US 12381939

I'll research this patent, including checking for any litigation in CAFC 2026 dockets.

Let me dig deeper into litigation and docket information specifically for this patent number.

Let me do a couple more targeted checks for any 2026 litigation or Federal Circuit activity specifically naming this patent.

Summary: US Patent No. 12,381,939

Note on scope: I searched for this specific number (literally, 12,381,939 — not similar numbers). Below is what I could confirm. I have flagged where I lack authoritative confirmation.

Bibliographic data

Continuity: The application is a continuation of US 17/819,442 (now US 11,722,554 B2), which is itself a continuation of US 17/109,883 (now US 11,431,786 B1, filed Dec. 2, 2020). This patent belongs to a family (Google Patents family ID 83007647) with several continuations, including US 11,985,185; US 12,273,412; US 12,192,270; and US 12,255,948.

Abstract (verbatim)

"A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing."

Plain-language overview of the independent claims

Claim 1 — Method for providing textual insights. Four-plus steps: (1) collect data about objects deployed across different layers of a cloud environment; (2) identify the deployed objects; (3) build a visual representation of the cloud environment showing the objects and their relationships; (4) use natural-language processing to generate textual insights about the objects and their relationships; and (5) tag the objects and their relationships with those generated insights. The tagging step is a notable addition relative to the parent/earlier family members.

Claim 11 — Non-transitory computer-readable medium. Mirrors claim 1's steps as stored instructions that, when executed, cause processing circuitry to collect object data across layers, identify objects, build the visual representation with relationships, generate NLP-based textual insights, and tag objects/relationships with those insights.

Claim 12 — System. A system with one or more processing circuitries configured to perform the same pipeline as claim 1 (collect → identify → construct visual representation with relationships → generate textual insights via NLP → tag objects and relationships).

Selected dependent claims: pure-text descriptions of objects/relationships (2, 13); multiple-step relationships (3, 14); anomaly detection of a relationship (4, 15); insights describing a network not detectable from analysis of individual objects (5, 16); plural/different cloud platforms (6, 17); determining relationships between objects (7, 18) using observational, static-analysis, or active-logging methods (8, 19); enumerated object types such as virtual network, firewall, NIC, proxy, gateway, container, VM, subnet, hub, VPN (9, 20); and applying a large language model to generate the insights (10, 21).

Litigation / CAFC 2026 docket check — IMPORTANT

I did not find any Federal Circuit 2026 docket, appeal, or district-court assertion naming US 12,381,939. Specifically:

• The well-known cloud-security patent dispute Orca Security Ltd. v. Wiz, Inc. (D. Del., C.A. No. 1:23-cv-00758, filed July 12, 2023) involved Orca patents 11,663,031; 11,663,032; 11,693,685; 11,726,809; 11,740,926; and 11,775,326, and Wiz's counter-asserted patents were 11,722,554; 11,929,896; 11,936,693; 12,001,549; and 12,003,529 — not 12,381,939. (See the Joint Claim Construction Chart and the joint IPR status notice filed in that case.)
• That case was stayed in January 2025 pending IPRs, and the PTAB invalidated three Orca patents in December 2025. According to a January 2026 report (BankInfoSecurity), Orca and Wiz agreed to dismiss all claims with prejudice and bear their own costs — ending the dispute. That would leave no live appeal to the Federal Circuit from that case.
• Because 12,381,939 issued August 5, 2025, it post-dates the patent assertions and counterclaims in the Orca case and could not have been (and was not) among the patents asserted there.
• I searched for "12381939" in connection with CAFC 2026 and with Wiz litigation and found no matching appeal or new complaint. The other litigation I saw involving Wiz (e.g., Raftt's February 2026 suit in the Tel Aviv District Court) is a trade-secret/unjust-enrichment action in Israel, not a US patent case, and does not name this patent.

Caveat on uncertainty: My searches were web-based and are not a substitute for a Docket Alarm / PACER / CourtListener query run against the exact patent number. I cannot affirmatively rule out a very recently filed or sealed 2026 action. If you need a definitive litigation clearance, the precise queries to run are: PACER/Reuters Docket Alarm for "12,381,939" across all district courts, and the CAFC CM/ECF docket search for that number. Based on available public records as of today (April 26, 2026), this patent does not appear to be the subject of any pending US litigation or Federal Circuit appeal.

Assignee note: Wiz, Inc. was reportedly acquired by Google in 2025 (per press reports referenced in search results); current-assignee of record per Google Patents still shows Wiz Inc. I did not independently verify any post-issuance assignment of this specific patent.

I'll search for litigation involving US patent 12381939 across patent litigation sources.

Those results refer to different patents. Let me search more specifically.

Let me search more specifically with the exact number and check litigation databases directly.

Summary of Findings on U.S. Patent 12,381,939

The patent itself (for identification)

• U.S. Patent No. 12,381,939 B2, "System and method for analyzing network objects in a cloud environment"
• Applicant/Assignee: Wiz Inc.
• Application No. 18/341,134, filed June 26, 2023
• Issued August 5, 2025 (published as US 2023/0344896 A1 on Oct. 26, 2023)
• Priority date: December 2, 2020
• It is a continuation of Ser. No. 17/819,442 (now U.S. 11,722,554), which is a continuation of Ser. No. 17/109,883 (now U.S. 11,431,786).

Litigation search result

I found no litigation that names or asserts U.S. Patent 12,381,939 specifically. I could not locate any district court complaint, PTAB proceeding, or docket entry in which the '939 patent itself is the asserted patent.

I want to be transparent about the limits of this: the searches I was able to run returned the Wiz/Orca family litigation (below) and unrelated patents, and I could not complete an exhaustive PACER / Unified Patents / Darts‑IP docket-by-docket check for the '939 number before hitting my search limit. The '939 patent also issued only on August 5, 2025, so it has been in force for a relatively short period. Accordingly, my statement is that no litigation is known to me, not a categorical guarantee that none exists.

Closely related litigation (same patent family) — for context

The Google Patents page for the '939 patent carries a "Family has litigation" flag (first worldwide family litigation, Darts‑IP family ID 83007647). That family-level litigation is Orca Security Ltd. v. Wiz, Inc., in which a sibling/parent patent in the same family as the '939 (U.S. 11,722,554) was asserted — but not the '939 patent itself.

Case details for the family litigation:

• Case: Orca Security Ltd. v. Wiz, Inc. (Wiz counterclaimed, joining the same action)
• Court / Jurisdiction: U.S. District Court for the District of Delaware
• Case No.: 1:23-cv-00758 (JLH) (also captioned C.A. No. 23-758-JLH)
• Filed: July 12, 2023
• Patents Orca asserted against Wiz: U.S. 11,663,031; 11,663,032; 11,693,685; 11,726,809; 11,740,926; 11,775,326
• Patents Wiz asserted against Orca (counterclaims, per the Joint Claim Construction Chart): U.S. 11,722,554; 11,929,896; 11,936,693; 12,001,549; 12,003,529
  • U.S. 11,722,554 ("the '554 patent") is the direct parent of the '939 patent and is in the same continuation family; the '939 patent itself was not named.
• Status/outcome: The court stayed the litigation on January 16, 2025, pending the PTAB inter partes reviews. On December 8, 2025, the PTAB found all challenged claims of certain asserted Orca patents unpatentable. The parties then stipulated to dismiss all claims and defenses with prejudice (each side bearing its own costs and fees) — reported by BankInfoSecurity ("Orca, Wiz End Dueling Lawsuits Over Cloud Security Patents").

Bottom line

• Direct answer: No litigation is known to me in which U.S. Patent 12,381,939 is the patent-in-suit.
• Family-level answer: The only known litigation involving this patent family is Orca Security Ltd. v. Wiz, Inc., No. 1:23-cv-00758 (D. Del., filed July 12, 2023), where the related U.S. 11,722,554 (parent of the '939) was asserted by Wiz — not the '939 itself. That case was stayed (Jan. 2025) and ultimately dismissed with prejudice after the Dec. 8, 2025 PTAB decisions.

Sources consulted

• Google Patents, US 12,381,939 B2 — https://patents.google.com/patent/US12381939/en (family, priority, and "family has litigation" info)
• Orca v. Wiz docket materials (CourtListener): https://www.courtlistener.com/docket/67600951/70/orca-security-ltd-v-wiz-inc/
• Wiz/Orca IPR materials (PTAB/Docket Alarm), e.g., IPR2024-00863, IPR2024-01109, IPR2024-00220
• Joint Claim Construction Chart, Orca Sec. Ltd. v. Wiz, Inc., C.A. No. 23-758 (JLH) (listing asserted patents)
• BankInfoSecurity, "Orca, Wiz End Dueling Lawsuits Over Cloud Security Patents" — https://www.bankinfosecurity.asia/orca-wiz-end-dueling-lawsuits-over-cloud-security-patents-a-30463

Caveat: Because I was unable to complete an exhaustive docket search before reaching my research limit, I recommend confirming via PACER (D. Del. and other districts), the Unified Patents litigation portal, and Darts‑IP family 83007647 before relying on the "no known litigation" conclusion. If you'd like, I can attempt more targeted docket lookups.

I'll verify the PTAB landscape for this patent before concluding. Let me run several targeted searches.

Let me confirm whether the '939 patent itself appears in any PTAB docket, and check for related Wiz-patent proceedings and appeals.

Proceedings overview

Total AIA trial proceedings on US 12,381,939: 0 (0 active / 0 claims invalidated / 0 claims sustained / 0 settled / 0 institution denied).

The USPTO Open Data Portal returns no AIA trial proceedings (IPR, PGR, or CBM) naming this patent, and my live searching surfaced none either — no petition, institution decision, FWD, or appeal captioned against U.S. Pat. No. 12,381,939. Bottom line for a defendant: the '939 patent is untested at the PTAB. Unlike a patent that has been through IPR and emerged narrowed, there is no claim-level validity record here to lean on and no § 315(e) estoppel to exploit. That is a weaker defensive posture than "hardened," because whatever validity fight you want to have, you would be the first to have it — but it also means the patent owner cannot point to any Board holding sustaining these claims. Note the family is flagged in the structured data as "Family has litigation" (Darts-IP family 83007647), so the absence of PTAB activity is a litigation-strategy fact, not a sign the patent is dormant.

⚠️ Everything below labeled "family-adjacent" concerns different patents, not the '939 patent. I flag it because those proceedings attack the same specification from which the '939 claims descend, and a defendant should know the terrain.

Proceedings on US 12,381,939

None. There is no proceeding to report for this patent number. I will not manufacture one.

Applying the statutory windows, to the extent they matter for timing:

• PGR — The '939 claims carry a 2020-12-02 priority date (post-AIA), so the claims are PGR-eligible. The PGR window runs 9 months from grant; the patent issued 2025-08-05, so a PGR window existed and (per the data) closed on approximately 2026-05-05 with no petition filed. I could not independently verify the absence of a PGR by direct E2E docket pull; treat the "no PGR" conclusion as resting on the ODP structured data plus the absence of any web hit.
• CBM — Not available. The CBM transitional program sunset 2020-09-16, and these claims are not covered-business-method claims in any event.
• IPR — Always available. Watch the § 315(b) one-year bar running from service of any complaint alleging infringement of the '939 patent; I could not confirm whether the '939 patent has been asserted, so I cannot date any bar for you.

Family-adjacent proceedings (sibling/parent patents — NOT the '939 patent)

These are the proceedings a defendant should actually read, because the '939 patent is a continuation of U.S. Pat. No. 11,722,554 (application Ser. No. 17/819,442, per the '939 cross-reference and the Google Patents family table). The '939 patent shares that parent's specification. So when a petitioner attacked the parent, it was attacking the '939 patent's disclosure.

IPR2025-01083 — Orca Security Ltd. v. Wiz, Inc. (U.S. Pat. No. 11,722,554)

• Type: Inter Partes Review
• Filed: 2025-06-04
• Status: Not Instituted – Merits (terminated 2025-12-15, per Unified Patents' PTAB portal)
• Petition grounds: Not verified by me at the paper level; the family-wide Orca petitions were accompanied by § 315(e)/Sotera stipulations (see below).
• Institution decision: Denied on the merits, 2025-12-15. I could not retrieve the Board's reasoning.
• Defensive value: High-signal for the '939 patent. A sophisticated petitioner with full access to the shared specification and the parallel Delaware litigation failed to get past institution against the parent patent. That does not bind the Board on the '939 claims (different claim scope), but it is the closest thing to a validity read on this disclosure.
• Link: https://www.docketalarm.com/cases/PTAB/IPR2025-01083/Orca_Security_Ltd._v._Wiz_Inc/

The June 4, 2025 Orca-vs-Wiz cluster

Orca filed five petitions that day against Wiz patents, together with Sotera stipulations (a § 315(e)-style narrowing of what Orca would raise in the co-pending Delaware case). Outcome per the Unified Patents portal:

• Settlement: The three "Settlement" terminations (2026-01-14) followed a Joint Motion to Terminate; the IPR2025-01087 docket shows a Settlement Agreement filed as Patent Owner Exhibit 2005 (agreements in PTAB settlements are typically filed but often redacted/confidential — I did not read it).
• Panel (IPR2025-01087, illustrative): APJs Karl D. Easthom, Nabeel U. Khan, and Lisa A. Murray.
• Link: https://www.docketalarm.com/cases/PTAB/IPR2025-01087/Orca_Security_Ltd._v._Wiz_Inc/

None of the five patents above is the '939 patent. I list them only because they show the petitioner (Orca) had the incentive, the counsel (Wilson Sonsini for Wiz; Latham & Watkins for Orca), and the family knowledge to hit the '939 patent — and did not.

Global context (not claim-level outcomes of the '939 patent)

• Wiz asserted Orca patents in a Delaware counterclaim and challenged them at the PTAB; the Board's 2025-12-08 FWDs invalidated all challenged claims of the Orca patents then at issue (unpatentable under § 102/§ 103). Further reviews were pending with decisions due early 2026.
• The Delaware litigation (Orca Sec. Ltd. v. Wiz, Inc., No. 1:23-cv-00758 (D. Del.)) was stayed 2025-01-16 and the parties ultimately dismissed all claims and counterclaims with prejudice, each bearing its own fees.
• Source: https://www.bankinfosecurity.asia/orca-wiz-end-dueling-lawsuits-over-cloud-security-patents-a-30463

Strategic summary

Claim status of the '939 patent. There is no PTAB record, so every claim (1–21) is UNTESTED, not "sustained." Do not let anyone characterize the absence of IPRs as an affirmance of validity — it is not. Claims 1 and 12 are the independent claims; 2–11 depend from claim 1 and 13–21 depend from claim 12. Claim 10 (LLM-based generation of textual insights) and claim 21 (same, in system form) are the features a defendant should scrutinize first, both because they map onto the post-2023 generative-AI narrative and because they are the limitations most likely to be read narrowly. A "sustained" vs. "canceled" ledger for this patent is blank.

Estoppel landscape. Because no IPR/PGR was instituted against the '939 patent, § 315(e)(2) estoppel does not attach to any petitioner with respect to these claims. A current or future defendant has the entire universe of § 102/§ 103 art available — nothing has been burned. Conversely, note the family-adjacent stipulations: if Orca's Sotera stipulations from the June 2025 cluster were construed family-wide (they were keyed to specific patents), they could constrain Orca — not you. And if Wiz's own earlier IPR work on Orca's patents produced a validity record, that runs in Wiz's favor on those patents; it says nothing about the '939 claims.

Pattern signals. (1) The same petitioner, Orca, filed five IPRs in one day against the Wiz family and did not name the '939 patent — despite the '939 patent being the continuation of the very parent it did attack. That is a notable omission. (2) The patent owner, Wiz Inc., is a well-capitalized operating company (not a troll) that litigates aggressively and uses IPR offensively; expect a vigorous defense if challenged. (3) No defensive aggregator (Unified Patents, RPX) appears in the chain — the Unified Patents portal data above is just a tracking source, not a filer. (4) The entire Wiz–Orca dispute appears to have resolved by global settlement/dismissal with prejudice in early 2026, which likely means the '939 patent will not be tested by Orca.

Recommended next steps

1. Confirm the null result directly. Pull the patent on PTAB E2E / PTAB Center (https://ptacts.uspto.gov/) and USPTO PatentCenter for U.S. Pat. No. 12,381,939, and confirm zero AIA trial numbers. The ODP structured data governs, but a direct docket check is cheap.
2. If you are a defendant being asserted and there is no IPR yet, the IPR door is wide open. No § 315(e)(2) estoppel exists against you, and no prior petitioner has framed the prior art for the Board. Priority is 2020-12-02, so the AIA § 102/§ 103 art window is broad and the post-2020 prior art (including the Wiz/Orca products themselves and the 2020-2021 Orca materials surfaced in the IPR exhibits, e.g. Orca's SideScanning technical brief) is fair game.
3. Do not rely on the family-adjacent denials as a merits win. IPR2025-01083 and IPR2025-01086 were denied institution on the merits — a discretionary/threshold loss for Orca, not a Board finding that the Wiz claims are valid. Institution denials have no estoppel or claim-preclusive effect. Read the underlying papers before citing them.
4. Check § 315(b) timing immediately. If you (or a privy) were served with a complaint alleging infringement of the '939 patent, your one-year IPR window is running; I could not confirm an assertion date from the available sources. Get the service date from your own docket.
5. Watch the parent for Federal Circuit activity. Given the volume of Wiz–Orca IPR work and the 2025-12-08 invalidation decisions, follow-on appeals are plausible. I found no CAFC appeal docketed on the '939 patent and could not confirm an appeal of IPR2025-01083; verify on the Federal Circuit docket / CourtListener before relying on finality.

Confidence note. The zero-proceeding finding is well-supported (canonical ODP data + negative web search). The family-adjacency facts (US 11,722,554 as parent; the Orca cluster outcomes and dates) come from Google Patents' family table and the Docket Alarm / Unified Patents aggregators, which I could not verify against the underlying Board papers — treat the institution-denial and settlement labels as aggregator data pending a direct E2E pull.

I'll research the assignment chain and ownership history for US 12,381,939.

Assignment / Ownership Analysis — US 12,381,939 B2

Source limitation, stated up front: I was unable to retrieve the actual USPTO Assignment Center record set for this patent with the research tools available to me. assignmentcenter.uspto.gov and assignment.uspto.gov are JavaScript-driven query applications that expose no indexable per-patent result pages, and web_search returned no mirrored copy of the assignment abstract of title for 12,381,939. I therefore have zero confirmed reel/frame entries and will not invent any. Everything below that is not a reel/frame citation is labeled as file-history or press-report based. This is a data-acquisition failure, not a negative finding — see "How to close the gap" after the timeline.

Cross-reference flag to the prior section: the earlier summary said Wiz "was reportedly acquired by Google in 2025." That is imprecise and should be corrected: the deal was announced March 2025 but closing was completed March 11, 2026 (SecurityWeek; TechRepublic update of March 11, 2026; EC decision of Feb 10, 2026, case M.11964). Also, the earlier section stamped itself "as of today (April 26, 2026)" whereas the operating date for this task is 2026-10-01 — the earlier litigation clearance was therefore ~5 months stale. Neither discrepancy changes the ownership conclusion, but both are noted.

Inventors

Five named inventors, all Israeli residents, all listed on the face of this patent:

Unusual-pattern check — mostly a negative finding, and a notable one:

• No inventor-departure pattern. Two of the five (Luttwak, Reznik) are Wiz co-founders who were still with the company at the March 11, 2026 Google close; Google committed ~$1.5B in cash/stock retention specifically to keep Wiz staff post-close. There is no evidence of founders/inventors exiting within 12 months of filing — the classic precursor to a portfolio fire-sale is not present.
• Roster note: the Wiz co-founder quartet normally cited is Rappaport / Luttwak / Costica / Reznik. Assaf Rappaport and Yinon Costica are not on this patent; the two co-inventor slots instead go to Shemesh, Berkovitz and Shai Keren. Normal for a large engineering organization — flagged only so a future analyst doesn't assume the founder four are always co-inventors on every Wiz patent.
• Origin caveat: a press report (Globes, via Wasla) notes the Israeli Tax Authority disputes Wiz's position that the IP was developed/registered in the US, asserting substantial development occurred in Tel Aviv. Inventor residency (all IL) is consistent with that dispute. This bears on who actually developed the claimed subject matter, but not on recorded chain of title.

Original assignee

Wiz, Inc. — Delaware corporation, headquarters New York, NY (per the European Commission's Art. 4(5) referral notice for case M.11964: "Wiz er fyrirtæki í Delaware með höfuðstöðvar í New York… stofnað árið 2020").

• Line of business: cloud-native application protection platform (CNAPP) / agentless multi-cloud security scanning — i.e., an operating company whose commercial product implements the kind of cloud-object discovery and relationship graphing claimed here. Wiz crossed $1B ARR by end-2025 and had ~1,800 employees.
• Did they ship a product embodying the claims? Yes. The patent's claimed pipeline (agentless object-data collection across cloud layers → object identification → relationship graph → NLP-generated textual insights → tagging) maps directly onto Wiz's shipping agentless cloud-security graph product. Claim 9's object enumeration (virtual network, firewall, NIC, proxy, gateway, container, VM, subnet, hub, VPN) is a description of Wiz's connector/scanner inventory.
• Current status: acquired. Google's $32B all-cash acquisition closed March 11, 2026 after US clearance (Nov 2025), unconditional EC clearance (Feb 10, 2026, M.11964), plus Australia/South Africa. Wiz retains its brand and multi-cloud commitments. Practically, the patent should now be held within the Alphabet/Google structure — but I found no evidence of a recorded USPTO assignment effecting that transfer (see below).

Assignment timeline

I could not obtain the Assignment Center record set for 12,381,939, so I cannot give you executed/recorded dates, reel/frames, conveyance types, assignors, assignees, or correspondents of record. Proceeding to list "the original assignment only" would be fabrication; stating "no records exist" would also be fabrication, because I did not actually see the query result page. The honest output is: records not retrieved — unverified.

What file-history and third-party evidence supports (clearly not assignment-record equivalents):

• 2020-12-02 — Original application US 17/109,883 filed (now US 11,431,786 B1). Applicant/assignee of record: Wiz, Inc. Inventors are Wiz personnel, so a contemporaneous inventor→Wiz, Inc. assignment is the expected record (executed at or near filing), but I cannot cite a reel/frame for it.
• 2022-08-12 — Continuation US 17/819,442 filed (now US 11,722,554 B2); same applicant, no re-assignment expected.
• 2023-06-26 — This application, US 18/341,134, filed as a further continuation; same applicant.
• Lead worth chasing (not a finding): a PTAB petition exhibit list (Petition 1557988, ptacts.uspto.gov) contains artifacts docketed "WZIO_P2438_spec_claims_drawings_20230712" and "WZIO_P2438_Declaration_assignment_20230713.pdf." This indicates a Wiz application docketed internally as WZIO_P2438 with a declaration/assignment executed on 2023-07-13 — the same window as this continuation. I cannot confirm it belongs to 18/341,134 (the 2023-07-12 spec date does not match this application's 2023-06-26 filing date), so treat it strictly as a search lead for locating the inventors' executed assignments.
• 2025-08-05 — Patent granted. Google Patents "Current Assignee: Wiz Inc."
• 2026-03-11 — Google/Wiz acquisition closes. Expected recorded conveyance: either an Assignment of entire interest, or (if structured as a stock purchase with Wiz surviving as a subsidiary) a Merger/"Change of Name"-type record — the EC notice states the concentration "á sér stað með kaupum á hlutabréfum" (occurs by purchase of shares), which is the configuration that most often yields no patent-level assignment record at all, because title stays in the acquired subsidiary.

How to close the gap (run these; the record is retrievable by hand in minutes):

1. Assignment Center, search by patent number 12381939 and separately by application number 18341134: https://assignmentcenter.uspto.gov/ (indexed UI at https://assignment.uspto.gov/patent/index.html).
2. Note that USPTO assignment PDFs are directly downloadable at a predictable legacy URL shape, e.g. https://legacy-assignments.uspto.gov/assignments/assignment-pat-059514-0676.pdf — so once you read a reel/frame off the abstract of title, the executed instrument (and its correspondent of record block) is one GET away.
3. Repeat for the sibling family members US 11,431,786; US 11,722,554; US 11,985,185; US 12,273,412; US 12,192,270; US 12,255,948; and pending US 19/047,259 — a Google-side recording is far more likely to have been made first against the highest-value family members, and the reel/frame will name the same correspondent for this patent.
4. Google Patents → 12,381,939 → "Legal Events / Assignee" tab, and PEDS/ODP for the "Assignment" tab.

Timeline diagram

timeline
    title Ownership of US 12381939
    2020 : Wiz Inc files original application
    2022 : Continuation filed by Wiz Inc
    2023 : This continuation filed by Wiz Inc
    2025 : Patent granted to Wiz Inc
    2026 : Google acquisition of Wiz closes

Only events that are independently documented are shown. No assignment records were verified, so no transfer nodes are drawn.

NPE / troll-pattern signals

Verdict

Operating-company assertion.

The documented chain begins, remains, and terminates with operating companies: Wiz, Inc. is the assignee of record on the face of the grant (Delaware CNAPP vendor, ~1,800 employees, $1B+ ARR, and a shipping agentless cloud-security graph product that implements the claimed pipeline), and the only known change of control is Alphabet/Google's $32B all-cash acquisition of Wiz, completed 2026-03-11 — i.e., consolidation into an even larger operating company, not a transfer to an assertion vehicle. Wiz demonstrably used the family offensively against a real competitor (counterclaims served in Orca Security Ltd. v. Wiz, Inc., D. Del., on 2024-06-04, asserting sibling patent 11,722,554 and four others), which is the definitional operating-company-assertion posture. Zero of the eight NPE signals is present on available evidence; signal 3 (repeat correspondent) is not assessable because no reel/frame was obtained, so I am not certifying it as absent — it is simply unmeasured.

Confidence qualifier: this verdict rests on the face-of-patent assignee, the file-history chain, and merger-review documents (EC case M.11964, which literally names the merging parties as Google LLC / Alphabet and Wiz Inc.) — not on a USPTO assignment abstract of title, which I could not retrieve. If the Assignment Center shows a post-2026-03-11 conveyance to an unfamiliar LLC rather than to Google, that would materially change this verdict.

Verify at: https://assignmentcenter.uspto.gov/ (search patent 12381939) and https://patents.google.com/patent/US12381939/en.

I'll research the prior art references cited for US 12,381,939 and related family members.

Prior Art Analysis — US Patent No. 12,381,939

Important preliminary caveat (read first). I attempted to retrieve the authoritative "References Cited" table (the examiner-cited U.S. patent documents, foreign documents, and NPL) directly from the USPTO/Google Patents full-text record for 12,381,939. That exact table did not come back in my search results. What I did retrieve are (a) the citation record of the immediate parent, and (b) the prior-art references actually litigated against sibling family members. I present both, and I flag exactly where I am inferring versus confirming. I will not fabricate an examiner citation list I could not verify.

A. What I could confirm about the citation record

The Google Patents page for 12,381,939 lists the family, the "Families Citing this family (95)" set (mostly Lacework/Fortinet forward citations — these are NOT prior art, they are later patents citing this family), but the fetch did not surface the backward "References Cited" table. Per the operating rules, I am treating the earlier-produced summary's note (tagging step + NLP/LLM claims) as authoritative context and building on it rather than repeating it.

B. Prosecution citations I could actually recover — the parent US 11,722,554 B2

The docketalarm copy of the parent US 11,722,554 B2 ("System and method for analyzing network objects in a cloud environment," Keren et al., Wiz, Inc., filed Aug. 12, 2022) reproduced its (56) References Cited section. Because 12,381,939 is a straight continuation of the '554 patent with substantially the same specification, these are the references most likely to appear (verbatim or carried forward) in the '939 record. The ones legible in the retrieved excerpt:

These are the citations I could actually see; the full list was truncated in the retrieved image and I could not verify the complete set for either the '554 or the '939 patent.

C. The most substantively relevant prior art in this exact field of endeavor

The strongest, most on-point prior art is not the prosecution citations at all — it is the art that Wiz and Orca actually litigated over the sibling patents in this same family and its technological neighborhood (the '031, '693, '735, '896, and '549 patents). For a continuation claiming a graph + NLP-insight pipeline, these are the references a challenger would reach for under § 102/§ 103:

D. My § 102 assessment (honest, hedged)

• No reference I located discloses or anticipates the full combination of claim 1 — specifically the final two elements: "generating textual insights using natural language processing" and "tagging the identified objects and respective relationships with the generated textual insights." The graph-construction art (Ross, Agarwal, Biran, Veselov) is strong on elements 1–3 (collect, identify, visual representation + relationships) but is largely silent on the NLP/LLM insight generation and insight-tagging steps that characterize the '939 independent claims.
• The closest prior art for elements 1–3 (and thus the best § 102 candidates for the dependent claims): Agarwal (US 9,800,470), Ross (US 11,863,580), and Biran (US 10,447,553) for the graph/multi-cloud elements; Veselov (US 11,216,563) for agentless cloud-object data collection.
• Element 5 (claim 10/21, "applying a large language model") is the most likely novelty hook, and the one least likely to be met by pre-2022 art in this field.
• A realistic challenge would therefore be § 103 (graph art + an admitted NLP text-generation reference), not clean § 102 anticipation of claim 1.

E. Limitations on this analysis (per strict rules)

1. I could not retrieve the verified, complete examiner-cited reference list for 12,381,939 from the USPTO database. My searches returned the parent's partial (56) list, the family/forward-citation lists, and IPR/litigation art — not the exact '939 citation table. Treat Section B as indicative of the parent and Section C as analogous-field art, not as the confirmed '939 citations.
2. Forward citations ≠ prior art. The "Families Citing this family (95)" entries (Lacework/Fortinet, all with priority 2017-11-27 and later) are later patents citing this family; they cannot be § 102 art against a patent claiming priority to Dec. 2, 2020.
3. Date logic: Because the effective priority date is Dec. 2, 2020, only references with a prior-art date before that (or qualifying under § 102(a)(2) via an earlier-filed published application) can anticipate. Ross (filed 12/23/2020) qualifies only as § 102(a)(2) art, not § 102(a)(1) — a point Wiz's own IPR briefing made against Orca's '896 patent.
4. To make this definitive, the precise records to pull are the USPTO PatentCenter / Global Dossier "References Cited" (form PTO-892) for application 18/341,134, and the full text of the parent '554 (56) list. I am flagging that I did not obtain those verbatim within this session rather than reconstructing them.

I'll analyze obviousness for US 12,381,939 by researching the actual prior art landscape — including references cited on the patent's face, family members, and third-party cloud-security/NLP art.

Excellent — the searches surfaced the key IPR petitions (which use "Keren," "Shivamoggi," and "Morgan" as art) and the Lacework NLP/insight patents. Let me pin down the exact reference numbers and check whether the '939 itself has been challenged.

Obviousness Analysis — U.S. Patent No. 12,381,939 B2

Analysis under 35 U.S.C. § 103, with the Graham/KSR framework

1. Threshold issues that drive the analysis

1.1 Effective filing date / priority

The '939 is a straight continuation chain: US 17/109,883 (filed Dec. 2, 2020, now US 11,431,786) → US 17/819,442 (now US 11,722,554) → US 18/341,134 (the '939). Assuming § 112 support in the Dec. 2, 2020 disclosure, the effective filing date for all claims is Dec. 2, 2020, and any reference effective before that date is § 102(a)(2)/§ 102(b)(1) art.

Two limitations warrant a written-description flag before relying on the 2020 date:

• Claim 1's "tagging the identified objects and respective relationships with the generated textual insights" — the '939 specification does describe this at ¶ [S250] ("association of one or more data labels, tags, or other, like, features, with graph entries for one or more network objects… Examples of relevant descriptions include… insights, such as those generated at S240"). Support likely exists.
• Claims 10 and 21's "applying a large language model to generate the textual insights" — the '939 specification never once mentions a "large language model," "LLM," or any specific model. The description says only "natural language processing." If claims 10/21 lack written-description support in the Dec. 2, 2020 (and Aug. 12, 2022) disclosures, their effective date shifts to the June 26, 2023 filing. That matters enormously: it would open the door to the entire 2021–2023 LLM/NLP-for-security art (see Ground D below). Conversely, if Wiz can show the LLM limitation was described in 2020, the limitation is met by ordinarly routine application of known text-generation models to graph data.

1.2 Person of ordinary skill in the art (POSITA)

A POSITA here would be a software/security engineer with ~2–4 years of experience in cloud security, network monitoring, and graph-based data analysis, familiar with: (i) cloud control-plane APIs (AWS/Azure), (ii) graph data structures and network-topology visualization, and (iii) natural-language generation/query interfaces over structured data.

1.3 Cautionary note on Wiz's own family

Wiz's earlier family members (the '786 and '554), which disclose substantially the same collect→identify→graph→tag pipeline, are not available as prior art against the '939: they share the same inventors, the same Dec. 2, 2020 priority, and common ownership, so they are disqualified under § 102(b)(2)(C). (This is precisely the art third parties are using against other companies' patents — e.g., the "Keren" reference mapped step-by-step in the PTAB petitions in Wiz v. Orca and the Shivamoggi ground in Orca v. Wiz, IPR2025-01083.) The '939's obviousness must therefore rest on third-party art.

2. Claim 1 — element-by-element, with third-party art

Claim 1 requires: (a) collecting object data on objects at different layers; (b) identifying objects; (c) constructing a visual representation with relationships; (d) generating textual insights using NLP; and (e) tagging objects/relationships with the insights.

Result: every element of claim 1 is disclosed across the art, and the only real question is whether combining graph-construction/visualization art (Shivamoggi, HPE, Splunk) with NLP/NLG art ('643, Lacework) and graph-tagging art ('316) was obvious.

3. Proposed grounds of rejection (§ 103 combinations)

Ground A — Shivamoggi in view of the NLG/NLP art ('643, Lacework '784/'398).
Shivamoggi teaches (a)–(c) and anomaly detection; it also outputs textual notifications ("the alert may be pushed to the user as a text, an email"). The '643/Lacework references teach generating natural-language descriptions of network nodes and paths. Combining them yields claim 1: the graph of Shivamoggi + NL description of graph elements + annotation of the graph with those descriptions.

Ground B — Shivamoggi in view of the relationship-graph/tagging art (US 11,734,316; Splunk '63910; ExtraHop '13650).
This combination supplies the "tagging … with generated insights" limitation expressly (graph elements enriched/annotated with metadata).

Ground C — US 2022/0150281 A1 in view of Shivamoggi and the NLP art.
The '281 reference supplies the multi-cloud, multi-layer collection and a rendered network topology map (tree→directed graph→rendering engine); Shivamoggi supplies relationship/anomaly analysis; the NLP art supplies the textual insights.

Ground D — (only if claims 10/21 are not entitled to the 2020 date) any of Grounds A–C in further view of 2022–2023 LLM/NL art, e.g., Lacework's guided interactions with a natural language interface family (US 12,355,793) and the general application of transformer LLMs (GPT-3, Nov. 2020) to graph-to-text summarization. Applying a known LLM to a known NLG task is, at minimum, an obvious design choice under KSR.

Single-reference note (§ 102 alternative, not the focus): Shivamoggi alone comes close to anticipating a narrower claim set (collection → connection graph → anomaly → attack path → text notification → GUI), but it does not clearly disclose "different layers" or NLP-generated insights, so a § 103 rejection is the more robust theory.

4. Motivation to combine (KSR factors)

1. Same field / common problem. All references address automated analysis of large, multi-layer cloud/network environments to reduce manual review — the exact problem the '939's Background recites. KSR permits combination of references "designed to address the same problem."
2. Known design incentive to convert graph output to text. Security analysts must interpret dense node/edge graphs; converting structured relationship data into human-readable text is a known, desirable goal (Lacework's NL-interface patents were expressly aimed at this). The '643 publication shows this was done for network paths specifically.
3. Predictable result, no unexpected property. Graph construction, NLP summarization, and metadata tagging are each well-understood; their combination yields the expected result (a tagged, annotated graph with readable descriptions), with no teaching away and no criticality of any specific order.
4. Tagging as a routine data-management step. Associating labels/insights with graph entries is standard property-graph practice and is taught by US 11,734,316 and Splunk's security graph.
5. No secondary considerations of record. The patent issued Aug. 5, 2025; no evidence of nexus, unexpected results, long-felt need, or industry praise is known.

5. Dependent claims

• Claims 2/13 (pure-text descriptions) and 3/14 (multiple-step relationships): met by the '643 natural-language path outputs and Shivamoggi's multi-hop attack paths.
• Claims 4/15 (anomaly detection of a relationship): squarely met by Shivamoggi (connection-behavior anomalies at the edge level) and Lacework's graph-based anomaly patents (US 10,419,469; US 10,581,891/US 11,153,339).
• Claims 5/16 (insight not detectable from individual-object analysis): met by graph-level/holistic anomaly detection (Shivamoggi's graph metrics; Lacework's privilege-change and login graphs).
• Claims 6/17 (plural, different cloud platforms): met by Shivamoggi (multiple client networks, AWS/Azure) and US 2022/0150281 A1 (cloud platforms 108A–N).
• Claims 7/18 & 8/19 (determining relationships via observational, static-analysis, or active-logging): met by Shivamoggi's passive/observational network-data collection, static-analysis teachings in the cloud-security art, and log-based methods.
• Claims 9/20 (enumerated object types — VPC, firewall, NIC, proxy, gateway, container, VM, subnet, hub, VPN): every type is a routine cloud-networking primitive disclosed across the art.
• Claims 10/21 (large language model): obvious in view of known LLMs applied to graph-to-text NLP (subject to the priority caveat in § 1.1). If not entitled to the 2020 date, this limitation is essentially admitted-obvious by the 2023 art.

6. Weaknesses in the obviousness case (counterarguments a patentee would raise)

1. The PTAB has already read Shivamoggi narrowly. In IPR2025-01083 (Orca Security Ltd. v. Wiz, Inc.), the Board denied institution of the Shivamoggi-based ground against the parent '554, reasoning that "the closest Figure 7A comes to disclosing a 'list of abnormal connections'" was the Connection Graph 710 and that this was insufficient. A petitioner relying on Shivamoggi must therefore articulate the graph/textual-insight linkage more precisely than was done against the '554. (Note: the '939's claims are not the '554 claims — the '939 adds the NLP and tagging limitations, which actually makes an NLP-reference combination necessary, not optional.)
2. "Tagging … with the generated textual insights" is the newest and most distinguishing limitation. A strong petition should anchor it on a reference that expressly annotates graph elements with auto-generated textual content — the '643/Lacework NLG references plus US 11,734,316's metadata-enrichment teaching — rather than treating tagging as a bare, unsupported assertion.
3. "Different layers of the cloud environment" could be argued to mean OSI/cloud stack layers specifically; the art should be cited for layered cloud constructs (VPC/network vs. compute vs. identity vs. application/L7 objects) rather than only generic heterogeneous nodes.
4. Written-description vulnerability cuts both ways. The absence of "large language model" support is a § 112 risk for Wiz, but it also means claims 10/21 (if shifted to a 2023 date) are squarely met by the 2022–2023 LLM inflation of the art.

7. Bottom line

• Claims 1, 11, 12 are prima facie obvious over Shivamoggi (US 11,770,387 B1) in view of natural-language network-graph output art (US 2021/0365643 A1; Lacework US 11,973,784 / US 11,770,398) and graph-tagging/enrichment art (US 11,734,316; Splunk US 2017/0063910 A1), with US 2022/0150281 A1 supplying the multi-cloud, multi-layer collection and rendered topology map.
• Dependent claims 2–9 and 13–20 add only routine, well-documented features.
• Claims 10 and 21 (LLM) are obvious as an application of known text-generation technology — and would be even more clearly so if their effective date is the 2023 filing rather than Dec. 2, 2020.
• Strongest proof posture: a § 103 combination (not § 102), because the "different layers" and "NLP/textual insights" limitations are best established by joining a graph-construction reference to an NLP/NLG reference, with an explicit KSR motivation (same field, known need to render complex graphs as readable text, predictable result).
• Contradiction flag relative to the earlier sections: the Litigation/Summary sections correctly found no proceeding naming the '939 itself. That remains true. What they did not capture — and what I surfaced here — is that the parent '554 is under IPR (IPR2025-01083, Orca v. Wiz, denial of institution) and that Wiz is petitioning against Orca patents using Wiz's own "Keren" family disclosures. These do not name the '939, so there is no inconsistency, but they are the most probative public record of how these exact limitations are being mapped against the art.

Caveat: Reference dates for US 2022/0150281 A1 and the Lacework NL-interface CIPs should be verified against their effective filing dates before being relied on as § 102(a)(2) art at a Dec. 2, 2020 critical date; the CIP/publication history of the Lacework family in particular needs a priority-support check.