US 12255948

I'll search for authoritative information on this patent and check for any 2026 litigation activity.

The second query returned an unrelated pharmaceutical result — let me refine and search more specifically.

Let me try more targeted queries for this specific patent and any 2026 appellate activity.

US 12,255,948 B2 — Analyst Summary

Important scoping note on the number. I treated "12255948" literally as US 12,255,948 B2. A search on the bare string "12,255,948" returns no USPTO/CAFC hits outside this patent, and one search engine returned an unrelated RXNORM drug code (RXAUI 12255948) — that is not this patent. I did not "correct" any identifier.

1. Bibliographic data (from the patent's own front matter)

Caveat: assignee/inventor data is taken from the patent text itself, not from a live USPTO Assignment ( reel/frame) query — I could not directly query the USPTO assignment database within this session.

2. Abstract (verbatim)

"A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing."

3. Independent claims — plain language

All three independent claims are substantively parallel (same five steps, framed as method / CRM / system). Claim 1 is representative:

Claim 1 — Method "for determining exposure of vulnerable network objects having cyber-threats"

1. Collect network-object data on multiple network objects deployed in a cloud computing environment.
2. Construct a network graph from that data, the graph including a visual representation of the identified objects.
3. Determine relationships between the identified objects in the graph, where those relationships include descriptions of connections between them.
4. Analyze the graph + relationships to generate insights, where the insights include at least a route between an identified network object and an external network.
5. Tag the network objects in the graph for which the insight was generated.

Claim 10 — same five steps implemented as instructions on a non-transitory computer-readable medium.

Claim 11 — same five steps implemented as a system comprising processing circuitry + memory storing instructions.

Dependent claims add: number-of-transmissions count and visual indication thereof (2, 12); transmission-order determination and data-path population (3, 13, 8, 18); generating a list of every object on the route (4, 14); ordering the list by transmission order (5, 15); visual representation of the list (6, 16); populating a data path where the object is exposed to the external network (7, 17); and generating an alert from the insights (9, 19).

Notable drafting observation (not a legal conclusion): the abstract and the claims do not fully match. The abstract and the specification (FIGS. 2–3B; S210–S250) describe NLP-generated textual insights ("firewall one is connected to object two…"), whereas the issued independent claims recite insights that are "a route between an identified network object and an external network" and a preamble about exposure of "vulnerable network objects having cyber-threats." The NLP/textual-insight language of the abstract appears in the specification but is not required by claim 1. This is characteristic of this continuation family, where different members carry different abstract/claim pairings.

4. Continuity chain (literal, as recited in the patent)

US 12,255,948 B2 (18/888,981, filed 2024-09-18) ← continuation of 18/887,753 (2024-09-17, now US 12,192,270 B1) ← continuation of 18/479,573 (2023-10-02, now US 12,273,412 B2) ← continuation of 18/478,534 (2023-09-29, now US 11,985,185 B2) ← continuation of 18/341,134 (2023-06-26, now US 12,381,939 B2) ← continuation of 17/819,442 (2022-08-12, now US 11,722,554 B2) ← continuation of 17/109,883 (2020-12-02, now US 11,431,786 B1).

There is also a child continuation: 19/047,259 (filed 2025-02-06), published as US 2025/0358330 A1.

5. USPTO / CAFC 2026 docket check — findings and limits

• Google Patents flags the family as litigation-linked ("First worldwide family litigation filed," Darts-ip family ID 83007647). So the family has been in litigation, but the page does not itself name the case.
• The relevant litigation is Orca Security Ltd. v. Wiz, Inc., D. Del. C.A. No. 23-758-JLH (SRF), plus parallel PTAB IPRs (e.g., IPR2025-01086; IPR2024-00863). Per press reports (Calcalist/CTech, BankInfoSecurity), the parties stipulated to dismiss all claims and counterclaims with prejudice, each bearing its own costs, after PTAB invalidated several Orca patents in December 2025. If that dismissal holds, there would be no pending appeal to the Federal Circuit on the Wiz side of that case.
• I found no CAFC 2026 docket, appeal number, or opinion specifically naming US 12,255,948. I could not directly browse CAFC or USPTO PatentCenter dockets in this session, so this is a negative search result, not a confirmed absence.
• Critical disambiguation: in the Delaware/PTAB briefing, the shorthand "the '549 patent" refers to US 12,001,549 (Wiz's LLM-based cybersecurity incident-response patent, challenged in IPR2025-01086 and criticized as Alice-abstract). That is a different patent from US 12,255,948. Do not conflate them. Likewise, the asserted Orca patents (11,663,031; 11,663,032; 11,693,685; 11,726,809; 11,740,926; 11,775,326) are unrelated to 12,255,948.

6. Explicit uncertainty statements

• I could not verify whether US 12,255,948 itself was ever asserted by Wiz against Orca (Wiz's counterclaim reportedly rested on five Wiz patents — I could not confirm whether this one was among them).
• I could not confirm the current recorded assignee chain via the USPTO Assignment database; Alphababet/Google's 2025 acquisition of Wiz is widely reported and could affect the real-party-interest record, but the patent text lists Wiz, Inc. as assignee.
• No IPR number for US 12,255,948 specifically appeared in the results — searches surfaced IPRs on US 12,001,549 and US 11,637,855 instead. Treat "no IPR found" as unverified.
• Any statement above about litigation status is drawn from secondary press reports and docket-aggregator snippets, not from a primary PACER/CAFC filing read in this session.

I'll search for litigation involving US patent 12255948.

Let me search more specifically to determine whether the '948 patent itself was ever asserted.

Let me check for any other litigation involving Wiz as patent plaintiff, and verify whether the '948 patent itself appears anywhere.

Summary of findings on U.S. Patent No. 12,255,948

Bottom line: I found no litigation that asserts U.S. Patent No. 12,255,948 ("the '948 patent") specifically. However, the patent's family is the subject of active/now-concluded litigation, which explains the "Family has litigation" flag on the Google Patents record.

Important verifications up front

• Per the authoritative full text you provided, US 12,255,948 B2 issued March 18, 2025, from application 18/888,981 filed September 18, 2024, as a continuation of 18/887,753 (now US 12,192,270 B1), with earliest priority to December 2, 2020. Assignee: Wiz Inc. Inventors: Keren, Hershko Shemesh, Reznik, Luttwak, Berkovitz.
• The Google Patents page's "Family has litigation — First worldwide family litigation filed" indicator is attached to Family ID 83007647 and links to a Darts-IP record. That is a family-level flag, not evidence that the '948 patent itself was ever asserted.
• I was unable to open the Unified Patents litigation portal directly (my search budget was exhausted on targeted queries). So the negative finding below is based on targeted keyword searches, not an exhaustive docket sweep. Treat it as "none found," not "provably none exists," especially given the patent issued only in March 2025.

Litigation in the same patent family (sibling patents, not the '948 patent)

Case 1 — Orca Security Ltd. v. Wiz, Inc.

Why this matters for the '948 patent: The '948 patent shares the same December 2, 2020 priority lineage as the '554 patent (US 11,722,554), which Wiz did assert in its counterclaims. But Wiz asserted the '554 patent — not the '948 patent. The '948 patent did not exist until March 18, 2025, months after Wiz's June 2024 counterclaims, and the case was stayed in January 2025 and then dismissed with prejudice. So the '948 patent was never pleaded into that case.

Related PTAB proceedings (not district-court litigation, but part of the same dispute)

Note: none of these IPRs names US 12,255,948 as the challenged patent. The '554 IPR (IPR2025-01083) targets the sibling patent, not the '948.

Also relevant: Wiz filed its own IPRs against Orca patents (e.g., IPR2024-00863, IPR2024-01191 on the '326 patent, IPR2025-00093, IPR2025-00441, IPR2025-00442). PTAB's Dec. 8, 2025 decision invalidating all challenged claims of three Orca patents (including the two original backbone patents from July 2023) is what triggered the January 2026 dismissal stipulation.

Other Wiz-related disputes that do NOT involve the '948 patent

• Raftt Systems v. Wiz, Inc. and Gahl Saraf and Roy Iarchy — Israeli proceeding (Tel Aviv District Court, reportedly filed Feb. 9, 2026; ~NIS 200 million claim) alleging misappropriation of technology/team in connection with Wiz's absorption of Raftt's staff. This is a corporate/trade-secret-type action, not a patent infringement case, and it does not assert US 12,255,948 (I saw no patent cause of action identified).

Caveats

• Because the '948 patent issued only on March 18, 2025 (a continuation in a very actively litigated family), it is entirely possible new assertions exist that are too recent to appear in indexed results. I could not complete a full docket/PTAB sweep within my search budget.
• I did not auto-correct any identifiers. All numbers above are reported as they appeared in the sources; I found no source referencing "12,255,948" as an asserted patent, and I am explicitly declining to map that number onto the asserted '554 patent or any other patent in the family.

Suggested verification steps (which I could not complete): a Lex Machina/Docket Alarm "patent" search on 12,255,948; a PACER/Unified Patents portal query on the patent number; and a check of the Darts-IP family ID 83007647 record flagged on the Google Patents page.

I'll verify the structured data with targeted web searches before finalizing.

Let me check whether any third party (e.g., Orca Security) has petitioned against this Wiz-owned patent.

Important lead: Orca filed IPR2025-01083 against sibling patent 11,722,554 (same family/spec). Let me verify its outcome and check for any proceedings against 12,255,948 or its other siblings.

Proceedings overview

There are zero AIA trial proceedings on file against US 12,255,948. The USPTO Open Data Portal structured record returns no IPR, PGR, or CBM involving this patent, and my web searches surface none — no petition naming 12,255,948 as the challenged patent appears in PTAB E2E, Docket Alarm, or any secondary PTAB database. The bottom line for a defendant: the patent is untested at the Board. That cuts both ways — there is no claim-cancellation record you can borrow, but there is also no adverse PTAB precedent hardening the claims. Because 12,255,948 issued on 2025-03-18, the nine-month PGR window closed on 2025-12-18; only IPR (§ 311, patents/printed publications, §§ 102/103) remains available. CBM is off the table (AIA § 18 sunset and this is not a financial-services patent).

One caveat on scope: the structured block is the canonical list, and I did not have live PTAB E2E access to run an exhaustive name/patent search. Verdict: no PTAB activity on file — treat the related proceedings below as context, not as proceedings on this patent.

Related sibling proceedings (NOT on 12,255,948 — flagged for context)

12,255,948 is one of eight family members sharing the same specification, inventors, and 2020-12-02 priority (11,431,786; 11,722,554; 12,381,939; 11,985,185; 12,273,412; 12,192,270; 12,255,948; and pending 19/047,259). Orca Security Ltd. attacked five siblings in a coordinated IPR campaign, and none of the petitions named 12,255,948.

IPR2025-01083 — Orca Security Ltd. v. Wiz, Inc. (U.S. 11,722,554 — '948's direct sibling)

• Type: Inter Partes Review
• Filed: 2025-06-04
• Status: Institution Denied (Board decision 2025-12-15; proceeding terminated same day). Verbatim status from structured data: no entry — this proceeding does not involve 12,255,948.
• Judge panel: Karl D. Easthom, Nabeel U. Khan, Lisa A. Murray (per Docket Alarm docket sheet)
• Petition grounds: Obviousness under § 103 against claims 1-5, 7-16, 18-21, over Shivamoggi (US 11,770,387), alone and in view of Zhong (US 10,693,743), Woolward (US 2020/0382560), Beyer, and Huang. Note the '554 claims recite "a list of abnormal connections between the identified network objects" — materially narrower and different from 12,255,948 claim 1, which recites "a route between an identified network object and an external network."
• Institution decision: Denied 2025-12-15. Per reported summaries, the Board found Orca failed to show a reasonable likelihood of prevailing, focusing on claim 1[d] — the prior art disclosed "suspected attack paths" but not the claimed "list of abnormal connections." (Secondary-source paraphrase; I was unable to retrieve the PDF of the institution decision to quote it verbatim — treat the quoted phrase as reported, not confirmed.)
• Settlement / termination: No settlement; terminated on institution denial. Petitioner requested a refund of post-institution fees on 2026-02-11, refund approved 2026-02-19.
• Appeal: Institution denials are not appealable to the Federal Circuit as of right. A Request for Director Review was procedurally precluded pending the institution decision, and none is docketed after it.
• Defensive value: Low direct value against 12,255,948. The denial rested on a limitation the '948 claims do not contain, so you cannot transplant the Board's reasoning. What you can use: it shows the Board is not reflexively instituting against this family, and the Shivamoggi/Zhong/Woolward art set was already tested and found wanting on the sibling's narrower claims.

IPR2025-01084 / 01085 / 01086 / 01087 — Orca Security Ltd. v. Wiz, Inc. (siblings)

• Type: Inter Partes Review (four separate petitions, filed 2025-06-04)
• Patents: 11,929,896 ('084), 11,936,693 ('085), 12,001,549 ('086), 12,003,529 ('087). None is 12,255,948.
• Status: Per the parties' Joint Notice filed in the Delaware action, institution was denied on 2025-12-15 for IPR2025-01083 ('554) and IPR2025-01086 ('549), and instituted as to all claims on 2025-12-15 for IPR2025-01084 ('896). I could not verify the status of '085 and '087 before running out of search steps — flagging that as an open item rather than guessing.
• Pre-institution discretionary fight: Wiz filed a discretionary-denial request; on 2025-10-17 the Deputy Director (Coke Morgan Stewart) issued a decision denying discretionary denial and referring the petitions to the Board, reasoning that the district court case is stayed with no trial date, there was minimal district-court investment, the patents issued only in 2023-2024 (weak settled expectations), and "early challenges favor robust, predictable patent rights."
• Settlement / termination: Orca filed Sotera stipulations (Ex. 1016) agreeing not to pursue in district court the grounds raised or that reasonably could have been raised under §§ 102/103 on patents/printed publications — conditioned on institution. Those stipulations were filed in the district court track and affect estoppel scope only for the instituted patents.
• Defensive value: If IPR2025-01084 reaches a final written decision, § 315(e)(2) estoppel will bind Orca as to the '896 claims — but not as to 12,255,948, which is a different patent with different claims.

Parallel district court case (context)

Orca Security Ltd. v. Wiz, Inc., No. 1:23-cv-00758-JLH-SRF (D. Del.), filed 2023-07-12. Orca asserted six Orca patents; Wiz counterclaimed on five Wiz patents (11,722,554; 11,929,896; 11,936,693; 12,001,549; 12,003,529). 12,255,948 is not asserted in that case. The case was stayed pending the IPRs (stipulation and order; stay order entered 2025-01-16).

Strategic summary

Claim status on 12,255,948: entirely UNTESTED. No claim has been canceled, and no claim has been adjudicated patentable, because no AIA trial has ever been instituted on this patent. Claims 1-19 stand as issued. Contrast that with the sibling patents, where the picture as of 2026-09-30 is mixed: institution denied on 11,722,554 (IPR2025-01083) and 12,001,549 (IPR2025-01086); instituted on 11,929,896 (IPR2025-01084). Do not let anyone tell you a sibling's institution denial "invalidated" or "confirmed" the '948 claims — it did neither.

Estoppel landscape. Orca has no § 315(e)(2) estoppel arising from any proceeding on 12,255,948, because estoppel attaches only after a final written decision, and institution denials generate none at all. That means Orca — or any other party — is free to file a first IPR against 12,255,948 on any patents/printed-publications ground under §§ 102/103. Note, however, that the '948 claims require "a route between an identified network object and an external network," which is a different and arguably broader/different-limitation recitation than the '554 claims' "list of abnormal connections" that the Board credited in denying IPR2025-01083. A sophisticated challenger will map the art to the route/external network and number of transmissions limitations (claims 2-8), which no panel has yet construed. The practical sequence for a defendant: file your IPR early (Director Stewart's 2025-10-17 referral decision and its citation of "early challenges favor robust, predictable patent rights" cuts against discretionary denial of § 315(b)-timely early filers); the parallel Delaware case being stayed is an additional Fintiv-adjacent fact that favors institution.

Pattern signals. This is a two-way war, not a troll scenario — the same actors (Orca Security and Wiz) are suing and IPR-ing each other over overlapping cloud-security graph patents, and both sides are represented by sophisticated firms (Erise IP for Orca; Wilson Sonsini for Wiz). Orca filed five IPRs in a single day (2025-06-04) against Wiz siblings, and Wiz filed six IPRs against Orca patents in May-August 2024. No defensive aggregator (Unified Patents, RPX) appears anywhere in the chain. Zero IPRs have been filed against 12,255,948 despite the family being under active, well-funded attack for over two years — that is a meaningful negative signal: either the patent is not asserted against a party with standing/interest to challenge it, or challengers have concluded the siblings are the more vulnerable targets.

Recommended next steps

1. Treat the record as "no PTAB activity" and say so in your invalidity contentions. The structured ODP data and my search both confirm no proceeding on 12,255,948. Verify independently against PTAB E2E (https://ptacts.uspto.gov) by patent number before you represent this to a court — I did not have live E2E access.
2. Pull the IPR2025-01083 institution decision (Paper dated 2025-12-15) and read it as a roadmap, not a shield. It is the closest thing to a Board merits test of this specification. Docket: https://www.docketalarm.com/cases/PTAB/IPR2025-01083/Orca_Security_Ltd._v._Wiz_Inc/ ; also mirrored at https://ipverse.greyb.com/ptab-web/cases/case-details/IPR2025-01083. The denial reasoned that "suspected attack paths" in the prior art did not disclose a "list of abnormal connections" — reasoning that maps onto the '554 claims, not the '948 "route... to an external network" limitation.
3. Check the live status of IPR2025-01084 (11,929,896). It was instituted as to all claims on 2025-12-15, so the statutory one-year § 316(a)(11) deadline puts the FWD due on or about 2026-12-15 — roughly ten weeks from today. If the Board cancels the '896 claims, that is a strong evidentiary and rhetorical lever against the same specification, even though it does not estop anyone from litigating 12,255,948. Also confirm the current status of IPR2025-01085 and IPR2025-01087, which I could not verify.
4. Monitor the Delaware case docket, Orca Security Ltd. v. Wiz, Inc., No. 1:23-cv-00758-JLH-SRF (https://www.courtlistener.com/docket/67600951/orca-security-ltd-v-wiz-inc/). It is stayed; any lift of the stay, or any amendment adding 12,255,948 to either side's asserted patents, would materially change the calculus and could open the door to a § 315(b) one-year clock.
5. If you are being asserted on 12,255,948 right now, the absence of PTAB activity means there is no estoppel clock running and no prior Board construction of the operative "route"/"external network" terms. File early, take a Sotera stipulation to blunt discretionary denial, and cite the Deputy Director's 2025-10-17 referral decision (denying discretionary denial where the parallel case was stayed with no trial date) as your Fintiv counter.

Confidence flags: The count (zero proceedings on 12,255,948) is stated with high confidence based on the structured ODP block plus independent search. The sibling-proceeding details are drawn from PTAB docket aggregators and court filings, not from the FWD/institution-decision PDFs themselves — I was unable to retrieve the source documents to quote verbatim, and the statuses of IPR2025-01085 and IPR2025-01087 remain unverified.

I'll research the assignment/ownership record for US 12,255,948 and the current status of Wiz, Inc.

Excellent — I found a Wiz assignment cover sheet. Let me drill into the specific application and Wiz's portfolio-wide recording pattern.

Assignment & Ownership Analysis — US 12,255,948 B2

Verification caveat up front (important). I could not open assignmentcenter.uspto.gov or assignment.uspto.gov as a live query in this session, so I cannot report reel/frame numbers for this patent specifically. Per your constraints, I am not inventing them. What follows is built from (a) an actual Wiz assignment cover sheet captured from a USPTO-hosted PTAB document, (b) the sworn ownership pleadings in the related Delaware litigation, and (c) press/secondary sources for corporate status. Every reel/frame reference below is quoted only where I actually have it, and I flag explicitly where it applies to a different Wiz application.

One cross-reference to the prior section, which is now resolved: the earlier summary said the Wiz counterclaim "reportedly rested on five Wiz patents — I could not confirm whether this one was among them." I can now confirm the five, and US 12,255,948 is not one of them (see §Assignment timeline / Context).

Inventors

Sourcing note. Inventor identities come from the patent front matter. The employer mapping is corroborated by a parallel Wiz patent (US 12,244,627, issued Mar. 4) whose inventor list overlaps heavily — Matilda Lidgi, Shai Keren, Raaz Herzberg, Avi Tal Lichtenstein, Ami Luttwak, Roy Reznik — all Wiz personnel. It also matches the inventor→Wiz declaration-and-assignment instrument I retrieved (below), where Wiz inventors assign to "WIZ, INC., One Manhattan West, New York, New York 10001."

Unusual-pattern checks — findings are negative, but with a limit:

• No evidence of inventor departure within 12 months of filing. Reznik and Luttwak are Wiz co-founders who remained through the founding-to-acquisition arc. I found no indication of a post-filing inventor exodus that would signal a portfolio fire-sale. (Unclear/not verified for Keren, Shemesh, and Berkovitz individually — I did not retrieve employment-history records for them.)
• All inventors share the original assignee. This is the ordinary founder/employee-assignment fact pattern, not a hire-then-transfer pattern.
• Origination date discrepancy to note: the application was filed 2020-12-02, but the family shows continued inventorship overlap across siblings (e.g., the '896 patent lists Daniel Shemesh, Liran Moysi, Roy Reznik, Shai Keren). Consistent single-employer pipeline, not a scattered inventor pool.

Do not over-read the absence of departure data. "No departure found" here is partly a function of the small public record on these individuals, not affirmative proof.

Original assignee

Wiz, Inc. — One Manhattan West, New York, NY 10001 (per the recorded Wiz assignment cover sheet; Israeli operations in Tel Aviv).

Critical nuance for the ownership chain: the Google transaction was an acquisition of Wiz, Inc. equity by Alphabet (backed by a ~$31.5B bond issuance). A parent-level stock acquisition does not, by itself, generate a patent-level assignment record against US 12,255,948 — and Google's stated plan was for Wiz products to keep operating across AWS/Azure/Google Cloud, implying Wiz, Inc. survives as an Alphabet subsidiary. If Wiz, Inc. persists as the record owner, the chain legitimately terminates at Wiz, Inc., and you should expect no new reel/frame for this patent. If instead a merger absorbed Wiz, Inc. into a Google entity, a Merger-type conveyance would eventually appear — I could not verify which occurred; check the Assignment Center for a 2026 merger/assignment entry before relying on either.

Assignment timeline

Plain statement of the record gap: I did not retrieve Assignment Center entries for this patent in this session. I therefore cannot enumerate reel/frame rows for 12,255,948. I do have documentary evidence that (i) Wiz's chain is recorded by assignment, and (ii) the recording is handled by one repeat correspondent. Here is what is evidenced, separated by confidence.

A. Established by direct pleading (this family):
Wiz pleaded in its counterclaim in Orca Security Ltd. v. Wiz, Inc., D. Del. No. 1:23-cv-00758-JLH that it is:

"the sole and exclusive owner, by assignment, of all rights, title and interest in U.S. Patent No. 11,929,896 … The '896 patent was duly and legally issued … on Mar. 12, 2024."

US 11,722,554 B2 — the direct ancestor in the 12,255,948 continuity chain — was likewise pleaded as Wiz-owned and asserted. This confirms the chain carries recorded inventor→Wiz assignments, but the pleading does not state reel/frame.

B. Directly retrieved cover sheet — pattern exemplar, NOT this patent:
The following is a real recorded Wiz assignment, pulled from a USPTO-hosted image set. It is for application 18/357,845 ("System and method for applying a policy on a network path"), not for 18/888,981. I present it because it is the authentic template for how every Wiz recording in this portfolio is filed:

• 2023-07-13 → 2023-07-20 (executed) / recorded 2023-07-25 — Submission ID 508029038 (reel/frame not visible in the excerpt)
  • Conveyance: Assignment (cover sheet marked "NEW ASSIGNMENT" / "NATURE OF CONVEYANCE: ASSIGNMENT"; document titled "DECLARATION AND ASSIGNMENT FOR PATENT APPLICATIONS," combining the 37 CFR 1.63 oath with the assignment and power of attorney)
  • Assignor: Roy Reznik (07/20/2023); Matilda Lidgi (07/16/2023); Shai Keren (07/13/2023); Eliran Marom (07/14/2023) — note: Shai Keren and Roy Reznik are also inventors on US 12,255,948, tying this template to our patent's personnel
  • Assignee: WIZ, INC., One Manhattan West, New York, NY 10001
  • Correspondent: M&B IP ANALYSTS, LLC, 150 Morristown Rd, Suite 205, Bernardsville, NJ 07924; email pair@mb-ip.com; phone 908-274-3111; fax (908) 274-3113. Submitter/signing attorney: MICHAEL BEN-SHIMON (USPTO Reg. No. 69,610). Attorney docket WZIO P2438. USPTO Customer Number 122066.
  • Context: Standard employee/founder invention assignment to the operating company — first-party, pre-issuance, not a transfer-to-asserter.

C. Recorded litigation events (35 U.S.C. § 290 reports, not assignments):

• 2023-07-12 — Orca Security Ltd. v. Wiz, Inc. filed, D. Del. 1:23-cv-00758-JLH.
• 2024-06-04 — Wiz counterclaimed, asserting five Wiz patents: US 11,929,896; US 11,936,693; US 11,772,554 [s/b 11,722,554]; US 12,001,549; US 12,003,529 (AO 120, Doc. 72).

⚠️ Two literal-reading flags, per your operating rules:

1. "11,772,554" appears to be a typo for US 11,722,554 B2 (the AO 120 lists date-of-patent 8/8/2023, which is the '554 patent's issue date, and no US 11,772,554 is in this family). I am flagging it rather than silently correcting it. If it is a distinct patent, the analysis of which family member was asserted changes.
2. US 12,255,948 was NOT asserted. It issued 2025-03-18, months after the 2024-06-04 counterclaim. However, its ancestor US 11,722,554 was asserted — so this family is litigation-tested even though this particular grant is not.

D. Not found / unverified:

• No reel/frame for any assignment touching 18/888,981.
• No post-issuance assignment to any entity other than Wiz, Inc.
• No 2026 merger/assignment record reflecting the Google close (consistent with a subsidiary-survival structure, but I could not confirm).

Timeline diagram

timeline
    title Ownership of US 12255948
    2020 : Application filed Dec 2
         : Inventors are Wiz employees
    2021 : Inventor assignments to Wiz recorded
         : Exact dates not verified
    2023 : Wiz counterclaims using sibling 11722554
    2023 : Family flagged as litigation linked
    2024 : Continuation 18888981 filed Sep 18
    2025 : Patent issued to Wiz Inc Mar 18
         : Alphabet agrees to buy Wiz for 32B
    2026 : EU clears deal Feb 10
         : Deal closes Wiz joins Google Cloud
         : No assignment recorded for this patent

NPE / troll-pattern signals

Signals 1–8 collectively: zero affirmative NPE indicators. The only technically "present" item (#3) is the correspondent-recurrence fact, which the evidence affirmatively rebuts as an NPE tell.

Verdict

Operating-company assertion

Justification. US 12,255,948 B2 issued on 2025-03-18 to Wiz, Inc., an operating cloud-security vendor that ships the Wiz CNAPP platform embodying the claimed cloud-object graph and exposure-path analysis. Wiz held the family from the 2020-12-02 priority filing — there is no recorded transfer to any licensing entity, no shell LLC, no aggregator, and no asserter-chain correspondent; the only recurring addressee is M&B IP Analysts, LLC / Michael Ben-Shimon on Submission ID 508029038 (recorded 2023-07-25), which is front-end prosecution recordal for Wiz and Radware, not an NPE mill. The family is litigation-tested — but as counterclaims by the owner itself (AO 120, Doc. 72, dated 2024-06-04, asserting US 11,722,554 and four other Wiz patents in Orca Security Ltd. v. Wiz, Inc., D. Del. 1:23-cv-00758-JLH) — and the owner was subsequently acquired by Alphabet (announced 2025-03-18; EU cleared 2026-02-10; reported closed ~2026-03-12). That is textbook operating-company assertion against a competitor, not NPE conduct.

Two residual uncertainties that could move this verdict — check them before relying on it:

1. Alphabet vs. Wiz, Inc. as record owner in 2026. If a merger conveyance exists post-2026-03, the chain's terminal assignee changes (still an operating company, so the verdict holds, but the named entity and venue/standing posture change). If no record exists, assume Wiz, Inc. remains record owner as a Google subsidiary.
2. Whether US 12,255,948 is later asserted in any 2026 follow-on action — it issued after the Orca counterclaim, so it has not yet had a chance to be pleaded. A fresh assertion campaign by Alphabet against Orca/Palo Alto Networks/Wiz competitors would keep this in "operating-company assertion," but a transfer to a separate Alphabet licensing vehicle would flip signals #1 and #4. I found no such vehicle.

Verify directly at: https://assignmentcenter.uspto.gov/ — search by patent number 12255948 (or application 18/888,981), and while there also pull 17/109,883 and 17/819,442 to capture the original inventor→Wiz reel/frame I was unable to surface here.

I'll research this systematically, starting with the patent itself and any citation records.

The initial searches returned unrelated Orca patents. Let me target the citation record directly.

Let me look for the actual citation lists on patent databases that render "References Cited."

Prior-Art Analysis — US 12,255,948 B2

⚠️ Threshold finding you need before anything else

The authoritative patent text supplied for this analysis contains no "References Cited" / "Patent Citations" section. The Google Patents rendering includes front-matter, classifications, abstract, description, Figures list, and the 19 claims — but the citation block is absent. My searches did not retrieve the citation list either.

This matters because your instruction was to "look at each patent citation for 12255948." That list is not available to me in this session, and I will not fabricate it. Inventing a plausible-looking "References Cited" table is the single most likely way this deliverable could become actively harmful (e.g., a fabricated §102 chart being reused in an IPR or invalidity contention).

What I can do, and have done below, is:

1. Document exactly what the patent's own record does and does not show (Section 1).
2. Report the prior-art references that did surface in my searches, correctly attributed (Section 2) — none of them are citations of 12,255,948.
3. Provide an analyst-identified candidate prior-art landscape with §102 reasoning, every entry flagged as unverified (Section 3).

1. The citation record — what exists and what I could not reach

The Google Patents "prior art keywords" string is worth noting: it tells you the classifier indexed this disclosure around network / objects / identified / graph / transmission. It is not evidence of any particular reference being cited.

Where the citations would live, if you need to pull them from primary sources:

• USPTO PatentCenter → Application 18/888,981 → "References Cited" tab (this shows the examiner-cited art for this application).
• USPTO Patent Public Search → record for 12,255,948 → "Referenced By / References Cited."
• The earliest family member, US 11,431,786 B1 (app. 17/109,883, filed 2020-12-02) — continuations often inherit the parent's citation set; the parent's face is the most informative single document in this family.

Recommendation: pull PatentCenter for 18/888,981 and for 17/109,883 before relying on any prior-art position. I could not do this in-session.

2. What my searches actually returned (verified, but not citations of this patent)

These references are real and relevant to the technical field, but each is attached to a different proceeding. Do not attribute them to US 12,255,948:

One genuinely useful datum from this set: per the IPR petition text, Orca's US 11,637,855 issued from app. 17/657,972 filed April 5, 2022, with priority to provisional 63/180,048 filed April 26, 2021. That is after the 2020-12-02 prior-art date of US 12,255,948. So the Orca family is, on these dates, not §102 prior art to 12,255,948 (it is potentially the reverse — a later-filed competitor in the same space). Verify priority-by-priority before relying on this.

Hufsmith (US 2020/0097662 A1, filed 2018-09-28) is the one reference in this set with a filing date safely before 2020-12-02, and it is in the same field (cloud-workload exposure/vulnerability risk). It is a candidate — see Section 3 — but it was located in a competitor dispute over different patents, not in this patent's record.

3. Analyst-identified candidate prior art (⚠️ NOT the patent's citation list — all unverified)

Framing the §102 problem correctly first. Claim 1 of US 12,255,948 requires, in combination:

• (a) collecting network-object data on plural objects in a cloud environment;
• (b) constructing a network graph with a visual representation;
• (c) determining relationships = descriptions of connections;
• (d) analyzing graph + relationships to generate insights including at least a route between an identified object and an external network; and
• (e) tagging the objects for which the insight was generated.

For §102 anticipation, a single reference must disclose all of these arranged as claimed. The hardest elements to find in one reference are (d) external-network route insight coupled with (e) tagging back onto the graph.

References I am deliberately not listing as prior art, and why:

• US 11,431,786 B1; 11,722,554 B2; 11,985,185 B2; 12,273,412 B2; 12,381,939 B2; 12,192,270 B1 — these are the same disclosure in the same priority chain, not prior art against 12,255,948. They are §102 self-collisions at most in an obviousness-type-double-patenting sense, not prior art.
• US 2024/0031425 A1 — a Wiz family publication the search surfaced (claim set worded around "detecting network vulnerability based on network path exposure" and cross-environment exposure). Same family ⇒ not prior art. Note it is also a different claim set from 12,255,948's, which is a useful drafting observation, not an anticipation point.
• US 2025/0016222 A1 — the pre-grant publication of this same application. Not prior art.

4. Explicit uncertainty statements

• I could not obtain 12,255,948's own "References Cited" list. Everything in Section 3 is analyst-supplied and must be verified against PatentCenter before use. Anyone presenting Section 3 as "the citations of 12,255,948" would be misrepresenting it.
• "Elder" and "Kim" are incomplete citations. I know they exist as IPR references against Orca's '855 patent; I do not have their full identifiers and will not guess them.
• I could not confirm whether 12,255,948 was itself cited, asserted, or challenged in any proceeding. The family carries a Darts-ip litigation flag, but the flag does not name the case.
• No §102 conclusion above should be treated as an invalidity opinion. A defensible anticipation position requires (i) the examiner-cited art, (ii) full reference texts, and (iii) element-by-element mapping to the issued claim language — none of which I could complete here.

5. Contradiction / gap flagged against the earlier sections

The previous summary states the abstract and claim 1 "do not fully match," with the abstract centered on NLP textual insights while claim 1 recites a route to an external network plus tagging. Section 3 confirms why this is analytically important for prior-art work: the §102 search must be run against the issued claim language (route/exposure + tagging), not against the abstract's NLP framing. A prior-art search driven by the abstract's "textual insights using natural language processing" would target the wrong corpus. That is a substantive, not cosmetic, divergence.

I'll ground this § 103 analysis in actual prior-art references. Let me run several targeted searches.

Excellent — the searches surfaced live PTAB petitions mapping specific prior art to this exact specification. Let me pin down the references and any IPR targeting this patent.

Strong material. Now let me pin down the sibling-patent IPR (11,722,554 — same family/specification) and the key reference details.

Obviousness Analysis — US 12,255,948 B2 under 35 U.S.C. § 103

Scoping note on "the Prior Art section of this page." The Google Patents page for US 12,255,948 B2 does not contain a discrete prior-art document list. What it does contain is a prior-art metadata block: prior-art keywords "network / objects / identified / graph / transmission" and prior art date 2020-12-02. That date is simply the family's earliest priority date (17/109,883), and the keywords are auto-generated from the claim vocabulary. Since the page yields no citations, I have grounded this § 103 analysis in the references that are actually being mapped against this specification in live proceedings — the PTAB petitions against Wiz-family and Orca-family patents — plus the underlying vArmour/Orca publications. I flag verbatim where I verified vs. inferred.

I. Threshold issue: what is the effective filing date of the issued claims?

This controls everything. US 12,255,948 is the seventh continuation in a chain running back to 17/109,883, filed Dec. 2, 2020. But the issued claim set is not the claim set of the 2020 parent:

• The 2020-parent disclosure (S210–S250; FIGS. 2–3B) is framed around NLP-generated textual insights ("firewall one is connected to object two, which is a VM…").
• The issued claims are framed around "determining exposure of vulnerable network objects having cyber-threats," with insights that "include at least a route between an identified network object and an external network," plus "tagging network objects … for which the insight is generated."

If those limitations are supported by the Dec. 2, 2020 disclosure (§ 112 written description — the specification does recite reachability/exposure insights and S250 tagging, so I lean toward "supported"), the effective filing date is Dec. 2, 2020, and prior art must predate it. If a challenger shows the "route to an external network" + "tagging for which the insight is generated" combination was not described in the 2020 parent (the burden allocation of Dynamic Drinkware favors the challenger here), the effective date slides to 2023–2024 and the prior art universe expands dramatically (see Ground 3). This priority/§ 112 vulnerability is, in my assessment, the single most consequential issue for US 12,255,948.

II. Level of ordinary skill in the art (POSITA)

Drawing on the level adopted in the parallel Wiz/Orca IPRs: a bachelor's in CS/CE/EE (or equivalent) plus 2–3 years of professional experience in cybersecurity analysis and cloud/virtualization. Such a person understands cloud provider APIs (AWS/Azure/GCP), identity-and-access management, agentless configuration collection, graph data structures, and network reachability/topology analysis. The patent's own classifications — H04L 63/1433 (vulnerability analysis), H04L 41/12 (network topology discovery), H04L 63/102 (entity profiles), H04L 49/70 (virtual switches) — define the fields a POSITA would search.

III. The prior art of record/relevance

Critical § 102 point on Keren. Keren is Wiz's own patent and is asserted as "prior art under 35 U.S.C. § 102(a)(2)" in a PTAB petition — but that petition targets a patent whose effective filing date is after Feb. 18, 2021. Against US 12,255,948, Keren fails on two independent grounds if the 12/2/2020 priority holds: (i) § 102(a)(1) is unavailable because Keren's application publication and issue date both postdate 12/2/2020; and (ii) as § 102(a)(2) art it is either not "effectively filed before" 12/2/2020 or is disqualified by the common-ownership exception, § 102(b)(2)(C) (both are Wiz, Inc. patents). Keren is therefore not usable art against US 12,255,948 on the assumption of a Dec. 2, 2020 effective date — notwithstanding that, on its face, Keren would otherwise read on claim 1 almost element-for-element. This is exactly the kind of self-collision that makes the priority determination outcome-dispositive.

IV. Claim 1 — element-by-element mapping

Difference analysis: the only genuine gap in the third-party art predating 12/2/2020 is the affirmative recitation of an "insight" whose content is a route/attack path terminating at an external network — a gap closed by attack-path art (NIST; the Morgan reference; the Orca '257 disclosure) and, in the vArmour reference, by its own exposure/simulation output.

V. Grounds of rejection

Ground 1 — Ross (vArmour) in view of Agarwal. Renders claims 1–6 and 9 obvious. Ross supplies the agentless cloud-API collection, the graph-with-visualization, relationship edges with direction/type, and tagging/labels. Agarwal supplies API-based credential collection and flow-map visualization of groups and their connections.

Ground 2 — Ross + Agarwal + attack-path art (Morgan; NIST Attack Graphs; Orca '257-type traversal). Renders claims 1–9 obvious. Morgan/NIST/Orca '257 supply the external-network route/attack-path insight and its visualization (forward/backward paths, entry points at risk), and path scoring.

Ground 3 (conditional) — Keren alone, or Keren + Morgan. If § 112/priority breaks the Dec. 2, 2020 date (i.e., the effective date is post-Feb. 18, 2021), Keren alone arguably anticipates claim 1 and, at minimum, renders it obvious. I note that Wiz itself made essentially this mapping in IPR2025-00093, arguing Keren discloses (a) collecting security-object data via cloud APIs; (b) a security graph integrated with a data structure of internet-accessible services; (c) traversing the graph to compute a "reachability property" for an external network (the internet); and (d) "tagging" objects with properties — the resulting "security insights" being the claimed notification. If that mapping is correct, it applies with even greater force here, because Keren shares the specification of the patent at issue. Keren + Morgan is the combination expressly urged in the PTAB petition as rendering claims 1–20 obvious.

Ground 4 — Veselov + Basavapatna (used in Wiz v. Orca, IPR2024-00220, against Orca's '735) is relevant only to the alerting limitation (claim 9), and is better treated as cumulative.

Motivation to combine (KSR rationales)

1. Same field, same problem. All references address cloud-security posture: the sheer scale of objects and the need to distinguish genuinely risky exposure from noise. Morgan states the problem explicitly: identifying vulnerabilities alone is insufficient because "not all known vulnerabilities are necessarily important to fix," so one must analyze paths. (Petition quotes: EX1006, 2:26–53.)
2. Predictable use of a known technique. The references' graphs already store nodes and directed edges representing permitted relationships. Computing a reachability/path from an external origin over such a graph is the graph's native operation — "use of a known technique to improve a similar device in the same way."
3. Known technique applied to a known device ready for improvement. vArmour/Ross expressly reports assets "unnecessarily exposed by weak policy"; adding internet-origin path computation to that same relationship graph is the natural next step, yielding a predictable result (a highlighted path/route).
4. No teaching away. Nothing in Ross, Agarwal, or the attack-path art disparages path analysis over a workload relationship graph; Ross even describes policy simulation over the graph, demonstrating that traversals for "what could reach what" are contemplated on the same data structure.
5. Reasonable expectation of success. The references operate on the same inputs (cloud configuration, API inventory, telemetry, firewall/policy rules) and produce compatible outputs (node-and-link visualizations), so a POSITA would expect the combination to work.

VI. Dependent claims

VII. Counterarguments and secondary considerations

• Patent Owner's strongest non-obviousness argument: that no single predating reference discloses an "insight" whose content is affirmatively "a route between an identified network object and an external network," combined with "tagging … for which the insight is generated." This is a real gap for the third-party art predating 12/2/2020 and should be probed. It is answered only by the combination with attack-path art (Ground 2), and its strength depends on that art's effective dates — which I could not fully verify.
• Objective indicia cut against Wiz here. Orca has argued (and sought discovery on) Wiz's copying of Orca's SideScanning technology, plus Orca's praise/commercial success, in the IPRs. That evidence of copying is directed at Orca's patents, not at US 12,255,948; for this patent, Wiz would need evidence of nexus between the claimed cloud-graph workflow and commercial success — a weak nexus given how conventional that workflow is shown to be.
• § 101 overlay (not § 103, but relevant context): the same family's legal vulnerabilities are being pressed under Alice against the sibling '549 patent. A claim set this abstract also tends to be an easy target for a broad § 103 combination.

A material data point in Wiz's favor: in Orca Security Ltd. v. Wiz, Inc. (D. Del. 1:23-cv-00758-JLH-SRF), Orca's petition IPR2025-01083 — directed at US 11,722,554, a family sibling sharing this specification — had institution denied on December 15, 2025, as did IPR2025-01086 (against 12,001,549). However, that denial is not dispositive for US 12,255,948: the claim sets differ materially (the '554 claims are not the "route to an external network"+"tagging" claims), the grounds are unknown to me, and a denial of institution has no preclusive effect on a district-court § 103 challenge on a broader record. Note the mirror-image outcome: the Board did institute on Wiz's '896 and '693 patents (IPR2025-01084, -01085), and invalidated all claims of Orca's 11,663,031/032/685 in IPR2024-00863/864/865 on Dec. 8, 2025 — showing that this body of cloud-security art is being credited in this technology space.

VIII. Conclusion and confidence

Bottom line: On the assumption that US 12,255,948 is entitled to its Dec. 2, 2020 priority (which I judge likely), claim 1 and its dependents are vulnerable to a § 103 challenge built on vArmour (Ross/Agarwal) as the primary cloud-relationship-graph reference, combined with attack-path prior art for the external-network route insight and with conventional alerting for claim 9. If the priority chain fails — a genuine risk given seven layers of continuations and claim language that evolved away from the 2020 parent's NLP-insight disclosure — then Wiz's own Keren patent (US 11,374,982) becomes near-anticipatory art, and the validity of the entire claim set collapses quickly.

Explicit uncertainties. (1) I could not verify the identity, number, assignee, or effective filing date of the "Morgan" reference (EX1006) in this session; I have used it functionally, as characterized in the petition. (2) I did not verify the specific vArmour patent numbers/dates beyond the publication and internal-application references quoted in the search results. (3) I found no IPR petition specifically naming US 12,255,948, and I could not confirm whether it is among the Wiz patents asserted in Delaware. (4) I could not verify Keren's benefit claim to 17/109,883 — this single fact determines whether Keren is available as art.

Contradiction to flag against the earlier-generated summary. That summary stated the parties "stipulated to dismiss all claims and counterclaims with prejudice" in Orca v. Wiz. The docket documents surfaced in this session — including D.I. 235, the Joint Notice of IPR Final Written Decisions (filed after the Dec. 8, 2025 FWDs, referencing a January 16, 2025 Order for Stay Pending IPR, D.I. 233, and docket entries through at least Nov. 2024) — show the action still active and being updated to the Court, with no dismissal order visible in the materials I retrieved. The stipulated-dismissal assertion should therefore be treated as not corroborated and likely erroneous, or as relating to a post-cutoff development I could not confirm.