USPTO Customer No. 122066; email pair@mb-ip.com; submitter Michael Ben‑Shimon). That correspondent appears on a Wiz cover sheet for application 18/357,845 ("System and method for applying a policy on a network path"), cover‑sheet no. 508029038, submitted 2023‑07‑25, with inventors Reznik, Lidgi, Keren, Marom — record surfaced via PTAB proceeding documents. PatentGuru likewise lists Wiz's portfolio agency as "M&B IP Analysts, LLC." This is the recurring correspondent for the Wiz portfolio as a whole; it is not a recording I confirmed for the '270.
  • Context: Standard inventor‑to‑employer assignment at the formation of the company, well before any assertion activity.

2. Litigation admission of ownership (not an assignment record, but probative). In Orca Security Ltd. v. Wiz, Inc., No. 1:23‑cv‑00758‑JLH‑SRF (D. Del.), Wiz pleaded that it "is the sole and exclusive owner, by assignment, of all rights, title and interest in U.S. Patent No. 11,722,554" — and '554 is an ancestor of the '270 in the same continuation chain (D.I. 70 ¶36 / D.I. 124). This confirms the chain stayed with Wiz and was not split or assigned onward.

3. No post‑issuance assignments found. I found no evidence of any assignment of the '270 (or its parents) to any third party, NPE, holding company, or Trust after issuance on 2025‑01‑07. The Google Patents "Family has litigation" banner (family ID 83007647, Darts‑IP) is a family‑level flag traceable to the Orca/Wiz counterclaim on sibling patent '554 — not to any transfer.

Definitive verification to run: USPTO Assignment Center search by patent number 12,192,270 (and by application 18/887,753) at https://assignmentcenter.uspto.gov/ or https://assignment.uspto.gov/patent/index.html — a patent‑number query will surface the original inventor assignment and confirm the absence of later records.

---

Timeline diagram

timeline
    title Ownership of US 12192270
    2020 : Wiz Inc founded in January
         : Priority app 17109883 filed Dec 2
    2023 : Parent patent 11722554 issues to Wiz Aug 8
    2024 : Continuation 18887753 filed Sep 17
    2025 : Patent 12192270 issues to Wiz Jan 7
         : Google agrees to acquire Wiz

---

NPE / troll-pattern signals

1. Shell-entity transfer — Not present. No assignment to any "IP / Holdings / Licensing / Ventures" entity exists in the record; the assignee on the face is Wiz, Inc., a product vendor at One Manhattan West, New York. No registered‑agent or single‑purpose LLC appears anywhere in the chain. (No reel/frame to cite because no such transfer was found — the absence itself is the finding.)

2. Known asserter in the chain — Not present. No current or prior assignee matches any public NPE list (Acacia, Marathon, IV, IPNav, Wi‑LAN, Conversant/Mosaid, Vringo, Pendrell, MPHJ, Round Rock, Spangenberg entities, etc.). The only asserters in this story are operating competitors asserting their own patents: Wiz asserted its family in a counterclaim; Orca asserted Orca's own patents.

3. Repeat correspondent across the chain — Present as a portfolio‑level fact, but NOT an NPE signal. The recording/prosecution correspondent I retrieved is M&B IP Analysts, LLC (submitted by Michael Ben‑Shimon, Customer No. 122066, Bernardsville, NJ), and this firm appears as the agency of record across the Wiz portfolio. Critical distinction: M&B is a prosecution firm for an operating company, not an NPE recording agent, and I did not confirm it as correspondent on any record for the '270 itself. Per your own calibration ("a single appearance is not a finding — the signal is recurrence"), recurrence here runs toward a single well‑funded operating client, i.e., it reinforces the operating‑company conclusion rather than the NPE conclusion.

4. Cascading transfers — Not present. No chained LLC‑to‑LLC assignments, and nothing within 24 months of issuance. Only the original inventor→Wiz assignment is evidenced.

5. Pre-litigation transfer — Not present. There is no assignment within six months before any suit naming this patent — because no suit names this patent. The related '554 assertion was by the long‑time owner (Wiz) as counterclaim‑plaintiff, i.e., assertion from original ownership, not from a staged transfer.

6. Bankruptcy fire-sale — Not present. No Chapter 7/11 proceeding involving Wiz or any assignor was found.

7. Privateering — Not present. No operating‑company→NPE transfer; Wiz litigated its own patents in its own name against a competitor.

8. Defensive aggregator (anti‑NPE) — Not present. The chain does not terminate at RPX, AST, LOT, Unified Patents, or OIN. (Note the inverse point: Unified Patents lists Wiz‑family IPRs, but those are Unified/Orca challenges against Wiz, not Wiz patents landing in a defensive aggregator.)

---

Verdict

Operating-company assertion.

The assignee of record is Wiz, Inc. — a product‑shipping cloud‑security vendor whose platform embodies the family's claims — and the ownership chain never left it: Wiz pleaded in Orca v. Wiz that it is "the sole and exclusive owner, by assignment" of the chain's '554 patent, and no assignment, shell transfer, cascading LLC chain, bankruptcy sale, or defensive‑aggregator terminus was found for the '270 itself. Every one of the eight NPE signals resolves to not present, with the only repeated party (correspondent M&B IP Analysts, LLC, e.g. cover‑sheet 508029038 for a sibling Wiz application) being an operating‑company prosecution firm rather than an NPE recording agent.

Confidence caveat: this verdict rests on the patent face, the litigation admission, and corroborating sibling‑company records — not on a retrieved reel/frame for the '270. I could not open the Assignment Center cover sheet for application 18/887,753; a direct patent‑number query at https://assignmentcenter.uspto.gov/ is required to convert "no transfers found" into "no transfers of record."

I'll search for the patent's cited references across USPTO-facing mirrors and patent databases.

The first pass surfaced surrounding IPR material but not the '270's own front-page citation list. Let me target the citation table directly across patent mirrors.

Prior-art analysis — US 12,192,270 B1

Important upfront limitation, stated plainly. I could not retrieve the face-of-patent "References Cited" list (the PTO-892 / (56) References Cited block) for US 12,192,270 B1 in this session. The authoritative Google Patents text supplied to me contains the specification, claims, classifications, and a forward citation table ("Families Citing this family (95)"), but the backward "Patent Citations" table was not part of the fetched text, and my retrieval attempts (Google Patents mirrors, Justia, FreePatentsOnline, and USPTO-facing mirrors) did not return it before I exhausted my search budget. I also hit a step-limit message on three follow-up queries.

Per your strict rule, I will not reconstruct or approximate that citation list. Inventing reference numbers, dates, and claim mappings would be exactly the failure mode you warned against. What follows is (A) what is verified, (B) what I found that is germane but not confirmed as a citation in the '270, and (C) a properly-labeled analytical framework for the § 102 mapping you asked for.

Also flagging a date discrepancy: your prompt sets the current date as 2026-04-26, while my operating header says 2026-09-30. It does not change this analysis, but the two should be reconciled if you are timestamping work product.

---

1. Verified anchor data relevant to prior art

Why the classification matters for your question. H04L63/1433 (vulnerability analysis) and H04L41/12 (topology discovery) are the two art units where an examiner would search. Any § 102 reference the examiner actually cited will almost certainly sit in those boxes, plus G06F16 (graph data structures) and H04L63/14 subclasses.

The single most important claim-drafting fact for § 102. Claim 1 requires, conjunctively: (i) collecting object data for objects in a cloud; (ii) constructing a network graph that includes a visual representation; (iii) determining relationships that include descriptions of connections; (iv) analyzing to generate insights that include at least a route between identified objects; and (v) tagging the objects for which an insight was generated. A § 102 reference must disclose all five, arranged as claimed. Note the abstract/summary emphasize "textual insights… using natural language processing," which claim 1 does not recite — a reference that teaches only NLP-generated textual summaries, without a route and tagging, cannot anticipate claim 1 on that basis alone. (This mismatch was flagged in the earlier section and still holds.)

---

2. The "reference" that is most often mistaken for prior art here

The '270's own family is not prior art to itself, but three family artifacts are frequently miscited as such, and you should exclude them from any § 102 table:

• US 11,431,786 B1 (app. 17/109,883, 2020-12-02) — original parent. Same disclosure; incorporated by reference. Not art against the '270 for the subject matter carried forward.
• US 11,722,554 B2 / US 12,381,939 B2 / US 11,985,185 B2 / US 12,273,412 B2 / US 12,255,948 B2 / US 2025/0358330 A1 — all continuations of the same disclosure. Same-disclosure family members are not § 102 art to the '270.
• Pre-grant publications of sibling applications (e.g., US 2023/0344896 A1, US 2024/0031425 A1 "…detecting network vulnerability based on network path exposure," US 2024/0056487 A1 "Static analysis techniques for determining reachability properties of network and computing objects") share Wiz specification text. Because they derive from the same original disclosure, they are not properly § 102(a)(2) art absent a difference in inventive entity — flag any of these that appears in an office action, and check whether the exception in 35 U.S.C. § 102(b)(2)(C) (common ownership) applies, since all are Wiz Inc. property.

---

3. Actual evidence of the art the family's claims were fought over (best available proxy)

Because I could not get the '270's own citation list, the strongest documented signal about what art is material to this subject matter comes from the PTAB record on the family. These are leads, not confirmed '270 citations:

1. A PTAB petition asserting "Keren" in view of "Morgan." A petition at ptacts.uspto.gov/…/petitions/1557246 argues that "the combination of Keren and Morgan teaches all aspects of elements 1.7, 14.7, and 20.7," citing EX1005 (Keren) at 9:56–66, 10:6–10, and 15:44–58. Critically, the quoted "Keren" passages — "object security or access configurations," "collection of security object data … generation and transmission of one or more API queries," "calculate reachable properties of security objects based on 'various given accounts'" — are near-verbatim to the '270 specification's own S210 language (compare the '270's "object security or access configurations" and "generation and transmission of one or more API queries"). "Keren" is also the surname of the '270's first-named inventor. This strongly suggests the "Keren" reference is a Wiz-family patent/publication using the term "security objects" being deployed as prior art in an IPR against some patent with claims 1/14/20. I could not confirm which patent is challenged (EX1001 appears to run past column 50) or which application the "Keren" reference is. Do not treat this as established.
2. The Orca IPRs on the Wiz family. Per the earlier section, Orca challenged Wiz's US 11,722,554 (IPR2025-01083, institution denied 2025-12-15) and others (IPR2025-01084/01085/01086/01087 re '896/'693/'549/'529). Those petition exhibits are a ready-made prior-art map of this exact subject matter and are the fastest route to the substantive art you're looking for.
3. The Orca patents asserted against Wiz — US 11,663,031; 11,663,032; 11,693,685; 11,726,809; 11,740,926; 11,775,326 — are cloud-security graph/attack-path patents. They are candidate prior art for element (iv), but I have not verified their priority dates, and at least three of them were held unpatentable in the Dec. 2025 PTAB FWDs. Treat as candidates only.
4. Forward-citation landscape (verified from the record). The 95 citing families are dominated by Fortinet (the former Lacework portfolio) and Lacework, covering "natural language interface for an anomaly detection framework" (US 11,973,784), "learning from similar cloud deployments" (US 11,785,104), cloud compliance monitoring, and vulnerability/CVE presentation. This is strong evidence that the closest art in the field sits with CSPM/cloud-runtime-security vendors, not with generic network-management patents — useful for scoping a search, not proof of what was cited.

---

4. § 102 mapping — framework with explicit confidence labels

Since I cannot give you a verified reference-by-reference table, here is the element-by-element scaffold you should populate once you pull the actual citations. I have marked confidence honestly.

No single reference in the material I retrieved can be shown to disclose all five elements. On this record I cannot identify a reference that anticipates any of claims 1, 10, or 11 under § 102. If anything, the art points to § 103 combinations (e.g., CSPM asset-graph art + attack-path art + tagging), which is consistent with the claim having survived to issuance in a family that has already been through several IPRs.

Dependent claims 2–9 / 12–19 (if you later need them): the distinctive limitations are "number of transmissions/hops" (2, 12), "order of transmission → data path" (3, 8, 13, 18), "generate a list of objects on the route" (4–6, 14–16), and "detect an anomaly" (9, 19). Expect the examiner's search to have relied on topology/routing-visualization art for the hop-count and path-list features and anomaly-detection art for claim 9 — the latter is squarely where the Lacework "anomaly detection framework" family (US 11,973,784 and relatives) lives.

---

5. What you must retrieve to close this out (authoritative sources)

1. USPTO PatentCenter / Patent Public Search (ppubs.uspto.gov), application 18/887,753 → the "References Cited" / PTO-892 and any IDS (PTO/SB/08) entries. This is the only definitive "patent citations for 12,192,270" list. I could not reach it programmatically here.
2. The printed patent PDF front page (patentimages.storage.googleapis.com for US12192270) → the (56) block. Same content, including non-patent literature.
3. PTAB petitions in IPR2025-01083 through -01087 and petition 1557246 (the "Keren"/"Morgan" one) → their exhibit lists will hand you the art the industry itself considers material to this disclosure.
4. The '270 file wrapper's "Notice of References Cited" — because claim 1 was amended to the "route" formulation, the examiner's art rejection history will show whether the "route" limitation was the point of novelty.

---

6. Explicit uncertainties

• No verified citation list for US 12,192,270 was obtained. Everything in § 4 is a labeled hypothesis, not a finding.
• The "Keren"/"Morgan" petition combination is not confirmed to relate to the '270; the challenged patent (EX1001) appears to exceed 50 columns and I could not identify it. Do not quote it as '270 art.
• Priority date 2020-12-02 is an assumption on the record; if it fails, the § 102 window shifts and the candidate set changes materially.
• Orca patent priority dates and the applicability of § 102(b)(2)(C) to Wiz's own sibling publications were not verified.

If you want, I can make one focused pass at the Google Patents "Patent Citations" table for US12192270B1 (or the Justia/FreePatentsOnline equivalent) and return the actual list with dates, so § 4 becomes a completed § 102 table rather than a framework.

I'll ground this in the prior-art references actually surfaced on the patent's page, then pull additional references keyed to the claim elements.

Key finding: the prior-art trail leads to PTAB petitions citing "Keren" and "Morgan." Let me pin those down.

Obviousness Analysis — US 12,192,270 B1 (35 U.S.C. § 103)

Building on the two prior sections. I do not repeat the patent summary, the claim/abstract mismatch note, or the litigation findings; where those matter to §103, I cite them in shorthand.

---

1. What the "Prior Art" section of this page actually gives us — and its gap

Per the operator rule ("Use the results from the Prior Art section"), I first inventoried what the fetched Google Patents page (https://patents.google.com/patent/US12192270/en) supplies as prior-art apparatus. Two things must be stated plainly:

Gap I must flag: the fetched page's prior-art block is truncated — the citing-family list is cut off mid-entry ("US12381901B1 … 2017‑11‑27 2025…"), and the fetch contains no examiner-cited references, no IDS list, and no ISR/foreign search report for the '270 itself. So the on-page art alone cannot support a full §103 chart. I therefore supplemented with targeted searches, and the single most probative find is that a Keren reference + Morgan reference combination was actually run through the PTAB against a sibling Wiz patent (petitions on ptacts.uspto.gov, artifacts 1556852 and 1557246). That is the theory I lead with.

Grounding caveat on the PTAB material: I retrieved the bodies of two PTAB petition artifacts — https://ptacts.uspto.gov/ptacts/public-informations/petitions/1556852/download-documents?artifactId=TA6wfdUFl_1rq_IgeoEBIXW1aOGfRurjCCxS8uSUIyeQrZmFfs0SWSo and https://ptacts.uspto.gov/ptacts/public-informations/petitions/1557246/download-documents?artifactId=HvEMAOO-dpNjR5bSzbeby8hdmEY6czrHvcs1Ho80_V3apabat49icQY — which cite EX1005 "Keren," EX1006 "Morgan" (U.S. Patent No. 12,015,631), a challenged "'257 patent" (EX1001), and EX1009 (NIST attack-graph guidance). I could not confirm from the retrieved text the IPR number, the petitioner, or the patent owner, and the excerpts in my results are from expert-declaration and petition-body pages, not the PTAB's FWDs. Treat the identity/ownership of the Keren reference as unverified — it matters enormously (§7).

---

2. Legal framework and the two threshold issues

Standard. §103 asks whether the claimed subject matter as a whole would have been obvious to a POSA at the effective filing date, in view of the scope/content of the prior art (Graham v. John Deere); the motivation to combine may come from the references themselves, the nature of the problem, or the ordinary creativity of a POSA (KSR Int'l v. Teleflex). Where the claimed advance is a graph-visualization and path-analysis workflow built from known graph and network-analysis techniques, KSR's "combination of familiar elements according to known methods" branch applies with force.

POSA definition I assume. B.S. in CS/EE (or equivalent) plus 3–5 years in cloud or network security, including hands-on work with (a) cloud provider APIs for asset/config enumeration, (b) graph modeling of network entities, and (c) vulnerability/attack-path analysis. This is deliberately the "reasonably capable generalist-plus-tools" level the Federal Circuit endorses; the Wiz co-inventors' own backgrounds (cloud-security practitioners) fit comfortably inside it.

Issue 1 — the effective-filing-date cliff (decisive). The '270 issued from 18/887,753 (filed 2024‑09‑17), claiming back through 18/479,573, 18/478,534, 18/341,134, 17/819,442, and 17/109,883 (2020‑12‑02). Google Patents itself labels that priority date "an assumption and not a legal conclusion."

• If the claims are entitled to 2020‑12‑02, then every 2022 publication (Keren's US 2022/0286479‑style publication, Morgan's US 2022/0191230 A1, Lacework's US 2022/0247769 A1) is not §102(a)(1) art, and the same-owner/same-inventor exclusions kill the Wiz-family documents as §102(a)(2) art. The case must then be built from pre‑2020 art only.
• If the claims are not entitled to 2020‑12‑02 (e.g., because the route/hop/tagging features were added by later amendment or lack §112 support in 17/109,883), the effective date collapses to 2022‑08‑12 or later and the entire 2022 body of cloud-security art becomes available, including the exact Keren + Morgan combination that a panel already credited against a sibling patent.

I therefore present two theories: a robust "priority-holds" combination (all pre‑2020 art) and a broader "priority-fails" combination (Keren + Morgan).

Issue 2 — the "Keren" qualification problem. The '270's first-named inventor is Shai Keren. If EX1005 "Keren" is a Wiz-family document (its terminology — security graph, security graph object list 450, reachability properties, numPortsOpenToInternet — and its figure layout FIGS. 4A/4B/5/6 mirror the '270's FIGS. 3A/3B) then, on the continued-prosecution reading, it is not prior art at all against the '270 (common inventorship → §102(b)(2)(A); common ownership → §102(b)(2)(C); and if published after the effective date, not §102(a)(1) art either). That is the single largest structural weakness in any Keren-based §103 challenge, and I flag it now because it drives my probability assessment in §8.

---

3. Claim 1 element-by-element mapping

Claim 1 (method; claims 10 and 11 are the same steps in CRM and system form) breaks into five limitations:

Preamble ("determining reachability of vulnerable network objects having cyber-threats"): Morgan supplies the "vulnerable asset / CVE" content (US 2022/0191230 A1 ¶¶[0011], [0049] equivalent in US 12,015,631), and Lacework '104 expressly describes "a detected vulnerability associated with one or more … cloud deployments" (claim 4) — so the preamble adds no separate inventive weight; it is a statement of intended use.

Where the claim is thin. Limitations 1.1 and 1.4 are broad. 1.1 is generic "collecting data about cloud objects" — no API-specific, agentless, or cross-account requirement appears in the claim (contrast the '270 specification, which foregrounds API querying). 1.4's "insight … include at least a route" is satisfied by any path output of a graph traversal. The only limitation with real bite is 1.5's causal link ("tagging … for which the insight is generated").

---

4. The combinations

Combination A — "Keren + Morgan" (the PTAB-proven theory)

References: Keren (security-graph document disclosing API-based object identification, a visual security graph, an object list with a route mode and hop count) in view of Morgan, U.S. 12,015,631 (Deepsurface Security; inventor Timothy Daniel Morgan; Diagnosing and managing network vulnerabilities; pub. US 2022/0191230 A1, 2022‑06‑16; granted 2024‑06‑18 per https://www.htsyndication.com/us-fed-news/article/us-patent-issued-to-deepsurface-security-on-june-18-for--diagnosing-and-managing-network-vulnerabilities---oregon-inventor-/22212401776).

Mapping: Keren covers 1.1–1.3 and the route/hop insight of 1.4 outright. Morgan supplies (i) the vulnerability dimension ("vulnerable network objects having cyber-threats") via CVE-based edge weighting; (ii) route presentation for a selected object with alternative paths and port numbers on each pathway (claim 8 of the '257 mapping in petition 1557246) — i.e., the visual route output; and (iii) the annotation/marking of graph nodes and edges with the analysis result, which meets 1.5.

Motivation (expressly articulated in the petitions, and independently sound): both references self-identify the same problem — which of a large number of vulnerable paths actually matters — and both solve it by prioritizing paths. The petition body (1557246) states the rationale directly: including attack‑path visualizations in a Keren‑type graph utility "would enhance the system's ability to identify security risks by providing additional insight into how outside threats can enter a network," and "would aid the network administrator in deciding where remediation efforts can be efficiently focused." That is a KSR-sufficient, reference‑anchored motivation, not hindsight.

Combination B — "Priority-proof" theory (all pre‑2020 art)

References: Lacework US 11,785,104 B2 (cloud-asset ingestion incl. agentless config pull; polygraphs rendered in a UI) + Lippmann US 2005/0138413 A1 and/or Noel US 2006/0085858 A1 and/or Swiler US 7,013,395 B1 / WO 2010/042979 A1 (attack graphs, hop-by-hop paths, vulnerability metrics per path, path prioritization) + NIST attack-graph guidance (EX1009 in the PTAB record).

Mapping: Lacework '104 covers 1.1–1.3 (and 1.2's visual requirement, which is the hardest element to find elsewhere); the attack-graph references cover 1.4 (route/path between enumerated entities, with the "route" being exactly a chain of hops through firewalls/routers/proxies — the '270's own FIG. 3B "9 hops" concept); the combination covers 1.5 by annotating graph nodes/edges with the computed path result — an unremarkable data-organization step.

Motivation: The '270's own Background concedes that (a) manual review of "devices, connections, and networks" is a known (if laborious) practice, and (b) protocol-agnostic traffic management tools already exist. Adapting the established attack-graph methodology to a cloud environment whose asset inventory is available from cloud provider APIs is a predictable use of a known technique for its known purpose (KSR; cf. In re ICON Health & Fitness). One caveat that cuts against the challenger: "adapting an old technique to a new environment" arguments get weakest when the new environment changes what the technique does. Here the environment changes the discovery mechanism (API-based, agentless), which the claims do not recite — so the challenger's job is easier, but a patent owner will argue the artisan would not have removed the agent/log dependency without the '270's teaching.

Combination C — for the "insight/NLP" and anomaly claims (esp. 9, 19)

References: Lacework US 11,973,784 B1 (natural-language interface: NL input → query → response, disambiguated against anomaly-detection data) and US 12,058,160 B1 (framework-generated natural-language inputs for detected events) over US 11,785,104 B2 (anomaly detection via deviation from normal-behavior distributions across deployments).

Mapping: Claim 9's "detecting an anomaly based on the generated network insights" is met by Lacework's anomaly-detection framework (baselining, distributions, "abnormally configured components … deviation from typical configurations") applied to the graph-derived insights. Note the cross-reference to the prior section: claim 1 does not recite NLP, so the abstract's "natural language processing" language is not a limitation — the NLP art matters only as §103 context/for dependents.

Combination D — the dependent claims 2–8 / 12–18

---

5. Secondary considerations / countervailing evidence

I found no evidence of unexpected results, licensing, or industry praise specific to these claims, and the record in the prior sections supplies two data points that cut against obviousness (worth stating even though they are not, strictly, §103 "secondary considerations"):

1. Orca's IPR on the sibling '554 patent (IPR2025‑01083) was denied institution (2025‑12‑15). The '554 is the same family member that was asserted by Wiz in D. Del. The art in that petition is not established in my sources, and institution denial may rest on §314(a)/§325(d) discretion rather than merits — so this is weak, but it is the only adjudicative signal on a same-family claim set.
2. The PTAB's 2025‑12‑08 FWDs invalidated Orca's 11,663,031 / 11,664,032 / 11,693,685 on a Keren‑based record (per the Joint Notice summarized in the earlier sections). If Keren was good enough to knock out three Orca patents, a challenger will argue it is good enough against the '270 — unless Keren is disqualified by common ownership, in which case it was only ever available against third-party patents and is unavailable here. This asymmetry is the analytical crux of the whole exercise.

---

6. Contradictions / items to flag

• Prior-section cross-check: the earlier sections concluded that no litigation asserts the '270 and that the '270 is not in the Orca/Wiz pleadings. That is consistent with what I see: the §103 exposure is PTAB-driven and family-level, not district-court-driven. No contradiction found.
• New potential inconsistency to flag: the earlier "Patent summary" section listed the anticipated expiration as 2040‑12‑02 and treated the 2020‑12‑02 priority as an assumption. My §2 turns that assumption into the pivotal §103 variable — I would not describe the analysis as complete without it.
• Unverified, do not treat as established: (i) the identity, owner, and priority date of "Keren" (EX1005); (ii) the IPR number, petitioner, and patent owner for ptacts petitions 1556852 / 1557246, and the identity of the challenged "'257 patent"; (iii) the effective date of the Morgan disclosure (publication 2022‑06‑16 is confirmed; its priority is not); (iv) whether any CAFC appeal was filed by the 2026‑02‑09 deadline — today (2026‑04‑26) that window has closed, and I found no docket evidence either way.

---

7. Bottom line

Strongest §103 theory — Combination A (Keren + Morgan), with Lacework '784/'160/'104 for claims 9/19. It is the only combination I found that was actually briefed by a POSA-declaration in a PTAB record, it maps every limitation of claim 1, and its motivation is expressed in the references themselves (path prioritization; remediation focus). Its two dependencies are (i) the '270 losing the 2020‑12‑02 date, and (ii) Keren not being disqualified as commonly-owned/common-inventor art.

Most robust theory — Combination B (Lacework '104 + Lippmann/Noel/Swiler/WO'979 + NIST attack graphs). It survives the priority issue entirely because Lacework's relevant disclosures may attach to its 2017‑11‑27 priority and Lippmann/Noel/Swiler/WO'979 are 2005‑2010 art. It is a cleaner KSR "known technique, known purpose" case, but it must bridge on-premises attack-graph art into a cloud asset graph, and it relies on "tagging" being recognized as routine — the weakest limitation in the claim.

Where the patent is most likely to survive: limitation 1.5, the nexus between generating the insight and then tagging the objects for which the insight was generated. No reference I have seen tags objects specifically in response to insight generation; each tags/annotates graph elements generally. A skilled patent owner will press that this is a specific data-flow choice (the '270's specification ties it to enriched compound-tag querying), and a challenger relying on "it would have been obvious to label the results" invites a hindsight objection. Expect this to be the battleground claim-construction fight ("tagging" = any label? any UI highlight? stored attribute?).

Practical next steps to firm this up: (1) resolve the '270's priority-date entitlement by comparing the issued claim language and FIG. 3B/S250 disclosure against application 17/109,883 as filed; (2) obtain the actual Keren EX1005 front page (number, assignee, inventors, priority) from the PTAB record and run the §102(b)(2) analysis; (3) pull the Morgan priority chain (US 12,015,631) and confirm whether its attack-path disclosure predates 2020‑12‑02; (4) pull Lacework's 2017 provisional (62/590,986) to confirm which polygraph/agentless-ingestion disclosures are actually supported — that determines whether Combination B is a 2017 reference or a 2022 one; (5) obtain IPR2025‑01083's institution decision to see whether the '554 denial was merits-based (which would materially weaken every theory above).