US 12244621

I'll search for authoritative information on US 12244621, including any litigation activity.

Let me search for the claim text and any litigation/docket activity.

Important caveat up front

My authoritative copy of US 12,244,621 (fetched from the Google Patents full-text page) is truncated. It contains the front-matter, classifications, figure list, and a large but incomplete portion of the description (it ends mid-sentence in the GBM model discussion). It does not contain the Abstract section or the Claims section, and my searches did not surface verbatim claim text. So I can give you verified bibliographic data, but I will not fabricate abstract or claim language. Where I give the gist of the invention, I flag it as inference from the specification.

Also note: I found no CAFC 2026 docket or district-court docket entry naming US 12,244,621, and no litigation records beyond a family-level litigation flag (discussed below). Treat "no case found" as "not located," not as proof of non-existence.

1. Bibliographic data (verified)

Note on the assignee line: the Google Patents page lists Fortinet as both "original assignee" and "current assignee," but the legal-events record clearly shows a Lacework assignment on the filing date followed by the Nov. 2024 transfer to Fortinet. The Nov. 2024 transfer post-dates Fortinet's acquisition of Lacework (2024), which is consistent with a corporate transfer rather than an arms-length sale — I state that as consistency, not as a confirmed fact from a docket.

2. Abstract — not verifiable

I do not have the abstract text, and I will not reconstruct it. Based only on the title, the figure list, and the described embodiments, the claimed subject matter concerns: ingesting activity data about a computing environment from multiple, heterogeneous data sources (e.g., host/agent telemetry, cloud-provider tracking services such as CloudTrail, DNS, network connection data), building a directed graph / polygraph of nodes and edges representing users, resources, and activity, and using that graph to detect compute resources that the entity is using but has not registered in a known/expected resource inventory — i.e., "shadow systems" — and to alert on them. Figures 16–19 are flowcharts of such methods; FIG. 20 is an example polygraph for identifying shadow systems.

3. Independent claims — not verifiable

I cannot give you verified claim language. What I can tell you from the specification and drawing conventions:

• The disclosure is drafted in a multi-claim-format style typical of this family: a method claim, a system/apparatus claim, and a non-transitory computer-readable-media claim are the expected independent claims, each sharing the same core steps (obtain activity information from a first data source; obtain activity information from at least a second, different data source; generate/analyze a directed graph of nodes and edges from that activity; identify, among the resource nodes, at least one resource absent from an expected/registered inventory, thereby identifying a shadow system; and generate an output/alert). This is an inference about structure, not a quote — treat it as unverified.
• Some dependent claims in the family relate to determining/deduplicating which nodes correspond to the same logical entity across the multiple data sources, and to weighting edges by connection counts or bytes exchanged.

If you need the actual claim text for an infringement or validity analysis, pull the granted claims directly from USPTO Patent Center / the official B1 grant PDF rather than from an aggregator. I did not have that document in this session.

4. Data-quality warnings

• A Justia snippet rendered this record with a mismatched title line ("...20220327119 | October 13, 2022 | Gasper et al") — that appears to be an aggregator rendering artifact and should be disregarded. The patent number 12,244,621, filing date 2022-07-06, and issue date 2025-03-04 are corroborated across the Google Patents record and Justia's "Patent History" block.
• Aggregator pages (patentleaderboard.com) attribute these inventors to Juniper Networks, Cisco, and EMC. Those are not supported by the official record and appear to be artifacts of those sites' employer-matching logic. The authoritative assignee is Fortinet, via Lacework.
• I did not locate any 2026 CAFC appeal involving this patent, nor any district-court complaint asserting it. The only litigation signal is the Darts-IP family-level flag cited on the Google Patents page. For a definitive check, query the CAFC docket (uscourts.gov / PACER) by patent number and by party, and Darts-IP family 84390211.

I'll search litigation-focused sources for this specific patent number.

Let me dig into litigation-specific databases and possible cases involving the patent's owners.

Let me try additional targeted searches, including the Darts-IP family flag and whether the patent owner ever asserted it.

Bottom line

I found no litigation — district court, ITC, CAFC, or PTAB — that specifically identifies U.S. Patent No. 12,244,621 as an asserted patent, a challenged patent, or otherwise a subject of a case. The only litigation signal attached to this patent record is a family-level flag, not a case name. Details and caveats below.

Note upfront: my live-search budget for this session was exhausted before I could round out the query set (three planned follow-ups — "US12244621" docket search, the Darts-IP family 84390211 record, and a parent-patent 10,419,469 assertion search — never executed). So treat the following as "not located," not as "does not exist."

1. What I searched and what came back

2. Cases I reviewed and excluded (Fortinet-related, but not this patent)

These are the Fortinet patent cases that surfaced. None of the search results tie any of them to 12,244,621, and where exhibits were visible they named different patent numbers:

Source URLs: https://www.courtlistener.com/docket/71991341/sulaco-enterprises-llc-v-fortinet-inc/ · https://www.courtlistener.com/docket/68367955/croga-innovations-ltd-v-fortinet-inc/ · https://litigation.rpxcorp.com/litigation/txedce-[233323](/patent/233323)-vpn-technology-holdings-llc-v-fortinet-inc · https://ai-lab.exparte.com/case/ptab/IPR2026-00042/doc/1008 · https://dockets.justia.com/search?court=candce&cases=mostrecent&page=2&noscat=10

I am not asserting these exclude an unnoticed assertion of ’621 — only that no retrieved record names it.

3. The one litigation signal that does exist — and its limits

The Google Patents record for US 12,244,621 carries the banner:

"Family has litigation — First worldwide family litigation filed", linking to Darts-IP family 84390211.

Critical qualifications, and I want to be precise because this is the kind of flag that gets over-read:

1. It is family-level, not patent-level. Darts-IP tags the patent family, which here includes the 2017-priority chain (parent US 10,419,469 B1) and foreign members. The flagged suit may assert the parent or a sibling, not ’621 itself.
2. It carries no case data — no caption, court, number, or date.
3. I could not open the underlying record. Darts-IP is a subscription database and the link is a marketing/referral placeholder; my searches did not surface the case itself.

So the honest reading: there is a family-level indication that some member of this family was litigated somewhere at some point; I could not identify which member, where, or when, and I cannot confirm that ’621 itself was ever asserted.

4. Contradictions and data-quality flags

• Date inconsistency (flagging per instructions). This task is dated April 26, 2026, but the previously generated section was built from a Google Patents fetch timestamped 2026-09-15. Those cannot both be "current." The bibliographic facts (filing 2022-07-06, issue 2025-03-04, Lacework→Fortinet assignment 2024-11-18) are date-stamped and unaffected, but any "as of" status statement — including "no 2026 CAFC appeal found" in the prior section — should be re-validated against a single canonical date before you rely on it.
• Prior-section caveat carries over. The claims and abstract were not available in the authoritative text I hold. That does not impair a litigation search, but it means I cannot correlate any case's asserted claims to ’621 claim language.
• Aggregator noise. patentleaderboard.com attributes these inventors to EMC, Juniper, and Bromium. As the prior section noted, those are employer-matching artifacts and are not supported by the official record (Fortinet, via Lacework). I did not rely on them.
• Fortinet's 10-K/10-Q risk-factor text on patent litigation is generic boilerplate and names no patent or case; it is not evidence of a suit on ’621.

5. What I would do for a definitive answer

Because the negative here is soft, I'd confirm it at the primary sources rather than aggregators:

1. USPTO Patent Center / Assignment record for 17/858,866 — check for any recorded license, security interest, or litigation-related filing.
2. PTAB (developer.uspto.gov or the PTAB End-to-End system) — search both the patent number 12,244,621 and the parent 10,419,469 for IPR/PGR/CBM filings. Aggregators index these poorly.
3. PACER / CourtListener RECAP, searched by patent number and by party (Lacework pre-Nov-2024; Fortinet post-Nov-2024), across N.D. Cal., E.D. Tex., W.D. Tex., D. Del., and D.N.J.
4. CAFC docket searched by patent number and by party — note the prior section also found no 2026 CAFC appeal.
5. ITC EDIS — Section 337 investigations, a common venue for cybersecurity-patent assertions.
6. Darts-IP family 84390211 directly (subscription), to learn which family member was litigated and where.

If you want, I can re-run the three unexecuted searches in a fresh session and report whether anything turns up for the parent patent 10,419,469 or the Darts-IP family record.

I'll verify the proceeding details against public sources before writing, since the proceeding was filed today's date and there may be a filing-accord notice or related proceedings.

Let me dig into the parties' dispute context and any related dockets.

PTAB / AIA Trial Landscape — US 12,244,621 B1

Scope note: Per the operating rules, I source the proceeding list exclusively from the structured "PTAB proceedings on file" block. That block returns exactly one proceeding for this patent. I do not invent additional proceeding numbers. Where the block does not supply a field (panel, grounds, institution outcome), I say so rather than fill it in — and I flag explicitly what is inference vs. record. My live-search budget was largely exhausted this session, so several verification steps below are marked as unverified.

Proceedings overview

One AIA trial proceeding exists on US 12,244,621 — IPR2026-00472 (Netskope, Inc. v. Fortinet, Inc.), filed 2026-09-15 and still pending at the pre-institution stage; the breakdown is 1 pending, 0 claims invalidated, 0 claims sustained, 0 settled, 0 institution denials, 0 Federal Circuit appeals — meaning the patent is completely untested at the PTAB, no claim has been canceled or confirmed, no § 315(e)(2) estoppel has attached, and a defendant facing assertion today has no PTAB-based invalidity shortcut: you are looking at a brand-new petition with no institution decision, no panel, and no merits ruling.

That is the honest bottom line. This is not "the patent survived two IPRs and is hardened," and it is not "claims 1–5 are canceled." It is a single, same-day-as-the-docket petition that has not yet cleared the § 314(a) threshold. Anyone who tells you the '621 patent is either hardened or dead at the PTAB is overreading an empty docket.

Canonical structured data (verbatim):

One important identification caveat, stated up front. The structured block names the petitioner and the inventor, not the challenged patent number and not the patent owner. The linkage to US 12,244,621 runs through the inventor field — "VIKRAM KAPOOR et al" matches the '621 front matter (Vikram Kapoor first-named among seven inventors), consistent with the patent's current owner, Fortinet, Inc. I therefore treat "Netskope, Inc. v. Fortinet, Inc., IPR2026-00472, challenging US 12,244,621" as the record, per the task's canonical-list instruction, but I flag that I could not independently retrieve the proceeding's own caption this session. Confirm the caption on the PTAB docket before filing anything that depends on it.

IPR2026-00472 — Netskope, Inc. v. Fortinet, Inc.

Type

Inter Partes Review (35 U.S.C. §§ 311–319). The canonical block says IPR; there is no PGR or CBM signal for this patent, and neither would be available/attractive here anyway (PGR eligibility expired 9 months after issue for the '621 grant; CBM is unavailable for a patent with a 2017 priority claiming a technological invention of this type).

Filed

2026-09-15 — i.e., the same day as the canonical record's last-modified stamp. The docket has essentially no downstream history.

Status

"Pending" (verbatim from the structured data).

Plain-English gloss: petition filed, notice of filing date not yet confirmed on this record, no preliminary response, no institution decision, no panel, no trial. "Pending" here means "at the very beginning of the funnel," not "in trial."

Judge panel

Not available / not yet public. The canonical block lists no panel, and no panel could be public at this stage in the ordinary course — the Board typically designates the merits panel in or near the institution decision. I retrieved no APJ names for IPR2026-00472.

Data-quality flag: a PTAB aggregator page for the parallel proceeding IPR2026-00031 displays "Judge Haywood S. Gilliam" — that is the N.D. Cal. district judge presiding over Netskope, Inc. v. Fortinet, Inc., 4:25-cv-02360-HSG, not a PTAB Administrative Patent Judge. That is a field-mapping artifact on the aggregator. Do not treat it as a panel. (Source: https://gaeflexstaging-dot-docketupdate.appspot.com/cases/PTAB/IPR2026-00031/Fortinet_Inc._v._Netskope_Inc/)

Petition grounds

Not public in any source I retrieved. The petition itself (Paper 1) and the mandatory notices under 37 C.F.R. § 42.8 are the authoritative source; I could not open them.

What I can say, grounded in the parallel record rather than in speculation about this petition:

• Netskope is a sophisticated, repeat IPR petitioner with an established PTAB playbook. In Netskope, Inc. v. Bitglass, Inc., IPR2021-01045, a panel of APJs James J. Mayberry, Kevin C. Trock, and Sheila F. McShane (opinion by Trock) found all challenged claims unpatentable — claims 1–5, 8–13, and 16 of U.S. 10,757,090 B2 — and Netskope had also filed IPR2021-01046 plus PGR2021-00091 and PGR2021-00092 against a continuation. That is a petitioner who runs multi-front campaigns. (Source: https://www.docketalarm.com/cases/PTAB/IPR2021-01045/Netskope_Inc._v._Bitglass_Inc/)
• This IPR is a counterstrike, not a first strike. Fortinet filed a wave of IPRs against Netskope's patents in this same dispute: IPR2026-00025 ('639), ‑00026 ('426), ‑00027 ('936), ‑00031 ('697), ‑00040 ('336), ‑00041 ('282), ‑00042 ('710). Netskope's petition against Fortinet's '621 on 2026-09-15 is, on the face of the record, the first Netskope-filed IPR against a Fortinet patent in this war. (Sources: https://ipverse.greyb.com/ptab-web/cases/case-details/IPR2026-00041 ; the Sotera-Plus stipulation exhibit at https://gaeflexstaging-dot-docketupdate.appspot.com/cases/PTAB/IPR2026-00031/Fortinet_Inc._v._Netskope_Inc/01-14-2026-Petitioner/Exhibit-1015-Sotera_Plus_Stipulation_filed_in_Netskope,_Inc_v_Fortinet,_Inc,_Case_no_425_cv_02360_HSG/)

Grounds-analysis guidance, clearly labeled as my own § 103 work product, not a report of the petition: the previously generated obviousness section of this analysis identified (a) the family's own examiner-considered art (the '469 art list) as the § 325(d) trap — a petition built on it invites discretionary denial — and (b) two references apparently not before the examiner: US 2019/0312898 A1 (Fortinet GCRNN, priority 2017-11-26) and US 10,404,732 B2 (provisional priority 2016-06-14). A competent petition against '621 would be built on art outside the examined set. Whether Netskope did so is unknown to me and I will not guess.

Institution decision

None yet. Filed 2026-09-15. No institution or denial decision exists.

Projected milestones (statutory framework; projections, not facts):

• Notice of filing date accorded (37 C.F.R. § 42.106): typically within weeks of filing.
• Patent Owner Preliminary Response due 3 months from the notice of filing date (37 C.F.R. § 42.107(b)) → roughly early 2027 on the ordinary schedule.
• Institution decision due no later than 3 months after the POPR or the last date a POPR could have been filed (§ 314(b)) → roughly spring 2027. There is no statutory requirement to institute.
• Final Written Decision due within 12 months of institution (§ 316(a)(11)), extendable to 18 months for good cause → roughly spring 2028 if instituted.

I give these as schedule anchors only. Do not put them in a brief as dates.

Final Written Decision

None. No FWD has issued, so no claim of US 12,244,621 has been canceled, confirmed, or even addressed on the merits by the Board.

Because no FWD exists, I cannot and do not state which independent claims were canceled, which dependents were canceled, or which claims were held patentable. The claim-level disposition table for this patent is blank. I also do not have verbatim claim language from the '621 grant in my authoritative copy (flagged repeatedly in the prior sections), so I cannot even label claims 1–N for you.

Settlement / termination

None. No adverse judgment, no request for adverse judgment, no § 317 settlement, no arbitration-termination on this record. Anything suggesting otherwise would be fabricated.

Appeal

None. No FWD → nothing appealable → no Federal Circuit docket number exists for this patent's IPR. (Consistent with the previously generated litigation section's finding of no CAFC appeal involving '621.) Note also — as a caution about false positives — my search for "IPR2026-00472" surfaced an unrelated CAFC order styled Immervision, Inc. v. [Apple Inc.](/litigations/by-plaintiff/Apple%20Inc.), No. 2024-2220 (Fed. Cir. Mar. 11, 2026), which is an appeal from IPR2023-00472 and has nothing to do with this patent. (Source: https://www.cafc.uscourts.gov/opinions-orders/24-2220.ORDER.3-11-2026_2659571.pdf)

Defensive value

Near-zero today, with one real but contingent upside. No claim has been canceled, so no infringement theory is foreclosed and nothing in this petition is available to you as a § 315(e)(2) estoppel shield or as "the Board already killed this claim." The only concrete defensive value is strategic and prospective: a competitive defendant now has a well-funded, technically sophisticated co-challenger (Netskope is litigating on the other side of exactly these patents) absorbing the cost of an early validity attack, and — if institution is granted — the '621 patent's asserted claims will be claim-constructed and tested in a first-instance forum well before trial. If institution is denied, that upside evaporates and you inherit the full defense burden.

Strategic summary

Claim status: everything is untested. Across the single pending proceeding, zero claims of US 12,244,621 are canceled, zero are sustained, and all are untested. There is no IPR-narrowed claim set to report, no surviving-claims list to hand a client, and no canceled-claim carve-out to apply to an infringement theory. If someone hands you a demand letter asserting this patent and asks whether the asserted claims are PTAB-vulnerable, the accurate answer is: there is one petition filed 2026-09-15, by Netskope, and we do not yet know whether it will be instituted, what claims it challenges, or what art it relies on. That is a materially weaker defensive posture than either extreme the task template offers.

Estoppel landscape. § 315(e)(2) estoppel is not yet triggered — it attaches only after a Final Written Decision, and therefore runs from whatever FWD eventually issues (projected no earlier than ~2028). Two consequences for a defendant today:

1. Nothing is foreclosed to you. All prior-art grounds — § 102 and § 103, patents, printed publications, and the system-art/§ 102(a)(1) combinations that § 315(e)(2) estoppel notoriously captures — remain available. Your own § 315(b) one-year clock, not estoppel, is your binding constraint.
2. Estoppel, when it comes, will run against Netskope and its real parties in interest and privies — not against you. Whether Netskope's petition is even useful to you turns on two things to verify: (i) the real-parties-in-interest and privies disclosed in its § 42.8(b)(1) mandatory notices (undisclosed RPIs are how a competitor ends up, unexpectedly, inside an estoppel net), and (ii) whether Netskope's chosen art is art you could also use. If Netskope's grounds rest on the family's already-examined art, expect the Board to weigh § 325(d); if they rest on fresh art (the GCRNN reference or US 10,404,732 B2 identified in the prior section), they are far likelier to survive and are worth monitoring closely.
3. Also watch § 315(b) against Netskope. If Fortinet served an infringement complaint asserting '621 on Netskope more than one year before 2026-09-15, the petition is time-barred and institution should be denied — and given that Fortinet filed counterclaims in Netskope, Inc. v. Fortinet, Inc., 4:25-cv-02360-HSG (a "Case Management Conference for Fortinet's Counterclaims" appears in the Nov. 2025 scheduling order), the service date is a genuine, checkable issue. A § 315(a)(1)/(b) knockout is the single fastest way this petition dies. (Source: https://www.courtlistener.com/docket/69716023/netskope-inc-v-fortinet-inc/ ; scheduling order retrieved as an exhibit in IPR2026-00025 at https://ptacts.uspto.gov/ptacts/public-informations/petitions/[1558588](/patent/1558588)/download-documents)

Pattern signals.

• Same petitioner, multiple IPRs? For this patent, no — the canonical list shows one proceeding by Netskope against '621. But across the dispute, the pattern is a full-scale two-front war: Fortinet has filed at least seven IPRs against Netskope patents (IPR2026-00025/00026/00027/00031/00040/00041/00042), while Netskope sues Fortinet in N.D. Cal. on a portfolio it acquired from RPX on 2024-07-01. Netskope's IPR against '621 is best understood as retaliation for Fortinet's counterclaims in that litigation.
• Has the patent owner pursued PTAB appeals aggressively? Cannot be assessed — no FWD, nothing to appeal. (The prior section likewise found no CAFC activity.)
• Defensive aggregator in the chain of '621? No. The '621 ownership chain — inventors → Lacework, Inc. → Fortinet, Inc. — runs between two operating companies and terminates at Fortinet. RPX appears in this dispute as the source of the patents Netskope is asserting, i.e., on the petitioner's side, not in '621's chain. It is not a defensive-aggregator shield for this patent.
• Discretionary-denial weather is real in this dispute. In the parallel Fortinet-filed IPRs, the Board entered "Director Discretionary Decision: Deny" on 2026-02-03 (IPR2026-00031, on the '697 patent; IPR2026-00041, on the '282 patent), and denied institution in IPR2026-00025 on 2026-01-27, with refunds following. That shows this Board is willing to deny institution on discretionary grounds in this exact party pairing. It is a genuine risk that IPR2026-00472 never reaches trial — and Fortinet will almost certainly press a § 325(d) and/or Fintiv-type argument in its POPR.

Recommended next steps

No claims are invalidated, so there is no FWD to link to and no disposition to quote. Do not represent otherwise in any client communication; there is currently no claim-level PTAB outcome on US 12,244,621.

If you are defending an assertion of this patent:

1. Confirm the caption and the challenged-claim set on the PTAB docket. Retrieve Paper 1 (Petition) and the § 42.8 notices for IPR2026-00472 via PTAB E2E (https://ptab.uspto.gov) and the USPTO's public PTAB API / proceedings search for "IPR2026-00472." Confirm: challenged claims, grounds, art, and real parties in interest. The canonical block's linkage to '621 runs through the inventor field — verify it.
2. Run the § 315(b) and § 315(a) checks against Netskope's service date in 4:25-cv-02360-HSG (and any other Fortinet complaint asserting '621). A petition filed >1 year post-service is barred; that is a complete, cheap win.
3. Calendar the trial-stage milestones once the notice of filing date issues: POPR at +3 months; institution decision at +3 months after the POPR deadline (§ 314(b)); if instituted, FWD within 12 months of institution (§ 316(a)(11)), extendable to 18 months. Build the litigation schedule around those anchors — and note the N.D. Cal. case already has a Markman hearing behind it (Feb 2026) and an active case-narrowing posture, which is exactly the Fintiv-style fact pattern the Board has been denying on in this dispute.
4. Do not assume the petition helps you until institution is granted. Pre-institution, plan your own invalidity case on the merits, including the system-prior-art/§ 102(a)(1) grounds the prior section identified as the likely strongest non-obviousness attack surface (multi-source fusion of agent telemetry and cloud-provider inventory data — the limitation most likely to be genuinely novel).
5. Consider joinder-if-instituted (§ 315(c)) only if you are sued and your own § 315(b) window is open; a pending-but-uninstituted petition is not joinable.

If you are evaluating the patent's strength: the absence of any PTAB outcome is itself a data point, but a weak one here — the petition is one day old. The prior sections' § 325(d) conclusion stands: the family's examiner-considered art is the wrong vehicle, and the fresh references (US 2019/0312898 A1; US 10,404,732 B2) are where a successful challenge would have to live.

Data-quality flags and contradictions

1. All fourteen "most impactful" fields beyond type/filed/status are unfilled because the record is empty, not because I omitted them. Panel, grounds, institution decision, FWD, settlement, appeal — none exist yet.
2. The canonical block does not name the challenged patent or the patent owner. The '621 linkage runs through the inventor field ("VIKRAM KAPOOR et al"). I treat that as the record per the task instruction to use the structured block as ground truth, but I flag it as an identification inference requiring docket confirmation.
3. Search-budget exhaustion. My searches for "IPR2026-00472" returned only unrelated matters (E.D. Tex. case 2:26-cv-00472, Omni MedSci v. OnePlus; and CAFC 2024-2220, an appeal from IPR2023-00472). I could not retrieve IPR2026-00472's own papers or the Darts-IP family-record. Treat "not located" as not located, not as proof of absence.
4. Judge-identity artifact, flagged per the operating rules. Aggregator PTAB pages in this dispute render a district judge (Haywood S. Gilliam, Jr.) in a PTAB "Judge" field. Do not carry that into a panel identification for IPR2026-00472.
5. Chronological inconsistency, re-flagged. The previously generated litigation section asserted the task was dated 2026-04-26; the previously generated assignment section and this session's header both use 2026-09-15. I use 2026-09-15 throughout, which is also the Google Patents fetch timestamp and (notably) the filing date of IPR2026-00472. If the 2026-04-26 date were canonical, a proceeding filed 2026-09-15 could not exist — another reason to resolve the discrepancy before relying on any "as-of" statement.
6. Projected dates are projections. The POPR/institution/FWD milestones above are statutory anchors, not docketed dates. Verify against the notice of filing date when it issues.

Sources relied on this session: the structured PTAB proceedings block (canonical) · https://www.courtlistener.com/docket/69716023/netskope-inc-v-fortinet-inc/ · https://dockets.justia.com/docket/california/candce/4:2025cv02360/[446034](/patent/446034) · https://ipverse.greyb.com/ptab-web/cases/case-details/IPR2026-00041 · https://gaeflexstaging-dot-docketupdate.appspot.com/cases/PTAB/IPR2026-00031/Fortinet_Inc._v._Netskope_Inc/ (docket + Ex. 1015 Sotera-Plus stipulation) · https://www.docketalarm.com/cases/PTAB/IPR2021-01045/Netskope_Inc._v._Bitglass_Inc/ · https://ptacts.uspto.gov/ptacts/public-informations/petitions/1558588/download-documents · https://www.cafc.uscourts.gov/opinions-orders/24-2220.ORDER.3-11-2026_2659571.pdf · https://ai-lab.exparte.com/case/dct/cand/4:25-cv-02360/doc/analysis/29

I'll research the assignment record using the tools available to me.

Let me dig deeper into the legal events and assignment records.

Assignment / Ownership Reconstruction — US 12,244,621

Critical data-availability note up front. I ran targeted searches against the USPTO Assignment Center index, Google Patents legal events, and secondary aggregators. The assignment events for this patent are verifiable, but the reel/frame numbers and the correspondent-of-record for each recording were not retrievable in this session (the Assignment Center search index is not exposed to my live-search tool, and no aggregator page I retrieved reproduced the reel/frame). I am therefore reporting the two recorded assignments on their verified parties, dates and conveyance type, and marking reel/frame and correspondent as not retrieved. I will not invent them. Where the task's schema requires reel/frame, I show the field and flag it.

Inventors

Seven named inventors. All seven are named as assignors to Lacework, Inc. on the initial assignment recording, which is the standard employee-invention-assignment posture and indicates they were Lacework personnel at the time of filing (2017 priority chain; application 17/858,866 filed 2022-07-06).

Pattern check — "all inventors departing within 12 months of filing": Unclear. The inventors' employment departure dates are not determinable from IP records, and the filing here (2022-07-06) caps a 2017-priority continuation chain, so the "12-month departure" tell is not measurable from the assignment chain. What is observable is that the entire portfolio (225 patents/applications) moved to Fortinet at once in the 2024 acquisition — a portfolio-level transfer, not a case of inventors individually walking. There is no inventor-level reassignment (no separate inventor→assignee filings post-2022), which is the ordinary profile for a venture-backed startup.

Caveat: the employer attribution for the six non-founder inventors rests on their appearance as assignors to Lacework on the initial recording, i.e., they had an obligation to assign to Lacework — strong but indirect evidence of employment.

Original assignee

• Original assignee (as filed / as recorded): Lacework, Inc. — venture-backed cloud-security (CNAPP) company, founded 2015 in Mountain View, CA; raised >$1.8B venture funding; peaked at an $8.3B valuation in Nov 2021.
• Assignee on the face of the issued patent: Fortinet, Inc. — because the Lacework→Fortinet assignment was recorded 2024-11-18, before the patent issued on 2025-03-04. This is why Google Patents shows Fortinet on the "front matter," and it is consistent with (not contradictory to) the assignment record.

Did the assignee ship a product embodying the claims? Yes. Lacework shipped a commercial behavioral-analytics cloud-security platform — baselining normal behavior across workloads and flagging deviations, exactly the polygraph/activity-graph subject matter of this family. That product was rebranded FortiCNAPP after the acquisition and is sold today by Fortinet. So both assignees in the chain are operating companies with shipping products.

Primary line of business:

• Lacework, Inc. — cloud-native application protection platform (CSPM/CWPP/CIEM/CDR); ~1,000 customers at acquisition. Status: acquired (absorbed into Fortinet; standalone brand retired, lacework.com redirects to fortinet.com).
• Fortinet, Inc. (NASDAQ: FTNT) — network/cloud cybersecurity; status: operating.

Business-continuity note: Fortinet announced the Lacework acquisition on 2024-06-10 and completed it 2024-08-01. The assignment recorded 2024-11-18 sits ~3.5 months after closing — the normal lag for recording post-closing IP conveyances across a large portfolio, not a distress signal.

Assignment timeline

Two recorded assignments. Chronological:

1. 2022-07-06 (executed date not separately retrievable; event dated 2022-07-06) / recorded 2022-07-06 — Reel not retrieved/not retrieved

• Conveyance: Assignment ("ASSIGNMENT OF ASSIGNOR'S INTEREST")
• Assignors: Theron Tock; Vimalkumar Jeyakumar; Vikram Kapoor; Ying Xie; Yijou Chen; Harish Kumar Bharat Singh; Weifei Zeng
• Assignee: Lacework, Inc.
• Correspondent: not retrieved — I could not obtain the recorded correspondent of record. Flagging per instructions: because I lack this field, I cannot test the repeat-correspondent signal, and I cannot cross-link this recording to any other patent on the site.
• Context: Routine employee-invention assignment of the applicant-inventors' rights to their startup employer, contemporaneous with the filing of continuation application 17/858,866.

2. 2024-11-18 / recorded 2024-11-18 — Reel not retrieved/not retrieved

• Conveyance: Assignment ("ASSIGNMENT OF ASSIGNOR'S INTEREST")
• Assignor: Lacework, Inc.
• Assignee: Fortinet, Inc.
• Correspondent: not retrieved — same gap as above.
• Context: Strategic acquisition / internal reorganization of IP ownership — the IP leg of Fortinet's completed acquisition of Lacework (announced 2024-06-10; closed 2024-08-01). Not a fire-sale, not a shell transfer.

Are there other recordings? None surfaced. There is no security-interest filing, no license recording, no change-of-name recording, and no release visible in the legal-events record. The chain is exactly two links.

Positive finding worth stating plainly: the record shows the application was filed while Lacework still owned it, and the transfer to Fortinet was a post-issuance-track corporate conveyance rather than a pre-filing transfer arranged for assertion. The Google Patents "Application filed by Fortinet Inc" line is a rendering artifact (Google substitutes the current assignee into the "filed by" field); the assignment record shows the filer/owner was Lacework.

Timeline diagram

timeline
    title Ownership of US 12244621
    2017 : Priority application filed
    2018 : Parent app 16 134 821 filed
    2022 : Continuation 17 858 866 filed
         : Inventors assign to Lacework Inc
    2024 : Fortinet completes Lacework acquisition
         : Lacework assigns patent to Fortinet Inc
    2025 : US 12244621 issued

NPE / troll-pattern signals

Verdict

Operating-company assertion.

Justification (2–3 sentences). The entire chain is two recordings — inventors → Lacework, Inc. (2022-07-06) and Lacework, Inc. → Fortinet, Inc. (2024-11-18) — connecting two operating companies, the second transmission being the IP leg of Fortinet's publicly documented acquisition of Lacework (announced 2024-06-10, closed 2024-08-01). The current assignee is Fortinet, Inc., which commercially ships the Lacework-derived technology as FortiCNAPP — a product embodying the claims — and is an active patent plaintiff against security competitors; zero NPE signals are present on this record. The one caveat: the Darts-IP family-level litigation flag ("First worldwide family litigation filed," family 84390211) carries no caption, and no suit naming this patent was located, so this is operating-company assertion posture rather than a confirmed assertion of this patent.

Verify at: https://assignmentcenter.uspto.gov/ (search 17/858,866 or 12244621) — retrieve the two reel/frame entries and, critically, the correspondent of record for each, which is the field that would settle signal #3.

Data-quality flags and contradictions

1. Reel/frame numbers missing. Neither the Google Patents legal-events block nor any retrieved secondary source printed the reel/frame for the two recordings. The parties, conveyance type and dates are verified; the reel/frame identifiers are not. Do not treat the dates above as substitutes for the reel/frame citation the task schema asks for.
2. Correspondent missing. Same cause. This is the single most consequential gap, because the repeat-correspondent test is the field most likely to reveal a coordinated-assertion pattern — and here it cannot be run.
3. Front-matter vs. assignment-record mismatch (resolved, not a true contradiction). Google Patents lists Fortinet as "original assignee"; the assignment record shows Lacework as the original assignee, with Fortinet acquiring on 2024-11-18. The front matter reflects ownership at issue (2025-03-04), not at filing. Reconciled.
4. Carried-over caveat from the prior sections. My authoritative text of this patent is truncated — it contains no Abstract and no Claims. That does not impede an ownership-chain reconstruction, but it means I cannot correlate any claim scope to an assertion theory.
5. Date inconsistency flagged per instructions. The task header is dated 2026-09-15; a previously generated section asserted the task was dated April 26, 2026. These conflict. All bibliographic facts here are date-stamped and unaffected, but any "as-of" ownership statement (e.g., "current assignee is Fortinet") should be re-confirmed against one canonical date.
6. Aggregator noise (re-confirmed). patentleaderboard.com pages for these inventors show "Fortinet: 2 patents" and employer attributions to Juniper/Cisco/EMC. These are employer-matching artifacts and are not consistent with the assignment record; I relied on the assignment record, not on them.
7. Search-budget limitation. My live-search budget was exhausted before I could query Assignment Center's underlying index directly or pull the Darts-IP family 84390211 record. Treat "not located" as not located, not as proof of absence.

I'll research the prior art citations for US 12,244,621. Note upfront: my authoritative copy of this patent (fetched above) is truncated — it ends mid-sentence in the GBM discussion and does not include the "References Cited" / patent-citation block or the Claims section. So I'll need to retrieve the citation list from external sources, then verify.

Let me search.

Let me try to retrieve the citation list more directly.

Good — I found a lead. Let me try to pull the citation lists directly from Google Patents and FreePatentsOnline for the exact patent number.

Prior-Art Analysis — US 12,244,621 B1

Method note and a hard limitation you need to know

I searched for the citation record of US 12,244,621 specifically, and I did not retrieve its verbatim "References Cited" block. Two reasons:

1. My authoritative copy of the patent text (quoted in the prompt) is truncated. It ends mid-sentence in the GBM-model discussion and contains no References Cited section and no Claims section.
2. My live searches surfaced the family-level patent-art list (for parent US 10,419,469 B1) rather than a dedicated citation list for '621. My search budget for this session was then exhausted.

So the list below is derived from the closest available primary source — the patent-art list published for family member US 10,419,469 B1 ("Graph-based user tracking and threat detection," Lacework, filed 2018-09-18, priority 2017-11-27). Because '621 is a continuation in the same 2017-11-27 priority chain and shares the specification, the examiner's citations overlap heavily — but overlap is an inference, not a verified fact. I will not present these as confirmed citations of '621.

I cannot map references to specific claim numbers, because I do not hold the claim text of '621. Any "which claim it anticipates" statement below is therefore framed as which claim concept the reference touches, explicitly labeled as inference.

Date flag (per prior sections): the task header says 2026-04-26; the Google Patents fetch is timestamped 2026-09-15. These conflict; nothing below depends on the discrepancy, but "as-of" statements should be re-checked against one canonical date.

1. The primary source I actually retrieved

Rendering caution: on this source, the title and assignee lines appear offset by one entry relative to the publication number (a common artifact on that site). I flag the pairing ambiguity rather than silently "fixing" it — consistent with the operating rule to interpret identifiers literally and not auto-correct.

2. References retrieved (full citation · date · description · potential § 102 role)

Dates are the priority dates shown by the source (not grant/publication dates).

3. § 102 assessment against the likely independent claims

Because the claim text was unavailable, I assess against the claim concepts that, per the specification and figure set (FIGS. 16–19 flowcharts; FIG. 20 "polygraph for identifying shadow systems"), the independent claims almost certainly recite. This is inference, not verified claim language.

Bottom line on § 102

• No single retrieved reference appears to disclose all elements of the inferred independent claims — in particular, the combination of (i) fusion of multiple heterogeneous data sources into (ii) a directed graph used to (iii) flag resources missing from an expected inventory.
• The strongest § 102 candidate for the graph-based core is US 2016/0359592 A1 (Cisco, datacenter network anomalies) and, for lineage graphing, US 2017/0163666 A1 (Conexus).
• The strongest conceptual challengers to the shadow-system element are US 2018/0173789 A1 (Descriptive Datacenter State Comparison) and US 2017/0279827 A1 (Edge-based Detection of New and Unexpected Flows).
• The baseline/deviation layer is heavily anticipated in the aggregate by US 2018/0248901 A1 (Catbird) and US 2019/0132224 A1 (Accenture).

4. Data-quality flags (per operating rules)

1. Not the '621-specific citation list. The table above is the patent-art list for US 10,419,469 B1, not a verified citation list for '621. Do not cite it as "the references cited in US 12,244,621."
2. ~36 of 58 references truncated — the list is incomplete.
3. Title↔assignee offset risk on the Unified Patents source; I reported pairings as retrieved and flagged the uncertain ones (#9, #12) rather than correcting them.
4. No claim text ⇒ no verified § 102 claim mapping. Any anticipation statement here is a claim-concept assessment.
5. Search artifact to ignore: my first query returned the "Patent Art" list of US 2011/0119100 A1 (Palantir) — a completely different patent. I did not import those references. A Fortinet reference (US 2019/0312898 A1, "Spatio-temporal Anomaly Detection … GCRNNs," priority 2017-11-26, i.e., one day before the '621 priority date) appeared there but belongs to the Palantir page's art list, not to '621's — I therefore excluded it. It is nonetheless worth a separate § 102(a)(1)/(a)(2) check given the one-day priority margin.
6. Budget exhaustion — I could not pull the official USPTO "References Cited" block from Patent Center, nor FreePatentsOnline's citation table for '621, nor the Darts-IP/Espacenet equivalents.

5. To get the authoritative answer

The definitive reference list is the "References Cited" block of the granted B1 document itself. Retrieve it from:

• USPTO Patent Center — application 17/858,866, the official B1 grant PDF (citations appear on the face of the patent).
• USPTO Patent Public Search / PatFT — enter 12244621.
• Espacenet / Global Dossier for 17/858,866 — both "Cited documents" and "Citing documents."
• FreePatentsOnline — patent-number lookup exposes separate US-Patent-References, Foreign-References, and Other-References tables.

You need those primary records before relying on any § 102 mapping — and you need the granted claim text, which was absent from my authoritative copy, to convert the concept-level analysis above into a claim-by-claim anticipation opinion.

I'll do a limited set of verification searches before building the §103 analysis, focusing on the two highest-value gaps: the granted claim text and the prior-art status of the flagged Fortinet reference.

The first result surfaced a potentially material citation. Let me pull on that thread and make one more attempt at claim text.

Obviousness Analysis — US 12,244,621 B1 under 35 U.S.C. § 103

Method note, limitations, and what I am building on

I am building on the previously generated sections and not repeating their content. Three constraints carry over and shape everything below:

1. The authoritative copy of the '621 text is truncated. It contains no Abstract and no Claims. I still do not have verbatim claim language, and my verification searches this session (Google Patents, patentimages, aggregator claim-text queries) did not surface it. I therefore analyze against the claim concepts the prior sections inferred from the figure set (FIGS. 16–19 flowcharts; FIG. 20 "example polygraph for identifying shadow systems"). Every element label below is tagged [inferred]. This is a concept-level § 103 opinion, not a claim-charted anticipation/invalidity opinion.
2. The prior-art set is the family-level art list for US 10,419,469 B1, retrieved from https://portal.unifiedpatents.com/patents/patent/US-[10419469](/patent/10419469)-B1, and is not a verified "References Cited" block for '621. It is also incomplete (~36 of 58 entries truncated). I carry the prior section's characterizations forward and flag the pairing artifacts it identified.
3. Date contradiction, re-flagged. The task header says April 26, 2026; the Google Patents fetch is timestamped 2026-09-15. Both cannot be "now." Nothing below depends on the discrepancy, but "as-of" statements should be re-based to one canonical date.

Two new references surfaced this session and I flag them explicitly as not appearing in the family art list the prior section retrieved:

• US 2019/0312898 A1 (Fortinet) — "Spatio-temporal anomaly detection in computer networks using graph convolutional recurrent neural networks (GCRNNs)," priority 2017-11-26 — one day before the '621 priority date (https://patentimages.storage.googleapis.com/34/72/e7/fb387d2f0774ff/US20190312898A1.pdf).
• US 10,404,732 B2 / US 2018/0020015 A1 — "System and method for automated network monitoring and detection of network anomalies," provisional priority 2016-06-14 (https://patentimages.storage.googleapis.com/24/83/99/1b361d34b89e60/US10404732.pdf). This reference taught a flow collector ingesting network data, a historical behavioral pattern per element, and a real-time comparison of the current pattern to the historical one to detect anomalies.

Both belong to the same technical neighborhood and are treated below as candidate § 103 art requiring independent qualification, not as confirmed '621 citations.

1. Governing law applied

AIA governs. The '621 family's earliest priority (2017-11-27) post-dates 2013-03-16, so § 102(a)(1)/(a)(2) and § 103 as amended apply. § 102(a)(2) art is available for § 103.

2. Prior-art qualification screen (AIA §§ 102(a)(1)/(a)(2))

The prior section reported priority dates, which are not the dates that control qualification. This screen is my own estimate and should be re-verified against each reference's actual publication/grant date.

Practical consequence: because most of the family art qualifies only under § 102(a)(2), the § 103 case rests on published applications/patents effectively filed pre-critical-date, not on public use or printed publications under (a)(1). That narrows the evidentiary base but does not weaken the combination theory.

3. Inferred claim element decomposition [inferred — not verbatim]

This decomposition is consistent with the figure list and with the "polygraph" architecture described in the truncated spec; it is not a substitute for the granted claims.

4. The § 103 combinations

Combination 1 — Primary: US 2016/0359592 A1 (Cisco) + US 2018/0173789 A1 (CA Technologies) + US 9,332,020 B2 (ThreatMetrix), optionally + US 10,127,273 B2 for E2

Motivation to combine. Cisco '592 and CA '789 are both directed to the same problem in the same field: understanding and securing a datacenter by modeling its network/state. Cisco supplies graph-based anomaly determination from observed traffic; CA '789 supplies the reference/expected-state comparator that converts "what is anomalous" into "what is present but not expected." ThreatMetrix '020 supplies the identity/fingerprinting machinery needed to decide which machines are the ones that are unexpected, and US 10,127,273 supplies plural distributed capture agents to satisfy E2. Under KSR, "any need or problem known in the field of endeavor at the time of invention and addressed by the patent can provide a reason for combining the elements in the manner claimed." The need — reconciling observed assets against an authorized/expected asset set to find unmanaged ("shadow") compute — was a named, well-understood enterprise problem (CMDB reconciliation, rogue-device/shadow-IT detection) well before 2017-11-27. There are only a finite number of predictable ways to find an unregistered asset: (i) scan/observe the network and inventory what you find, (ii) fingerprint what you find to know what it is, (iii) diff that against your authorized list. The '621 claim set, on the inferred reading, is the union of exactly those three predictable steps. That is the KSR "obvious to try" posture squarely.

Predictable results / reasonable expectation of success. Each element is a known, separately-implemented function. Their combination produces an aggregation of expected results (an alert on an unregistered resource) with no asserted synergy or unexpected property. § 103 should be found.

Weaknesses. CA '789 must be shown to compare against a set that functions as an inventory of compute resources rather than merely a state snapshot; ThreatMetrix '020 must be shown to teach graph relationships and not merely fingerprint records. Both gaps are bridgeable with a POSITA declaration, but neither is free.

Combination 2 — US 2017/0163666 A1 (Conexus, connection lineage tracing) + US 2018/0173789 A1 (CA Tech) + US 10,127,273 B2

Conexus is the strongest single-reference teaching of E3 in the retrieved set: "connection lineage tracing" builds exactly a directed graph of nodes and edges out of application execution and connection activity — i.e., the "polygraph" construct. CA '789 supplies E4/E5. US 10,127,273 supplies E2 (plural distributed capture agents).

Motivation. Lineage/relationship graphs are built precisely so that the population of participating entities can be enumerated and reasoned about. Once a POSITA has enumerated entities from lineage, comparing that enumeration to the set of entities the operator believes exist is the natural and routine next step for a security operator; that is the security rationale natively expressed by CA '789. The combination is a "use of a known technique (inventory reconciliation) to improve a similar device (an activity-derived entity graph) in the same way" — the express KSR formulation. Both references are analogous art (same field: network/application security monitoring; same problem: discovering and characterizing activity in a datacenter).

Weaknesses. Conexus is framed as threat detection using lineage; a patentee would argue no suggestion to repurpose lineage output as an asset inventory. Counter: KSR/In re Kemps — the reference need not be designed for the same purpose, and the problem addressed (unknown participants in a network) is the same. Also, this combination is the most exposed to the "the graph is a behavioral graph, not a resource inventory graph" distinction if the granted claims emphasize node typing (resource nodes vs. user nodes).

Combination 3 — US 2018/0248901 A1 (Catbird, behavioral baselining) + US 2019/0132224 A1 (Accenture, outlier network activity) + US 9,332,020 B2 (ThreatMetrix) (+ CA '789 for E4)

Catbird supplies baselining of normal network behavior; Accenture supplies outlier identification/mitigation; ThreatMetrix supplies asset identification by fingerprint.

Motivation. These are the classic tripartite building blocks of behavioral security analytics: establish normal → detect departure → attribute the departure to an entity. A POSITA combining them is doing nothing more than assembling a known pipeline in a known order. A sub-inventory of resources can be derived from the baseline set: entities that participate in monitored activity but were never incorporated into the operator's registered set are, by definition of the comparison, "absent from the expected inventory." The '621 applicant's own specification frames baselining and deviation detection as the core mechanism (per the figure list and the truncated spec text on baselines/anomalies), which supplies an applicant-admission of the state of the art for this layer.

Weaknesses. Catbird/Accenture are behavioral outlier references; neither speaks to an asset registry. They are the weakest of the retrieved references for E4/E5. Use them for the baseline/deviation sub-elements only, and rely on CA '789 (or an inventory reference) for E4.

Combination 4 — US 2018/0063178 A1 (Promithius) + US 10,127,273 B2 + US 2018/0173789 A1

Promithius teaches real-time internal network threat detection and enforcement; US 10,127,273 teaches plural distributed remote capture agents (E1+E2, the multi-source element); CA '789 teaches the expected-state comparator. This is the combination to use if the granted claims expressly recite the multi-source limitation (which the title strongly implies) rather than merely implying it.

Motivation. Multi-source telemetry fusion for security was, by 2017, a settled architectural norm — the reason US 10,127,273 exists at all is that single-point capture was understood to be insufficient. Combining distributed collection with a state-comparison analytic requires no inventive leap; it is the ordinary deployment topology.

Combination 5 — US 10,404,732 B2 [extra] + US 2018/0173789 A1 + US 9,332,020 B2

US 10,404,732 B2 (provisional priority 2016-06-14) discloses a flow collector collecting instances of network data from one or more network elements, a historical behavioral pattern per element, and a real-time comparison of current vs. historical pattern to detect anomalies, with a notification. This is a remarkably close structural fit to E1/E3/E6 and, via its "one or more network elements," reaches toward E2.

Why this matters strategically. Like the Fortinet GCRNN reference, this appears not to be in the family art list the prior section retrieved. If the examiner of '469/'621 never considered it, a petitioner could use it to avoid § 325(d) discretionary denial — a real risk here because the same or substantially the same art was already before the examiner (see § 7 below).

Weaknesses. Qualification depends on perfecting the 2016-06-14 provisional and on the "one or more network elements" language being read as plural, heterogeneous sources. Both need verification.

5. Motivation-to-combine — consolidated KSR rationales

I found no reference teaching away from the combination. Absent teaching away, unexpected results, or a credible nexus-bearing secondary consideration, the KSR framework resolves toward obviousness.

6. Dependent-claim concepts

7. Secondary considerations (Graham factor 4) and the § 325(d) problem

Likely pro-patentee evidence. Lacework shipped a commercial platform embodying the family's subject matter; Fortinet sells it as FortiCNAPP; the technology drew significant market attention and a reported ~$8.3B 2021 valuation (per the ownership section). This is the strongest secondary-consideration candidate.

Why it probably fails. Nexus is the kill shot. Commercial success attributable to a whole platform (detection breadth, UI, integrations, brand, sales motion) is not presumptively attributable to the specific claimed combination, and the market-praise evidence must be tied to the claimed features. Given that the underlying elements (behavioral baselining, flow graphing, asset fingerprinting, state comparison) were each independently known and commercially available from other vendors (Catbird, Cisco, Accenture/Telco, ThreatMetrix), the patentee would struggle to show the success flowed from this combination rather than from Lacework's execution. I would expect a weak-to-moderate secondary-considerations record.

The examiner-consideration point — two directions.

• For the patentee: The parent US 10,419,469 B1 issued on this art. A § 103 challenge must therefore show either (a) the examiner misapprehended a reference, (b) the '621 claims add a limitation not present in '469, or (c) new art not previously considered.
• For a challenger: Because the same/substantially the same art was before the examiner, an IPR petition grounded solely on the retrieved '469 art risks § 325(d) discretionary denial (Director's "same or substantially the same art previously presented" practice). This is the single most important strategic finding in this analysis. The petition that succeeds on this family is one built on US 2019/0312898 A1 (Fortinet GCRNN) and/or US 10,404,732 B2 — references the examiner apparently did not have — with the family art used only as background.

8. Bottom line and confidence

Verdict: the inferred independent claims are more likely than not obvious under § 103 over combinations of the retrieved art — with the caveat that no conclusion here survives loss of the claim text.

The two limitations carrying the most non-obviousness weight — and therefore the two to attack hardest — are:

• E5/E4 (the "expected inventory" of compute resources, and identifying a resource absent from it) — best supplied by CA '789, supplemented by ThreatMetrix '020 for resource identity; and
• E2 (genuinely different, heterogeneous data sources — e.g., host-agent telemetry and a cloud-provider tracking service) — best supplied by US 10,127,273 for plural capture agents, or, if the claims name cloud-provider APIs specifically, by general knowledge plus the references' own multi-plane collection.

No combination I can build establishes the specific cloud-provider-registration-data source (e.g., CloudTrail-type inventory data) or the specific cross-source entity-unification algorithm — those are, on the inferred claim reading, the strongest non-obviousness redoubts, and the places where I would expect a patentee to retreat.

Highest-leverage next step (unchanged from the prior sections but now sharpened): obtain the granted claim text and the official References Cited block for 17/858,866 from USPTO Patent Center / the B1 grant PDF, then claim-chart Combinations 1 and 5. Without the claims, this analysis cannot distinguish a broad independent claim (in which case Combinations 1/5 are strong) from a narrow one reciting multi-source fusion of agent telemetry and cloud-provider inventory data (in which case the § 103 case weakens materially and the § 112 sufficiency of that disclosure deserves scrutiny).

9. Data-quality flags

1. No claim text ⇒ no verified claim charts. Every element label is [inferred]. Do not quote this as claim language.
2. Prior art is the parent's (US 10,419,469 B1) art list, ~21 of 58 entries, retrieved from a Unified Patents page the prior section flagged for title↔assignee offset artifacts. Not a verified '621 citation list.
3. Dating defect in the underlying source. The prior section's table reports priority dates, not publication/grant dates; § 102 qualification requires the latter. My § 2 screen is an estimate and must be re-verified per reference.
4. Two references used here are outside the retrieved list (US 2019/0312898 A1; US 10,404,732 B2). Treat both as candidate art pending qualification — the Fortinet GCRNN reference in particular turns on a one-day priority margin and therefore on the validity of its own priority claim.
5. Chronological contradiction (task date 2026-04-26 vs. fetch timestamp 2026-09-15) — re-flagged; all legal conclusions here are priority-date-relative and thus less sensitive to it, but "as-of" statements are not.
6. Aggregator noise (patentleaderboard.com employer mis-attributions to Bromium/EMC/Juniper) — did not rely on it.
7. § 325(d) is the practical gating risk, and it is a discretionary doctrine — my assessment of it is a prediction, not a rule application.

Sources relied on this session: https://patents.google.com/patent/US12244621/en · https://portal.unifiedpatents.com/patents/patent/US-10419469-B1 · https://patentimages.storage.googleapis.com/34/72/e7/fb387d2f0774ff/US20190312898A1.pdf · https://patentimages.storage.googleapis.com/24/83/99/1b361d34b89e60/US10404732.pdf · https://patents.google.com/patent/US20180020015A1