US 12273412

I'll run targeted searches to verify the identifier and check for any CAFC 2026 docket activity, then summarize.

US 12,273,412 B2 — Analyst Summary

Verified against: Google Patents full text (US12273412B2, fetched 2026‑09‑24), Justia (patents.justia.com/patent/12273412), and Espacenet INPADOC family data. Identifier interpreted literally as 12,273,412 (no auto‑correction applied).

---

Bibliographic Data

---

Abstract (as printed)

"A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing."

---

⚠️ Important Observation: Abstract ≠ Claimed Subject Matter

The abstract (and the Summary of the specification) is directed to generating textual insights using NLP. The granted claims are not. They are directed to filtering network insights based on an insight indicating exposure from an external network. This abstract/claim mismatch is characteristic of this family — each continuation re‑wrote claim 1 while the specification stayed largely unchanged. Analysts and litigators should rely on the claims, not the abstract.

---

Independent Claims — Plain Language

Claim 1 — Method for filtering network insights from vulnerable network objects having cyber‑threats

1. Collect object data on objects in a cloud environment that are deployed/operable at different layers of that environment.
2. Identify the deployed objects.
3. Construct a representation of the cloud environment including the objects and their relationships (note: "representation," not "visual representation" — narrower than the abstract).
4. Generate network insights on objects and relationships, where insights are defined as natural‑language representations of aspects of the representation.
5. Tag the identified objects for which an insight was generated.
6. Filter the network insights based on an insight indicating exposure from an external network.

Plain language: build a model of a multi‑layer cloud, auto‑describe it in natural language, tag the objects those descriptions cover, and use an "exposed to the outside" insight as a filter criterion to cut the insight set down to what matters.

Claim 10 — Non‑transitory computer‑readable medium
Same six steps as claim 1, expressed as instructions that when executed by one or more processors cause a device to collect, identify, construct, generate, tag, and filter. Substantively coextensive with claim 1 in a different statutory category.

Claim 11 — System
Same six steps again, implemented as processing circuitry plus memory containing instructions configuring the system to perform them. Again substantively coextensive with claim 1.

Dependent‑claim scaffolding (all three families of dependents track each other):

• Alert generation (claims 2/12) and filtering that alert on the external‑exposure insight (claims 3/13)
• Generating a network graph from the representation (4/14) and graph formats — table, chart, non‑visual data format, list of objects, or combinations (5/15)
• Anomaly detection based on generated insights (6/16) and an alert based on the detected anomaly (7/17)
• Determining a network object is vulnerable to a cyber‑threat based on the external‑exposure insight (8/18), and filtering insights further based on an insight indicating a cyber‑threat vulnerability (9/19)

---

Family Context (why this matters)

This patent is one node in a large Wiz continuation family (family ID 83007647, 8 family applications), all sharing the 2020‑12‑02 priority. Critically, claim scope was re‑cut in each continuation, so family members are not coextensive:

• US 11,722,554 B2 (app. 17/819,442) — claims directed to determining abnormal configuration of network objects; insights include "a list of abnormal connections."
• US 11,985,185 B2 (app. 18/478,534, the immediate parent) — claims directed to detecting network vulnerability based on network path exposure; insight = "a network object is exposed to an external network."
• US 12,273,412 B2 (this patent) — claims directed to filtering insights based on an external‑exposure insight.

---

Litigation / Post‑Grant Activity — What I Found and What I Did Not

What I found (from web sources, not sworn docket inspection):

• No CAFC 2026 docket naming U.S. 12,273,412 was located. My searches of published Federal Circuit Rule 36 judgments and 2026 CAFC opinions did not surface this patent number. Search results returned an unrelated Rule 36 disposition (WAG Acquisition v. Google, No. 2024‑1630, decided 2026‑03‑09) and did not connect it to 12,273,412.
• Orca Security Ltd. v. Wiz, Inc., D. Del. C.A. No. 23‑758‑JLH‑SRF (also cited as 1:23‑cv‑00758‑JLH‑SRF) is the operative suit involving this family. Wiz's counterclaims asserted US 11,722,554 — a parent of 12,273,412 (per Wiz's answering brief, D.I. 144; Orca's opening brief, D.I. 112). I found no source stating that 12,273,412 itself was asserted.
• IPR2025‑01083 (Orca v. Wiz, on US 11,722,554) — institution denied 2025‑12‑15. Again, that is the parent, not 12,273,412.
• The Delaware case was stayed (Order, D.I. 233, 2025‑01‑16) pending IPRs, and was subsequently dismissed with prejudice in 2026 by stipulation, each side bearing its own costs (per BankInfoSecurity/Calcalist reporting). PTAB had invalidated all claims of three Orca patents on 2025‑12‑08.
• IPR2025‑01087 (Orca v. Wiz, on US 12,003,529) — terminated‑settled 2026‑01‑14, consistent with the global dismissal.

What I could not verify (stated explicitly, not inferred):

• I did not query USPTO PatentCenter/PAIR or the CAFC CM/ECF docket system directly — searches were web‑based. Absence of a CAFC 2026 docket hit is not proof that none exists.
• No PTAB proceeding (IPR/PGR) specifically challenging 12,273,412 was identified.
• Official current legal status, maintenance‑fee status, and any terminal disclaimer (the related '554 carries a § 154(b) terminal disclaimer) were not independently confirmed for the '412.

Ground‑truth hierarchy used: Where search results conflicted with recollection, I deferred to the search results; where search results conflicted with the authoritative Google Patents full text provided, I deferred to that full text (per operating rules).

I'll search multiple litigation sources for US patent 12273412.

The search surfaced the Orca v. Wiz dispute, which involves Wiz's patent family. Let me verify whether US 12,273,412 itself was asserted, and check the relevant IPRs.

Bottom line

I found no litigation that specifically names or asserts U.S. Patent No. 12,273,412. Searches for the literal identifiers "12,273,412" and "12273412" returned no court docket, complaint, or PTAB proceeding for that patent. No IPR/PGR petition against the '412 patent was found either.

However, the Google Patents record you supplied carries the flag "Family has litigation — First worldwide family litigation filed" with a Darts-ip link for family ID 83007647. That litigation is the Orca Security v. Wiz dispute, which involves the same patent family (the '412 patent is a great-grandchild continuation of Wiz's U.S. 11,722,554, which was asserted). Details below, with the distinction between "asserted patent" and "same-family patent" kept explicit.

---

1. Litigation directly involving US 12,273,412

No district court action, ITC investigation, or PTAB trial naming US 12,273,412 was located in CourtListener/RECAP, Docket Alarm, Unified Patents' litigation/PTAB portal, or news coverage. Given the '412 patent issued 2025-04-08, an absence of enforcement actions in the ~12 months since issuance is not surprising.

---

2. Litigation involving the same patent family (the Darts-ip "family litigation")

Orca Security Ltd. v. Wiz, Inc. — the only known litigation touching family 83007647.

Relationship to US 12,273,412 (literal chain per the '412 specification): 17/109,883 → US 11,431,786 → 17/819,442 → US 11,722,554 → 18/341,134 → 18/478,534 → 18/479,573 → US 12,273,412. So US 11,722,554 is the direct ancestor of the '412 patent and is in the same family.

• Orca initially asserted US 11,663,031 and US 11,663,032, later expanding its operative complaint to US 11,693,685, 11,726,809, 11,740,926, and 11,775,326 (six total).
• On June 4, 2024, Wiz answered and counterclaimed on US 11,722,554, 11,929,896, 11,936,693, 12,001,549, and 12,003,529 ("Wiz Asserted Patents").
• US 11,722,554 — the family member of the '412 patent — was among the Wiz patents asserted. The '412 patent itself was not asserted; it did not issue until April 2025, after Wiz's counterclaims were filed and while the case was stayed.
• On January 16, 2025, the court granted a stay pending resolution of the IPRs.
• PTAB final written decisions on December 8, 2025 found all challenged claims of three of Orca's six asserted patents unpatentable; disclosed to the court by joint status filing December 15, 2025.
• The parties then dismissed all claims and defenses with prejudice, each bearing its own costs/fees. News coverage (BankInfoSecurity / Inforisktoday) describes the stipulation as signed on a "Tuesday," and the related PTAB terminations are dated January 14, 2026, consistent with a dismissal on or about January 13, 2026. I could not confirm the exact stipulation date from a primary docket document, so treat the precise day as unverified.

Dockets: https://dockets.justia.com/docket/delaware/dedce/1%3A2023cv00758/83027 ; https://storage.courtlistener.com/recap/gov.uscourts.ded.83027/gov.uscourts.ded.83027.144.0_1.pdf

---

3. Related PTAB proceedings (none on the '412 patent)

Orca challenged five Wiz patents; no petition targeted US 12,273,412.

Also relevant: Wiz challenged Orca's patents in IPRs instituted December 9, 2024; PTAB found three Orca patents unpatentable on December 8, 2025. Appeal paths to the Federal Circuit existed into early 2026, but I found no CAFC appeal naming the '412 patent.

Sources: https://portal.unifiedpatents.com/ptab/case/IPR2025-01086 ; https://www.docketalarm.com/cases/PTAB/IPR2025-01087/Orca_Security_Ltd._v._Wiz_Inc/

---

4. Other matters checked (not relevant to the '412 patent)

• Coverage of the Orca–Wiz dismissal: https://www.bankinfosecurity.asia/orca-wiz-end-dueling-lawsuits-over-cloud-security-patents-a-30463 and https://www.inforisktoday.in/orca-wiz-end-dueling-lawsuits-over-cloud-security-patents-a-30463
• The Raftt-investor/Wiz dispute reported in Israeli press is a corporate/asset dispute, not a patent case, and does not involve US 12,273,412.

---

Caveats

1. My searches returned zero results for the literal string "12,273,412" — I did not auto-correct it, and no litigation surfaced under that number.
2. The Google Patents "family has litigation" flag is keyed to family ID 83007647, which is populated by the Orca–Wiz case and the '554 patent — not by any suit asserting the '412 patent.
3. Docket completeness: PACER paywalls and my search-step limit mean I cannot rule out a very recent, low-visibility filing. If you need certainty, a paid PACER/Darts-ip query on family 83007647 and a Lex Machina/Unified Patents litigation query for patent number 12273412 would be the definitive check.

If you need a single-sentence answer: no litigation is known that asserts US 12,273,412; the only litigation in its patent family is Orca Security Ltd. v. Wiz, Inc., No. 1:23-cv-00758 (D. Del., filed July 12, 2023), which asserted the family's parent patent US 11,722,554 and was dismissed with prejudice around mid-January 2026.

I'll start by checking whether any AIA trial proceedings exist for this patent, then attempt to corroborate via web search.

Let me dig into the family-member proceedings and check specifically for any petition naming the '412 patent.

Proceedings overview

Total AIA trial proceedings challenging US 12,273,412: zero. The canonical structured block supplied with this task ("PTAB proceedings on file") reflects a USPTO Open Data Portal query returning no IPR, PGR, or CBM naming US 12,273,412 as the challenged patent (0 active / 0 claims invalidated / 0 claims sustained / 0 settled / 0 institution denied). Independent web searching corroborates that result — the only PTAB activity in this patent family is IPR2025-01083, which challenged the ancestor patent US 11,722,554, and was denied institution on the merits on 2025-12-15. Bottom-line defensive posture: there is no cancellation, no estoppel, and no PTAB paper trail against the '412. A defendant cannot say "claim 1 is already dead." What a defendant can say is that the one time anyone tried to invalidate this disclosure at the Board, the Board refused to institute — which makes an IPR-based defense against the '412 an uphill fight, not a slam dunk.

---

No proceeding to report against the '412 itself

The canonical ODP list is empty, and I could not find a petition, institution decision, or FWD naming US 12,273,412 in any public source. Concretely:

• The '412 issued 2025-04-08 (filed 2023-10-02, app. 18/479,573; priority 2020-12-02; anticipated expiration 2040-12-02). It is a late continuation of the 17/109,883 → 11,431,786 → 17/819,442 → 11,722,554 → 18/341,134 → 12,381,939 → 18/478,534 → 11,985,185 chain.
• It is not among the patents asserted in Orca Security Ltd. v. Wiz, Inc., No. 1:23-cv-00758 (D. Del.), and Orca's 2025-06-04 IPR campaign against Wiz (IPR2025-01083/01084/01085/01086/01087) targeted the '554, '896, '693, '549, and '529 patents — not the '412.

Residual uncertainty: the '412 has been in force roughly six months. A petition filed very recently could postdate the ODP ingest. My searches surfaced nothing, but I am flagging that window rather than asserting absolute certainty. Everything below is therefore related-proceeding context, not a proceeding on the '412.

---

IPR2025-01083 — Orca Security Ltd. v. Wiz, Inc. (challenged US 11,722,554 — family ancestor, NOT the '412)

• Type: Inter Partes Review
• Filed: 2025-06-04
• Status: Institution Denied (denied 2025-12-15; case terminated 2025-12-15). Plain English: the Board refused to start a trial because the petitioner did not show a reasonable likelihood of prevailing on even one claim.
• Judge panel: Karl D. Easthom, Nabeel U. Khan, Lisa A. Murray (Tech Center 2400, Art Unit 2447)
• Petition grounds: Claims 1–5, 7–16, 18–21 challenged under 35 U.S.C. § 103 only, No. § 112 or § 102-only grounds:
  • Ground 1 — claims 1, 4, 7–12, 15, 18–21 obvious over Shivamoggi (US 11,770,387 B1)
  • Ground 2 — claims 2, 3, 13, 14 obvious over Shivamoggi + Zhong (US 10,693,743 B2)
  • Ground 3 — claims 5, 16 obvious over Shivamoggi + Woolward (US 2020/0382560 A1)
  • Supported by the declaration of Dr. Chuck (William) Easttom (Ex. 1003).
• Institution decision: Denied 2025-12-15 under 35 U.S.C. § 314(a). The Board found the record insufficient to show a reasonable likelihood that the Shivamoggi-based combination taught the insight limitation of claim 1 — specifically, Shivamoggi's "suspected attack paths" was not shown to be the claimed "list of abnormal connections" generated from the graph. (Caveat: the claim-level rationale is reported via secondary docket summaries; the underlying institution decision is the public PTAB paper, and the district-court copy of the corresponding family FWDs was filed under seal. Treat the precise wording as needing confirmation against PTAB E2E Paper 10.)
• Procedural events worth noting: Orca filed a Sotera-type stipulation (EX1016, served 2025-08-14) offering to give up its IPR grounds in the district case; Patent Owner filed a request for discretionary denial (2025-08-26) and a POPR (2025-09-26); the Board referred a Director Discretionary Decision on 2025-10-17; petitioner's opposition to discretionary denial was filed 2025-09-26. In the end the denial was on the merits, not on § 314(a)/Fintiv discretion. Petitioner's post-institution fees were refunded (board notice 2026-02-19).
• Settlement / termination: No settlement — denial on the merits terminated the proceeding. Because institution was denied, Orca's conditional Sotera stipulation never took effect.
• Appeal: I found no notice of appeal to the Federal Circuit for IPR2025-01083. Its rehearing/Director-review and appeal windows would have run in early 2026; absent a filing, the denial is final. (Contrast: the Wiz-side FWDs in IPR2024-00863/00864/00865 issued 2025-12-08, with rehearing/Director-review due 2026-01-07 and Federal Circuit notice of appeal due 2026-02-09.)
• Defensive value for the '412: This is the single most useful data point a defendant has. The closest prior-art attack anyone has assembled against this specification — Shivamoggi as primary reference — failed at the institution stage. But note the limits: (i) it was never adjudicated on the merits against any claim; (ii) no estoppel attached; (iii) the '412's claim 1 is not the '554's claim 1, so the Board's reasoning does not automatically transfer.

Companion proceedings in the same 2025-06-04 Orca campaign (all against Wiz patents, none against the '412):

Wiz's parallel IPRs against Orca's patents (context for the pattern; unrelated to the '412): IPR2024-00220 ('735) and IPR2025-00095 ('855) filed by Wiz; IPR2024-00863/00864/00865 obtained Final Written Decisions on 2025-12-08 holding all claims of Orca's '031, '032, and '685 patents unpatentable; IPR2024-01109 ('809) instituted 2025-01-16 (FWD due ≤ 2026-01-16) and IPR2024-01190 ('926) instituted 2025-01-22. The underlying district case was stayed 2025-01-16 pending IPR and then dismissed with prejudice on 2026-01-13 (D.I. 237–238).

---

Strategic summary

Claim status on the '412. Nothing is canceled, nothing is sustained, nothing is tested. Claims 1–19 — including independent method claim 1, the independent CRM claim 10, and the independent system claim 11 — are entirely untested at the PTAB. The invalidation history that exists in this family belongs to other patents: Orca's asserted patents were wiped out (all claims of '031, '032, '685 held unpatentable on 2025-12-08), while the Wiz-side family members were never invalidated — the '554 and '549 survived institution-stage attack, and the '896 and '693 are mid-trial with FWDs due 2026-12-15. The '412, along with its untested siblings '939, '185, '270, and '948, carries no PTAB outcome at all.

Estoppel landscape. There is no § 315(e)(2) estoppel running against anyone on the '412, because no IPR was ever instituted on it. Conversely, a defendant facing assertion of the '412 starts with a clean slate of prior art — no ground is foreclosed, and no petitioner has burned the Shivamoggi/Zhong/Woolward line of attack. One nuance to keep straight: the Sotera stipulations Orca filed across IPR2025-01083 and its companion petitions were conditional on institution. They never matured for the '554 or the '549 (both denied), and they never touched the '412 at all. If you are advising a defendant, the full prior-art universe — including art Orca already assembled, plus anything new — remains available for a § 102/§ 103 challenge, and § 315(b) is not triggered unless and until you are served with a complaint on the '412.

Pattern signals. Orca ran a coordinated five-petition campaign against Wiz on 2025-06-04; all petitions leaned on the same primary reference (Shivamoggi), and the two that were denied were denied for the same shortfall. That is a strong hint that the Shivamoggi-centric theory does not travel well against this specification — including to the '412, whose claim 1 requires insights that are "natural-language representations" and then requires "filtering the network insights based on an insight indicating exposure from an external network." A filtering-on-exposure limitation is a materially narrower hook than the '554's "list of abnormal connections," so a petitioner would need new art or a new theory. Wiz, for its part, was an aggressive PTAB filer in both directions (six IPRs against Orca's patents, plus IPR2024-00220 and IPR2025-00095) and successfully litigated for stays; the Delaware case it was defending was dismissed with prejudice on 2026-01-13. I found no defensive aggregator (Unified Patents, RPX, etc.) in the chain — the Unified Patents hit in my search is only a public case-list page, not a Unified-filed petition. Reported acquisition context (Wiz acquired by Google) is press-sourced and should be verified independently before you rely on it.

---

Recommended next steps

• If you are a defendant now facing assertion of the '412: do not plan around a canceled claim — there isn't one. Your § 282 invalidity case is entirely yours to build.
• Confirm the empty docket yourself before finalizing any opinion. The '412 issued only 2025-04-08; run a fresh PTAB E2E / Patent Center search at https://patents.google.com/patent/US12273412/en and the ODP endpoint, because a recently filed petition could sit in the ingest gap.
• Get the IPR2025-01083 institution decision itself (PTAB Paper 10, 2025-12-15) and read the claim-1 reasoning, not a summary. Docket and documents: Docket Alarm IPR2025-01083 and ipVerse case detail. The district-court joint notice with the companion-proceeding status table is at D. Del. D.I. 235; the full district docket is on CourtListener.
• Watch the two live family trials: IPR2025-01084 ('896) and IPR2025-01085 ('693), both instituted 2025-12-15, with statutory FWD deadlines of 2026-12-15. A decision there adjudicates the same specification at the merits stage for the first time — the outcome will be the best available predictor for how the '412 would fare on a Shivamoggi-style theory.
• If you are considering filing an IPR on the '412: the § 315(b) one-year clock has not started unless you have been served with a complaint asserting it. Note the family's prosecution history is already in the record as petitioner exhibits (EX1018–EX1020 in IPR2025-01083), which may narrow your room to argue claim-scope distinctions.

Sources consulted: Google Patents US12273412B2 (authoritative full text); the structured PTAB-proceedings block in this prompt (canonical ODP list); the sources linked above. Where I am relying on a secondary summary rather than a primary PTAB document, I have said so explicitly.

I'll start by verifying the key facts I can extract from the patent text, then cross-reference with live sources.

Let me verify the assignment record details and check for any additional recorded assignments or security interests.

Ownership & Assignment Analysis — US 12273412 B2

Patent: US 12273412 B2 — System and method for analyzing network objects in a cloud environment
App. No.: 18/479,573 · Filed: 2023-10-02 · Granted: 2025-04-08 · Priority: 2020-12-02
Assignee of record: Wiz, Inc. (New York)

Source-access note (read first). I was able to retrieve the assignment data that Google Patents mirrors from the USPTO assignment system (the legal-events block for this patent), but I was not able to open the Assignment Center / assignment.uspto.gov record directly (the query returned no results page within my tool budget). Accordingly, the reel/frame and party data below are grounded in the legal-events record embedded in the patent text, but the correspondent-of-record field (the recording attorney/agent) could not be confirmed and I will not invent one. Where a field is unknown I say so.

---

Inventors

Pattern assessment: No unusual departure pattern. This is the opposite of a pre-fire-sale inventorship break-up — two of the five inventors are Wiz's co-founders and CTO/VP-R&D, and the inventorship group recurs across the whole Wiz family (US 11,431,786 → US 11,722,554 → US 11,985,185 → US 12,192,270 → US 12,255,948 → this patent). All five inventor-assignors executed the assignment to Wiz before the priority date (signing dates 2020-11-29 to 2020-12-02), consistent with standard employment invention-assignment practice at a company founded in January 2020.

---

Original assignee

Wiz, Inc. — New York, NY (technically a US-incorporated entity; engineering concentrated in Tel Aviv, Israel).

• Primary line of business: Cloud security / CNAPP. Wiz ships a commercial agentless cloud-native application protection platform (the "Wiz Cloud Security Platform") that scans AWS, Azure, Google Cloud, OCI and Kubernetes for vulnerability, configuration, network and identity risk. This is directly the subject matter of the '412 claims (network-object analysis, graph construction, exposure insights in a cloud environment) — the original assignee ships a product embodying the claims.
• Commercial traction: Claimed the fastest-ever $1M→$100M ARR ramp (≈18 months); ~$350M ARR (2023); crossed $1B ARR in 2025.
• Status: Operating; acquired. Google/Alphabet announced a $32B all-cash acquisition on 2025-03-18 (deal value later confirmed at $32B), cleared US (DOJ, Nov 2025) and EU (Feb 2026) antitrust review, and closed 2026-03-11. Wiz operates as a distinct brand/product line within Google Cloud. It is not dissolved, in bankruptcy, or a licensing entity.

---

Assignment timeline

One (1) recorded assignment exists for this patent. There are no post-issuance transfers, no security agreements, and no merger assignments appearing in the records I could reach.

• 2020-11-29 → 2020-12-02 (executed) / recorded 2024-03-12 — Reel 066736/0031
  • Conveyance: Assignment (inventor-to-employer; "ASSIGNMENT OF ASSIGNORS INTEREST")
  • Assignor: Shai Keren; Daniel Hershko Shemesh; Roy Reznik; Ami Luttwak; Avihai Berkovitz
  • Assignee: WIZ, INC. , New York
  • Correspondent: Not determinable from the sources I could access. The Google Patents legal-events mirror does not expose the correspondent field, and my direct Assignment Center retrieval returned no page. I will not guess a name or firm.
  • Context: Original inventor→company assignment for the priority application (Ser. No. 17/109,883, filed 2020-12-02). Notably it was recorded ~3 years after execution (2024-03-12) — a belated perfection step that lands in the same window as this continuation's pre-issuance publication (US 2024/0146799 A1, 2024-05-02) and roughly three months before Wiz's June 2024 counterclaims in the Orca litigation. Belated recording of a founder assignment is common docket/perfection housekeeping, not a transfer.

No chain-of-title movement after 2024-03-12 is reflected in the data I can reach. In particular, no assignment recording the Alphabet/Google merger transition appears. That may be because (a) an internal merger/stock-purchase step for a wholly-owned subsidiary is often not recorded as a separate asset assignment, or (b) the record simply post-dates the snapshot I was working from. Treat "Google is the current owner of this patent on the USPTO assignment record" as unverified. What is verified is that Wiz, Inc. is the assignee of record on Reel 066736/0031, and that Wiz, Inc. is now an Alphabet subsidiary as of 2026-03-11.

Verification links: https://assignmentcenter.uspto.gov/ · https://assignment.uspto.gov/patent/index.html — search App. No. 18/479,573 or Patent No. 12273412. Reel/frame to pull: 066736/0031.

---

Timeline diagram

timeline
    title Ownership of US 12273412
    2020 : Inventors assign rights to Wiz Inc
    2021 : Wiz platform commercially launched
    2022 : First family patent issues as US11431786
    2023 : Continuation filed as 18479573
    2024 : Inventor assignment recorded as reel 066736
         : Wiz counterclaims against Orca Security
    2025 : US 12273412 granted
    2026 : Alphabet completes 32B Wiz acquisition

---

NPE / troll-pattern signals

1. Shell-entity transfer — not present. The only assignee in the chain is Wiz, Inc. — a New York operating company with ~950 employees (2024) and >$1B ARR (2025). No "IP / Holdings / Licensing / Ventures" suffix, no registered-agent service address, no single-purpose LLC. Reel 066736/0031 names an operating company as assignee.

2. Known asserter in the chain — not present. Neither Wiz, Inc. nor Alphabet appears on the classic NPE rosters (Acacia, Marathon, Intellectual Ventures, IPNav, Wi-LAN/Mosaid/Conversant, Vringo, Pendrell, Innovatio, MPHJ, Lumen View, Round Rock, Spangenberg entities). Wiz is a product company that litigates its own patents; it is not an acquisition vehicle for assertion.

3. Repeat correspondent across the chain — unclear / not determinable. There is only one recorded assignment (Reel 066736/0031), so there is no recurrence to evaluate. I could not retrieve the correspondent name from the record, so I cannot check it against any Unified Patents / RPX / Patent Progress correspondent list. This signal is unresolved due to missing data, not because it was checked and cleared.

4. Cascading transfers — not present. Single recorded link, inventor→Wiz. No chained LLCs, no sub-24-month transfer sequence.

5. Pre-litigation transfer — not present (as a transfer). The 2024-03-12 recording of Reel 066736/0031 falls ~3 months before Wiz's counterclaims in Orca Security Ltd. v. Wiz, Inc., C.A. No. 1:23-cv-00758 (D. Del.), and 8 months after Orca's July 2023 original complaint. But this is the original founder assignment being perfected, not a transfer engineered to manufacture standing or venue. The patent stayed with the operating inventor's employer throughout.

6. Bankruptcy fire-sale — not present. No Chapter 7/11 proceeding; Wiz's trajectory was private financing ($1.9B raised) → record exit. Its founder-inventors became billionaires at close.

7. Privateering — not present. No operating company parked patents with an outside NPE to assert against competitors. Wiz asserted its family patents in its own name (counterclaim-plaintiff in 1:23-cv-00758) — the antithesis of privateering.

8. Defensive aggregator — not present. The chain terminates at an operating company (Wiz, Inc. → Alphabet/Google), not at RPX, AST, LOT Network, Unified Patents, or OIN. The patent is active and not neutralized.

Corroborating context (operating-company assertion): Google Patents flags this family as "Family has litigation." Wiz asserted a sibling family patent, US 11,722,554 (same priority chain: 17/109,883 → 17/819,442 → …), as one of the "Wiz Asserted Patents" in its June 4, 2024 counterclaims against Orca Security. Both sides dismissed all claims with prejudice (stipulation, early 2026) after the PTAB invalidated three of Orca's asserted patents in December 2025. That is competitor-vs-competitor assertion, not NPE assertion.

---

Verdict

Operating-company assertion.

The chain is a single link — five Wiz inventors to Wiz, Inc., executed 2020-11-29→2020-12-02 and recorded 2024-03-12 at Reel 066736/0031 — with no downstream transfers, no licensing shell, and no asserter entity. Wiz, Inc. is an operating cloud-security vendor whose flagship platform practices the claimed subject matter, it enforced a sibling patent in this same family (US 11,722,554) against competitor Orca Security in D. Del., and it has since been acquired by Alphabet/Google (closed 2026-03-11) and continues as an operating product line — none of the eight NPE signals is affirmatively present.

Caveats for a reviewer: (i) the correspondent of record on Reel 066736/0031 was not retrievable and should be pulled manually from Assignment Center to close out signal #3; and (ii) no assignment recording the Google/Alphabet merger step was found — the "current assignee" field should be re-verified against Assignment Center before relying on Alphabet's name on the title record.

Verify at: https://assignmentcenter.uspto.gov/ (search Patent No. 12273412 or App. No. 18/479,573; pull Reel 066736, Frame 0031) · https://assignment.uspto.gov/patent/index.html

I'll verify the patent on USPTO and gather details on each cited reference.

Let me pull the citation list as printed and verify the most substantive references.

Let me verify several more of the cited references.

Prior‑Art Analysis — US 12,273,412 B2

Analysis date: April 26, 2026 (see date-discrepancy note at the end).
Reference list source: the authoritative full text of US 12,273,412 B2 supplied for this analysis (Google Patents, "Citations (21)" section). Per the operating rules, where anything conflicts I defer to that full text.

---

0. Identification & scope

The identifier 12273412 is read literally as US 12,273,412 B2, Wiz, Inc., System and method for analyzing network objects in a cloud environment, app. 18/479,573, filed 2023‑10‑02, granted 2025‑04‑08, priority 2020‑12‑02 (earliest parent 17/109,883). The USPTO full text lists 21 patent‑document citations. All 21 are analyzed below.

Two sourcing caveats stated up front, because they matter:

1. The list below is the citation list as it appears in the granted patent (Google Patents full text). I was not able to independently pull a USPTO PatentCenter/PAIR "References Cited" printout in this session, so I cannot state whether any additional references appear only in the file wrapper. The 21 are the ones of record in the printed patent.
2. The list is a single, undifferentiated examiner/listing citation set. The grant document does not, in the material supplied, map individual references to individual claims or assign X/Y/A categories. Any "which claim does it hit" mapping below is my analytical inference, not a quotation from the record, and is flagged as such.

---

1. The statutory frame (this is the crux)

Priority date: 2020‑12‑02. Because the '412 is a continuation in the same family, art is measured against 2020‑12‑02, and the specification is unchanged across the family (no new matter).

• Any reference published before 2020‑12‑02 is a candidate under §102(a)(1).
• A reference published on/after that date can still qualify under §102(a)(2) if it is a US patent/application publication with an effective filing date before 2020‑12‑02.
• Anticipation under §102 requires a single reference disclosing every element of the claim. Obviousness (§103) permits combination.

The element that does the work: independent claims 1, 10, and 11 (method / CRM / system, substantively coextensive) each end with "filtering the network insights based on an insight indicating exposure from an external network." As flagged in the prior section, the abstract and specification point at NLP insight generation; the claims are pointed at filtering an already‑generated insight set using an external‑exposure insight. None of the 21 cited references, on its face, discloses that final filtering step in combination with the tagging step that precedes it. That means there is no clean §102 anticipation of claims 1/10/11 among the cited art — the cited set is, realistically, §103 combination material. I state that as an analytical conclusion, not as a legal opinion.

---

2. The 21 cited references

---

3. Most relevant cited prior art — ranked

Potentially most relevant (in order):

1. US 2014/0157417 A1 (Boeing; granted US 9,712,551 B2) — closest on the structural half of claim 1: network objects, links/data flows, a graphical representation, and an explicit vulnerability path ("path an actor could take if the actor gained unauthorized access"). Its background statement about "multiple layers of a network including network devices and other objects/processes through which data may flow" is directly on‑point for the "objects are deployed and operable at different layers" element. Verified at https://patents.google.com/patent/US20140157417 and https://www.patents-review.com/a/20140157417-methods-systems-architecture-centric-threat-modeling.html.
2. US 2020/0267175 A1 (Raytheon BBN) — closest on the representation/insights half: semantic graph instance models built by fusing heterogeneous sources, plus derived aggregate attributes (an "insight"‑like output). Verified at https://www.patents-review.com/a/20200267175-systems-methods-evaluating-cyber-assets.html.
3. US 2016/0359872 A1 (Cisco) — strong on cloud/data‑center object‑data collection and topology, i.e. the S210/S220 subject matter.
4. US 2019/0095530 A1 (Estia) — closest to the "tagging" limitation, which is a claim element that most of the other art ignores.
5. US 2016/0048556 A1 (Graphika) — the only cited reference whose subject is literally filtering, useful as §103 art against the culminating "filtering the network insights" step.

Supports the dependent‑claim flank: US 11,709,944 B2 (Darktrace) and US 9,210,185 B1 (Lookingglass) for anomaly/vulnerability (claims 6–9/16–19); US 10,977,587 B2 (Northrop Grumman) for claims 8/18.

Poor §102 candidates (cited for background only): US 10,171,300 B2 (growing neural gas), US 2020/0374343 A1 (delivery of blocks), US 2016/0373944 A1 (wireless optimization), US 2018/0024981 A1 (TDA spreadsheets). On their face these have little to no element‑level correspondence to claims 1/10/11.

---

4. Bottom line on §102

• No cited reference anticipates claims 1, 10, or 11 as a whole, because none discloses the terminal limitation — filtering the network insights based on an insight indicating exposure from an external network — in combination with the tagging step.
• The realistic threat model from this cited art is §103: e.g., Boeing (multi‑layer object graph + vulnerability path) combined with Raytheon BBN (semantic‑graph instance models + derived attributes) and further combined with a filtering reference such as Graphika. Even that combination does not obviously reach the external‑exposure‑based filtering, which is why the nearest art in the family (the '554 and '185 parents, distinct claim sets) was the subject of the Orca IPRs rather than this reference set.
• §102(a)(2) watch‑list: US 2020/0382539 A1 (pub. one day after priority), US 10,924,347 B1, US 2023/0008765 A1, and US 11,709,944 B2 are post‑priority publications that remain available only via their 2019 effective filing dates.

---

5. Explicit limitations / caveats

• Descriptions for references #1, #4, #8, #10, #11, #13, #15, #16, #17, #18, #20, #21 are derived from the title as printed in the authoritative full text plus general field knowledge. I did not verify their claim text or specification content in this session (search budget exhausted before those lookups). Treat those descriptions as title‑based and lower confidence; the §102/§103 mapping for them is provisional.
• I did not obtain the USPTO file wrapper's own claim‑rejection mapping; the "claims implicated" column is entirely my inference.
• Per the previously generated section's admonition, this analysis relies on the claims, not the abstract — the abstract describes NLP insight generation, which is not what claims 1/10/11 recite.
• Contradiction flagged: the previously generated section and the authoritative full text are consistent with each other (19 claims; independent claims 1, 10, 11; priority 2020‑12‑02; 21 citations). The one inconsistency is the date: the system/banner date is 2026‑10‑01 and the full text was fetched 2026‑09‑24, while this task states April 26, 2026. I have not adjusted any patent identifier or date on that basis; flagging it so the chronology of the Orca/Wiz litigation notes isn't misread.

I'll ground the key references from the page's Prior Art section before building the §103 analysis.

Obviousness Analysis — U.S. Patent No. 12,273,412 B2

Under 35 U.S.C. § 103 (AIA), as of the 2020‑12‑02 effective filing date

Scope note: This analysis is built from the Prior Art listings on the US12273412B2 Google Patents page (Patent Citations — 21 refs; Family Cites Families — 10 refs; Families Citing this family — 95 refs; Similar Documents) plus targeted verification of five key references. Where I verified reference disclosure through search, I say so and link. Where I am working from title, assignee, and effective filing date only, I flag it as unverified content. Per operating rules I have not auto‑corrected any identifier.

---

1. Legal framework applied

AIA § 103. Because the '412 patent claims priority to an application filed 2020‑12‑02, the critical date is 2020‑12‑02. Prior art therefore includes:

• § 102(a)(1): anything publicly available (printed publication, patent, public use) before 2020‑12‑02.
• § 102(a)(2): U.S. patents and U.S. application publications effectively filed before 2020‑12‑02, even if they published afterwards (and even if they published just after — e.g., US20200382539A1, published 2020‑12‑03, is still § 102(a)(2) art on its 2019‑06‑03 priority).

KSR Int'l Co. v. Teleflex Inc., 550 U.S. 398 (2007), governs. Key holdings I apply below: (i) a combination of familiar elements according to known methods is obvious when it yields no more than predictable results; (ii) if a technique has been used to improve one device/process and a POSITA would recognize it would improve a similar one in the same way, that is obvious; (iii) where there is a design need, market pressure, and a finite number of identified, predictable solutions, the combination is obvious; (iv) the motivation need not appear in the references themselves and may be found in the knowledge, common sense, or the prior art as a whole.

Also relevant: the examiner allowed claims 1/10/11 over the 21 cited references (Non‑Final Action mailed 2024‑07‑05, then allowance). That does not immunize the claims; it does mean an invalidity theory must show a combination the examiner did not substantively address, or must explain why the examiner's individual-reference rejections understated the references' collective teachings.

---

2. Person having ordinary skill in the art (POSITA)

A POSITA here has a bachelor's degree in computer science, computer engineering, or electrical engineering (or equivalent), plus roughly 2–4 years of experience in cloud networking, cloud infrastructure APIs, and network security posture tooling — or a master's degree with less experience. The POSITA is familiar with:

• cloud provider control-plane APIs (AWS, Azure, GCP) and Kubernetes/container orchestrators (the '412 spec itself names AWS®, Azure®, and Kubernetes®);
• network topology/graph modeling (nodes, edges, dependency maps);
• security scanning, CSPM‑style exposure analysis, and attack‑path modeling;
• query/reporting front‑ends and, by 2020, natural‑language interfaces to data platforms.

This is not a POSITA who must invent natural‑language generation — by 2020, template‑based NLG over structured graph data and NL query front‑ends were routine engineering.

---

3. Claim construction of the limitations that drive the analysis

Claim 1 recites six steps. Two construction points matter:

That last limitation is the narrowest hook remaining in the granted claim. Note the spec's own framing of the problem: protocol‑agnostic solutions "may be over‑broad, providing irrelevant or redundant information" — i.e., the patent itself states the motivation to filter down to what matters. That statement is a § 103‑usable admission about the state of the art and the design need.

---

4. The prior art on the page, mapped to claim 1

4.1 Availability (§ 102 status as of 2020‑12‑02)

All 21 examiner‑cited references have effective filing dates before 2020‑12‑02 and are available:

Also available from the "Family Cites Families" block (2010–2020 filings): US8874749B1 (Citrix), US10129344B2 (Microsoft), US10693743B2 (Splunk, 2015‑09‑21), US10846122B2 (Google), US11146581B2 (Radware, 2018‑12‑31), US11310284B2 (Varmour, 2019‑05‑31), US11281558B2 (IBM), US11770387B1 (Rapid7, 2020‑07‑17). US11955117B2 (TD Bank, 2021‑05‑27) is not prior art — post‑dates.

From "Families Citing this family," only the pre‑2020‑12‑02‑filed items are usable, notably the Lacework cluster (2017‑11‑27 priority and 2019‑12‑23 priority) and the Fortinet/Lacework "natural language" items, e.g. US11973784B1 ("Natural language interface for an anomaly detection framework," 2017‑11‑27) — § 102(a)(2) art. The large majority of that 95‑item list (MITRE US20230065398A1 at 2021‑08‑27; Noname US12107732B2 at 2022‑11‑14; Robin Systems WO2024129065A1 at 2022‑12‑13; Palo Alto US20250047701A1 at 2023‑07‑31; Mixmode US20250168178A1 at 2023‑11‑20; Citibank US11792125B1; Bank of America US12175227B2; Pure Storage US12609934B2; OpenAI US12518109B1) post‑dates the critical date and cannot be used.

4.2 Element‑by‑element mapping

Reading the mapping as a whole: limitations (a)–(c) and (e) are squarely disclosed by Splunk '743 alone (cloud resource data collection → topology map with nodes/edges → tags/triggers on map elements). Limitation (d) is squarely disclosed by Lacework '3784. Limitation (f) is the exposure‑filtering concept, disclosed in the cyber‑threat‑modeling art (Raytheon, Boeing, Darktrace) and, more generally, in the CSPM practice of isolating internet‑exposed resources.

---

5. Combinations that render claim 1 obvious

Combination A (primary): Splunk '743 + Lacework '3784 + Raytheon '175

What each contributes

• Splunk US10693743B2 — (a), (b), (c), and (e): collecting cloud‑resource data from cloud services, generating an interactive topology map whose nodes are cloud resources and edges are their relationships, and associating tags/triggers with map elements.
• Lacework US11973784B1 — (d): an anomaly‑detection framework monitoring a cloud deployment that generates natural‑language inputs/descriptions from detected events and serves them through a natural‑language interface; its data platform ingests cloud‑environment data including "configuration information… network activity information… events," and does so in "agentless configurations."
• Raytheon US20200267175A1 — (f) and, supportively, claims 6/8: builds semantic graphs of an environment including an explicit external entity class and trust boundaries, constructs attack vectors, and derives exposure/detectability attributes — i.e., it produces exactly the "insight indicating exposure from an external network" used as the filter predicate.

Why a POSITA would combine them

1. Same field and same problem. All three are network/cloud monitoring‑and‑security analytics platforms operating on the same data (cloud resource inventories, connectivity, configuration, events). KSR, 550 U.S. at 417.
2. Art‑recognized design need. The '412 specification itself concedes that broad, protocol‑agnostic monitoring "may be over‑broad, providing irrelevant or redundant information." Splunk's own disclosure is motivated by the same concern — it notes the topology map lets users "analyze the collection of resources in ways that are not possible using conventional cloud computing service management consoles." Reducing analyst information overload by filtering to externally exposed objects is the natural, expected use of an exposure attribute.
3. Predictable result, no new mechanics. Each step is a data‑processing step: tag graph nodes → generate text about them → select the subset whose tag/attribute indicates external exposure. Combining a query/filter UI (Splunk) with an NL description layer (Lacework) and an exposure classifier (Raytheon) is the routine composition of three software modules over a shared data model.
4. Finite, identified solutions. By 2020 the set of candidate filtering predicates for security triage (exposure, privilege, anomaly, vulnerability) was small and known. KSR ("a finite number of identified, predictable solutions").

Combination B: Cisco '59872 + Splunk '743 + Lacework '3784 + Raytheon '175 (or Boeing '417)

Adds Cisco US20160359872A1 to supply express multi‑layer coverage: it discloses automatic determination of network topology, device type/model, interconnection type, and "dependencies of components within the network" across the datacenter fabric, and a web front‑end exposing "traffic flows, application dependency maps, network topology." This directly meets the "objects … operable at different layers" language and the relationship graph of (c). Boeing '417 substitutes for Raytheon as the exposure source if architectural threat modeling with visualization is desired; both are in the threat‑modeling field and neither is more than a substitution of one known exposure‑identification technique for another.

Motivation: Cisco and Splunk are both enterprise network‑monitoring platforms addressing datacenter/cloud topology discovery; a POSITA building a cloud‑wide object graph would look to precisely this body of work; layering an NL description module (Lacework) and an exposure filter (Raytheon/Boeing) onto that graph is the ordinary engineering step of adding reporting and triage to an existing topology tool. No reference teaches away — none criticizes combining topology modeling with threat/exposure analysis.

Combination C: Splunk '743 + Lacework '3784 + Darktrace '944 + Rapid7 '70387

• Rapid7 US11770387B1 — graph‑based network representation and lateral‑movement detection (path/relationship modeling).
• Darktrace US11709944B2 — an "intelligent adversary simulator" that models attack paths and identifies vulnerable/exposed assets.
• Lacework '3784 — NL generation over the monitored environment.
• Splunk '743 — cloud object collection + tagged topology map.

Motivation: adversarial path simulation (Darktrace) is a known technique for producing "this object is reachable/exposed" facts; feeding those facts into a graph‑filtered, NL‑described reporting pipeline is the predictable application of a known technique to a known data structure. KSR at 417.

Combination D (secondary/backup): Splunk '743 + Lacework '3784 + Boeing '417 + NEC '2461

Uses NEC US20200252461A1 (temporal discrete‑event analytics) for the anomaly/alert dependents (claims 6/7) and Boeing US20140157417A1 for the exposure/vulnerability determination (claims 8/9). Useful if a challenger prefers a threat‑modeling reference over a sim‑based one.

---

6. Dependent claims

Note the near‑tautology in claim 8: the claim's own preamble and claim 1 already presuppose a method "for filtering network insights from vulnerable network objects having cyber‑threats." A reference disclosure that predicts attack outcomes for assets (Raytheon, Northrop, Darktrace) supplies the vulnerability determination as a matter of design choice.

---

7. Arguments the patent owner will make — and how they fare

1. "The references are in different fields; no motivation to combine." Weak. All sit in network/cloud monitoring and security analytics; Splunk, Cisco, Lacework, Raytheon, Darktrace, Varmour, Radware and Northrop are all commercial security/monitoring platforms. KSR expressly allows motivation from the design need and the ordinary creativity of a POSITA. The patent's own Background supplies the need (information overload from over‑broad monitoring).

2. "The examiner considered all 21 references and allowed the claims." Not dispositive. The 21 references were cited individually, mostly as background; the record shows no substantive multi‑reference § 103 rejection on the filtering‑by‑external‑exposure limitation as now claimed. A petition/rejection built on an explicit three‑reference combination with articulated motivation is materially different from per‑reference citation.

3. "Natural‑language generation from a cloud graph is non‑obvious." Weak given Lacework '3784 (2017‑11‑27 priority) expressly integrating NL generation and an NL interface into a cloud‑deployment anomaly‑detection framework, and given that the claim requires only "natural‑language representations," not a trained model — template/report generation suffices. Additionally, the page's "Families Citing this family" block shows the Fortinet/Lacework line building "generative AI assistant," "natural language queries," and "knowledge graph" interfaces on the same 2017 priority, corroborating that this was a known direction by 2020.

4. "The combination must be evaluated as of 2020, and the cloud‑specific objects (Kubernetes, IaC) were new." Partially available but limited. The claim is agnostic as to object type; the spec's own examples (AWS®, Azure®, Kubernetes®) are named as ordinary existing platforms.

5. Secondary considerations. I found no evidence in the record of unexpected results, long‑felt need, industry praise, or licensing attributable to the '412 patent specifically. The patent did issue, but that is not a secondary consideration. If the patent owner asserts commercial success, the nexus would be to the broader Wiz CSPM product, not to the claim's filtering step — nexus is the vulnerability in that argument.

---

8. Honest limitations of this analysis

Per the operating rules, I am flagging where I lack high confidence:

• I verified content only for five references (Cisco US20160359872A1, Splunk US10693743B2, Lacework US11973784B1, Estia US20190095530A1, Raytheon US20200267175A1) and partially for the Nov 2020 Raytheon application US20200252418A1. Everything asserted about Boeing US20140157417A1, Darktrace US11709944B2, Rapid7 US11770387B1, Northrop US10977587B2, Varmour US11310284B2, Radware US11146581B2, Boeing, Lookingglass, and NEC is inferred from title/assignee/date and general practice, not verified against the reference text. Do not file a § 103 rejection on those without pulling the documents.
• The search tool exhausted its step budget before I could verify Darktrace, Boeing, and Rapid7, so those three carry the lowest confidence in the combinations above. Combination A relies least on them.
• The "filtering" limitation is the crux. A successful § 103 challenge must show art that discloses using external-network exposure as a selection predicate over generated textual insights — not merely generating an exposure finding. In Raytheon '175 the exposure/attack‑vector output is used for planning and prediction; using it additionally to filter a report stream is a one‑line combination but is the element a patent owner will contest hardest. This is where the analysis is most vulnerable and where additional prior art (e.g., CSPM product documentation, Varmour/Radware, or the Lacework "attack path" line, US12267345B1) should be developed — while noting US12267345B1 is a 2017‑11‑27‑priority Lacework item and therefore § 102(a)(2)‑available.
• This is an obviousness opinion on paper, not a validity opinion. It does not address § 101 (the claims recite a practical filtering/security application, so § 101 risk appears low), § 112, or the near‑identical claim scope across the family (the '554, '185, and '412 claims differ mainly in the final "filter/determine/insight" clause) — which raises obviousness‑type double patenting exposure independent of § 103. That ODP question is flagged here but not analyzed.

---

9. Bottom line

Claims 1, 10, and 11 of US 12,273,412 are, in my assessment, vulnerable to a § 103 challenge, and the strongest, best‑supported case is:

Splunk US10693743B2 (cloud‑resource data collection → interactive topology map of nodes and relationships → tags/triggers on map elements) in view of Lacework US11973784B1 (natural‑language generation and NL interface inside a cloud‑deployment anomaly‑detection framework) in view of Raytheon US20200267175A1 (semantic instance graphs with an explicit external entity class, trust boundaries, attack vectors, and derived exposure/detectability attributes).

Each claim element is disclosed; the motivation is supplied by the identical technical field, the shared problem of analyst information overload (admitted in the '412 specification itself), and the finite set of predictable triage predicates available by 2020. Dependent claims 2–9/12–19 add only known alerting, anomaly‑detection, graphing/format, and vulnerability‑determination features disclosed by NEC '2461, Lookingglass '185, Boeing '417, Northrop '587, and Darktrace '944.

The weakest link — and the point on which the patent owner will focus — is the final "filtering the network insights based on an insight indicating exposure from an external network" step, where the art must be shown to use an exposure finding as a report/insight selection predicate rather than merely generating one.