Prosecution Insights
Last updated: April 19, 2026
Application No. 18/944,959

APPLICATION ENDPOINT CYBERSECURITY TECHNIQUES

Non-Final OA §101§103§DP
Filed
Nov 12, 2024
Examiner
TOLENTINO, RODERICK
Art Unit
2439
Tech Center
2400 — Computer Networks
Assignee
Wiz Inc.
OA Round
1 (Non-Final)
77%
Grant Probability
Favorable
1-2
OA Rounds
3y 4m
To Grant
99%
With Interview

Examiner Intelligence

Grants 77% — above average
77%
Career Allow Rate
545 granted / 705 resolved
+19.3% vs TC avg
Strong +35% interview lift
Without
With
+35.4%
Interview Lift
resolved cases with interview
Typical timeline
3y 4m
Avg Prosecution
25 currently pending
Career history
730
Total Applications
across all art units

Statute-Specific Performance

§101
15.7%
-24.3% vs TC avg
§103
56.2%
+16.2% vs TC avg
§102
11.9%
-28.1% vs TC avg
§112
8.3%
-31.7% vs TC avg
Black line = Tech Center average estimate • Based on career data from 705 resolved cases

Office Action

§101 §103 §DP
Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Detailed Action Office Action is in response to the instant Application 18/944,959 filed on 11/12/2024. Claims 1-21 are pending. This Office Action is Non-Final. Information Disclosure Statement The information disclosure statement (IDS), submitted on 11/12/2024 and 5/19/2025, is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner. Double Patenting The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969). A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b). The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13. The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer. Claims 1, 11 and 12 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1, 10 and 11 of U.S. Patent No. 12,170,682. Although the claims at issue are not identical, they are not patentably distinct from each other because all the limitations of claims 1, 11 and 12 of the instant Application, with regards to an application endpoint cybersecurity system and limitations therein are being met and are anticipated by the limitations recited in 1, 10 and 11 of U.S. Patent No. 12,170,682. Regarding claims 2-10 and 13-21; claims 2-10 and 13-21 are also rejected under Double Patenting for similar reasons respectively and are dependent on claims 1 and 12 and therefore inherit the rejection from issues of the independent claims. Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1-3 are rejected under 35 USC 101 as being directed to an abstract idea without being integrated into a practical application or being significantly more. Regarding claim 1, 11 and 12, the claim recites the limitations “detecting an application …;” “generating in a security database …;” “detecting at least one existing network path…;” and “determining…;” Broadly interpreted, the aforementioned steps are directed to mental processes as said steps could be performed in the human mind. Therefore, the claims recite an abstract idea. Said abstract idea and/or judicial exception is not integrated into a practical application as the claim does not recite any other active steps that could be considered that the abstract idea is being integrated into a practical application. It’s noted that the claim recites the “initiating active inspection… .” However, said operations are not sufficient to consider that the abstract idea is being interpreted into a practical application. Said operations are recited at a high level of generality in gathering/processing/storing information, which are a form of insignificant extra-solution activity. It’s also noted that the claims recite additional limitation/elements (i.e., system, processing circuitry, processor, memory, etc.,). However, said additional elements are recited at a high-level of generality (i.e., as a generic computing device performing a generic computer functions) such that it amounts no more than mere instructions to apply the exception or abstract idea using generic computer components. Accordingly, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea. The claims do not include additional elements/limitations/embodiments that are sufficient to amount to significantly more than the judicial exception because the additional elements when considered both individually and as an ordered combination do not amount to significantly more than the abstract idea. As mentioned above, although the claims recite additional elements, said elements taken individually or as a combination, do not result in the claim amounting to significantly more than the abstract idea because as the additional elements perform generic computer content distributing functions routinely used in information technology field. As discussed above, the additional elements recited at a high-level of generality such that they amount no more than mere instructions to apply the exception using a generic computer component. Therefore, the claim is directed to non-statutory subject matter. Regarding claims 3, 4, 6-10, 14, 15 and 16-21; claims 3, 4, 6-10, 14, 15 and 16-21 are also rejected under 35 U.S.C. 101 as being directed to non-statutory subject matter for the same reasons addressed above as the claims recite an abstract idea and the claims do not positively recite any other operations that could be considered as the abstract idea is being integrated into a practical application or significantly more. It’s noted that in the above claims recites the limitations: “applying …; ” “generating…;” “initiating…;” “selecting…;” “inspecting…;” and “determing ….” Said steps are either directed to mental processes and/or in a form of insignificant extra-solution activities; The aforementioned steps are not sufficient to consider that the abstract idea is being integrated into a practical application or significantly more. Therefore, claims 3, 4, 6-10, 14, 15 and 16-21 are also rejected under 35 U.S.C. 101 as being directed to non-statutory subject matter. Claim Rejections - 35 USC § 103 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention. Claim(s) 1-3, 5-7, 11-14 and 16-18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Seri et al. (US 2025/0063061) in view of Mahadevan et al. (US 2021/0111958). As per claim 1, Seri teaches a method for application endpoint validation and securement, comprising: detecting an application endpoint on a resource already deployed in a computing environment (Seri, Paragraph 0042 recites “In this regard, it is noted that some software components are used as resources which are not represented in a static file of a computer program. For example, some software components are resources in dynamic libraries which are linked within a program file and loaded into memory at runtime when the program file is executed. Static analysis of such a program file may therefore fail to identify some of the software components that may be used by the program which could affect security of a computing environment. Identifying software components in-memory allows for identifying more software components, thereby providing a more accurate evaluation of potential risks, which in turn may be utilized to more accurately prioritize or otherwise determine mitigation actions for securing the computing environment.” And Paragraph 0060 recites “At S310, software components, versions of software components, or both, are discovered in-memory. In an embodiment, S310 includes performing an analysis of data in-memory. More specifically, in some embodiments, the analysis may be performed at least with respect to libraries loaded into memory. That is, software components may be discovered by identifying libraries loaded into memory, where the software components may utilize certain libraries or combinations of libraries at runtime such that each software component corresponds to a respective library or combination of libraries. An example process for discovering software components via in-memory analysis is discussed further below with respect to FIG. 4.”); detecting at least one existing network path between the resource and an external network, the network path including the application endpoint and a reachability parameter (Seri, Paragraph 0097 recites “At S530, potential paths of exploitation are analyzed for each vulnerable state. In an embodiment, S530 includes analyzing a code path from a vulnerable process to another process or function serving as an asset to be protected. The analysis may be based on data retrieved from other sources, e.g., other components deployed in or with respect to the computing infrastructure indicating communications between and among components of the computing infrastructure and, more specifically, between processes executed via the computing infrastructure. In a further embodiment, S530 may include creating a mapping of such potential paths of exploitation to be used for impact analysis, for example as described further below.”); initiating active inspection of the application endpoint over the network path; and determining through active inspection that the application endpoint is exposed to the external network (Seri, Paragraphs 0101-0102 recites “At S550, a reachability is determined for each vulnerable state with respect to one or more networks or subnetworks through which protected assets (e.g., processes or other components deployed in the infrastructure) are accessible. In an embodiment, S550 may include determining whether a process or other component affected by the vulnerable state is capable of reaching the Internet or a network or subnetwork where one or more predetermined assets (e.g., processes or components deployed in the computing infrastructure) to be protected from vulnerabilities reside. Such determination may be based on the output of detection tools (e.g., the detection tools 150, FIGS. 1A-B), which may be configured to provide indications of whether certain vulnerable states have reachability to particular networks or components. To this end, in some embodiments, S550 includes creating a mapping including paths from different protected assets which go through other components that lead to the Internet or one or more other external networks. Such mapping may be utilized, for example, for impact analysis as described further below. In an embodiment, S550 may include identifying one or more paths from each protected asset to the Internet or a public-facing network or subnetwork. Moreover, the path may be defined with respect to security control integrations which are configured to detect vulnerabilities, mitigate vulnerabilities, or both. In a further embodiment, S550 includes applying one or more predetermined reachability analysis rules defined with respect to predetermined security control integrations, where each security control integration is a process or other component configured to detect vulnerabilities, to mitigate vulnerabilities, or both. Using paths defined with respect to security control integrations allows for providing visibility into the security controls which are in place within a given computing infrastructure. In combination with awareness regarding the posture of the computing infrastructure, mitigation rules can be defined more granularly in order to optimize mitigation while minimizing potential negative effects of changes performed pursuant to mitigation.”). But fails to teach generating in a security database: a representation of the application endpoint, and a representation of the resource, wherein the security database includes a representation of the computing environment. However, in an analogous art Mahadevan teaches generating in a security database: a representation of the application endpoint, and a representation of the resource, wherein the security database includes a representation of the computing environment (Mahadevan, Paragraph 0038 recites “At 502 of the method 500 (FIG. 5), instruction 636 of the performance management system 130 of FIG. 6, may (e.g., when executed by the processing resource 632) provide a topology map that represents one or more paths for interconnecting the two or more endpoint resources from the plurality of resources to construct a logical system. In other words, the topology map represents various ways to interconnect the two or more endpoint resources to one another. In an example, the topology map is created in the fabric topology by providing one or more paths to interconnect the two or more endpoint resources. For example, FIG. 7 shows an example of a topology map 700 representing Path 1, Path 2 and Path 3 for interconnecting endpoint resources M1 and N4 that may be determined from the fabric topology of the memory semantic environment in FIG. 4. In some examples, a topology map may be created for interconnecting several combination of resources. In some examples, a topology map may be created for interconnecting a requester to each responder along various paths in a fabric topology.”). It would have been obvious to a person of ordinary skill in the art, before the earliest effective filing date, to use Mahadevan’s Identifying a path for interconnecting endpoint resources to construct logical systems with Seri’s System and method for mitigating cyber threats using risk analysis because it offers the advantage of creating a system that enforces security policies for arranging and interconnecting the resources. As per claim 2, Seri in combination with Mahadevan teaches the method of claim 1, Seri further teaches initiating a mitigation action in the computing environment in response to determining that the application endpoint is exposed to the external network (Seri, Paragraph 0057 recites “Mitigations 230 may be followed by patching operations 240. Such patching may provide more permanent fixes to the vulnerable states mitigated via mitigations 230. In this regard, the mitigations 230 may be utilized in order to mitigate vulnerable states more rapidly than such patching operations 240 can be performed, which in turn allows for securing the relevant assets more effectively than solutions which utilize patching as the main mitigation tool.”). As per claim 3, Seri in combination with Mahadevan teaches the method of claim 1, Seri further teaches applying a policy to the representation of the computing environment, wherein the policy includes a rule applied to a representation of the application endpoint (Seri, Paragraph 0057 recites “Mitigations 230 may be followed by patching operations 240. Such patching may provide more permanent fixes to the vulnerable states mitigated via mitigations 230. In this regard, the mitigations 230 may be utilized in order to mitigate vulnerable states more rapidly than such patching operations 240 can be performed, which in turn allows for securing the relevant assets more effectively than solutions which utilize patching as the main mitigation tool.”). As per claim 5, Seri in combination with Mahadevan teaches the method of claim 3, Seri further teaches initiating the mitigation action further in response to determining that the representation of the application endpoint violates the rule (Seri, Paragraph 0057 recites “Mitigations 230 may be followed by patching operations 240. Such patching may provide more permanent fixes to the vulnerable states mitigated via mitigations 230. In this regard, the mitigations 230 may be utilized in order to mitigate vulnerable states more rapidly than such patching operations 240 can be performed, which in turn allows for securing the relevant assets more effectively than solutions which utilize patching as the main mitigation tool.”). As per claim 6, Seri in combination with Mahadevan teaches the method of claim 3, Seri further teaches applying the policy to a portion of the representation of the computing environment (Seri, Paragraph 0057 recites “Mitigations 230 may be followed by patching operations 240. Such patching may provide more permanent fixes to the vulnerable states mitigated via mitigations 230. In this regard, the mitigations 230 may be utilized in order to mitigate vulnerable states more rapidly than such patching operations 240 can be performed, which in turn allows for securing the relevant assets more effectively than solutions which utilize patching as the main mitigation tool.”). As per claim 7, Seri in combination with Mahadevan teaches the method of claim 6, Mahadevan further teaches applying the policy to the portion of the representation, wherein each representation in the portion of the representation includes a tag having a predetermined value (Mahadevan, Paragraph 0049 recites “In an example, the method 500 may further include updating the cost matrix based on a run-time parameter. In an example, the processing resource of the performance management system 130 is to update the cost matrix based on a run-time parameter. As used herein, the term “run-time parameter” refers to a parameter or a feature that changes while a program or an operation is running. In an example, a run-time parameter may be a run-time change in the configuration of the fabric topology or topology map. A run-time change in the configuration of the fabric topology or topology map may occur due to a change in resources of the fabric topology, a change in load characteristics in the fabric topology, or based on Quality of Service (QoS) goals and admin policies. In an example, a change in resources of the fabric topology may be a result of the selection of at least one endpoint resource that is different from the two or more endpoint resources identified previously, a change in the fabric topology due to the addition of a new path or both. A change in load characteristics may be a result of a change in bandwidth utilization or latency along a path in the fabric topology. QoS goals and admin policies may involve a desired bandwidth for interconnecting two or more endpoint resources. A change in topology map may occur to maintain desired bandwidth for interconnecting two or more endpoint resources according to QoS goals and admin policies.” Changes in policies for a topology based on load, would effect sections whose paths were effected and not necessarily the whole network.). It would have been obvious to a person of ordinary skill in the art, before the earliest effective filing date, to use Mahadevan’s Identifying a path for interconnecting endpoint resources to construct logical systems with Seri’s System and method for mitigating cyber threats using risk analysis because it offers the advantage of creating a system that enforces security policies for arranging and interconnecting the resources. Regarding claims 11 and 12, claims 11 and 12 are directed to a non-transitory readable medium and a system associated with the method of claim 1. Claims 11 and 12 are of similar scope to claim 1, and are therefore rejected under similar rationale. Regarding claim 13, claim 13 is directed to a similar system associated with the method of claim 2 respectively. Claim 13 is similar in scope to claim 2, respectively, and are therefore rejected under similar rationale. Regarding claim 14, claim 14 is directed to a similar system associated with the method of claim 3 respectively. Claim 14 is similar in scope to claim 3, respectively, and are therefore rejected under similar rationale. Regarding claim 16, claim 16 is directed to a similar system associated with the method of claim 5 respectively. Claim 16 is similar in scope to claim 5, respectively, and are therefore rejected under similar rationale. Regarding claim 17, claim 17 is directed to a similar system associated with the method of claim 6 respectively. Claim 17 is similar in scope to claim 6, respectively, and are therefore rejected under similar rationale. Regarding claim 18, claim 18 is directed to a similar system associated with the method of claim 7 respectively. Claim 18 is similar in scope to claim 7, respectively, and are therefore rejected under similar rationale. Claim(s) 4 and 15 is/are rejected under 35 U.S.C. 103 as being unpatentable over Seri et al. (US 2025/0063061) in view of Mahadevan et al. (US 2021/0111958) and in further view of Jump et al. (US 2021/0194782). As per claim 4, Seri in combination with Mahadevan teaches the method of claim 4, but fails to teach generating a value in the representation of the application endpoint based on a result of applying the rule to the representation of the application endpoint. However, in an analogous art Jump teaches generating a value in the representation of the application endpoint based on a result of applying the rule to the representation of the application endpoint (Jump, Paragraph 0014 recites “In some embodiments, the outlier endpoints may include those endpoints having connectivity performance quality below a particular threshold as determined by the connectivity tests. Additionally, or alternatively, aspects of the present disclosure may calculate or identify connectivity scores or a measure of connectivity performance quality of each endpoint in a subnet, and may visually present the endpoint connectivity performance quality (e.g., in a network map, a table, chart, or the like displayed on a monitor or screen). As described herein, the information identifying endpoint outliers may be used to change and/or improve the technical operation of a network. For example, the information identifying endpoint outliers may be used to modify network topology, modify network processes, modify network policies (e.g., security policies, Quality of Service (QoS) policies, etc.), modify communications paths, update network hardware, move network equipment, or perform some other network planning-related task to mitigate, repair, circumvent, or otherwise mitigate the adverse effects of the outlier endpoints. Further, aspects of the present disclosure may not only measure, identify, or determine performance quality among peers in a subnet, but may also measure, identify, or determine the connectivity performance between endpoints in a subnet and endpoints outside of the subnet. In this way, connectivity between the subnet and other external networks may be evaluated, and lower performing endpoints may be mitigated by changing or modifying the network to reduce or avoid usage of the lower performing, outlier endpoints.”). It would have been obvious to a person of ordinary skill in the art, before the earliest effective filing date, to use Jump’s identifying network communication performance outlier endpoints in a computer network with Seri’s System and method for mitigating cyber threats using risk analysis because it offers the advantage of having a proper assessment of a network path. Regarding claim 15, claim 15 is directed to a similar system associated with the method of claim 4 respectively. Claim 15 is similar in scope to claim 4, respectively, and are therefore rejected under similar rationale. Claim(s) 8 and 19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Seri et al. (US 2025/0063061) in view of Mahadevan et al. (US 2021/0111958) and in further view of Kuwabara (US 2021/0111944). As per claim 8, Seri in combination with Mahadevan teaches the method of claim 3, but fails to teach selecting the policy from a plurality of policies, each policy corresponding to a different level of severity. However, in an analogous art Kuwabara teaches selecting the policy from a plurality of policies, each policy corresponding to a different level of severity (Kuwabara, Paragraph 0079 recites “In S6, the calculator 12 calculates the sum of a plurality of severity values obtained by repeatedly performing the processes of S2-S5. The sum of severity values corresponds to an SRLG violation cost on the paths between the source node and the destination node. In S7, the evaluator 13 decides whether the protection path has been appropriately set for the primary path according to the sum of severity values. In this case, for example, the evaluator 13 may evaluate the designated path by comparing the sum of severity values with a specified upper limit. Alternatively, when a plurality of protection path candidates are designated, the evaluator 13 may select a preferable one of the plurality of protection path candidates according to a specified evaluation policy.”). It would have been obvious to a person of ordinary skill in the art, before the earliest effective filing date, to use Kuwabara’s Device and method for controlling network with Seri’s System and method for mitigating cyber threats using risk analysis because it offers the advantage of having the flexibility to select a proper policy given the network need. Regarding claim 19, claim 19 is directed to a similar system associated with the method of claim 8 respectively. Claim 19 is similar in scope to claim 8, respectively, and are therefore rejected under similar rationale. Claim(s) 9, 10, 20 and 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Seri et al. (US 2025/0063061) and Mahadevan et al. (US 2021/0111958) and in further view of Chambers et al. (US 2018/0227324). As per claim 9, Seri in combination with Mahadevan teaches the method of claim 3, but fails to teach inspecting the resource for a cybersecurity object, in response to determining that the representation of the application endpoint violates the rule. However, in an analogous art Chambers teaches inspecting the resource for a cybersecurity object, in response to determining that the representation of the application endpoint violates the rule (Chambers, Paragraph 0066 recites “The analysis module 210 may also verify a potentially malicious resource is, in fact, malicious. The analysis module 210 may include comparing information regarding the malicious resource to blocklists, which may be private or publically available blocklists. These blocklists may comprise IP addresses, domain names, MAC addresses, or other computing system indicators that may be used to identify an online resource. In various embodiments, the analysis module 210 may also conduct a deep-content inspection of the potentially malicious resource by loading the potentially malicious resource in a sandbox (e.g., testing) environment on the intermediary node 105.”). It would have been obvious to a person of ordinary skill in the art, before the earliest effective filing date, to use Chambers’ methods and systems for generating dashboards for displaying threat insight information and providing security architecture with Seri’s System and method for mitigating cyber threats using risk analysis because it offers the advantage of performing thorough analysis of potentially malicious network objects. As per claim 10, Seri in combination with Mahadevan and Chambers teaches the method of claim 9, Chambers further teaches determining that the resource includes a cybersecurity risk, based on detecting the cybersecurity object (Chambers, Paragraph 0066 recites “The analysis module 210 may also verify a potentially malicious resource is, in fact, malicious. The analysis module 210 may include comparing information regarding the malicious resource to blocklists, which may be private or publically available blocklists. These blocklists may comprise IP addresses, domain names, MAC addresses, or other computing system indicators that may be used to identify an online resource. In various embodiments, the analysis module 210 may also conduct a deep-content inspection of the potentially malicious resource by loading the potentially malicious resource in a sandbox (e.g., testing) environment on the intermediary node 105.”). It would have been obvious to a person of ordinary skill in the art, before the earliest effective filing date, to use Chambers’ methods and systems for generating dashboards for displaying threat insight information and providing security architecture with Seri’s System and method for mitigating cyber threats using risk analysis because it offers the advantage of performing thorough analysis of potentially malicious network objects. Regarding claim 20, claim 20 is directed to a similar system associated with the method of claim 9 respectively. Claim 20 is similar in scope to claim 9, respectively, and are therefore rejected under similar rationale. Regarding claim 21, claim 21 is directed to a similar system associated with the method of claim 10 respectively. Claim 21 is similar in scope to claim 10, respectively, and are therefore rejected under similar rationale. Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to RODERICK TOLENTINO whose telephone number is (571)272-2661. The examiner can normally be reached Mon- Fri 8am-4pm. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu Pham can be reached at 571-270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. RODERICK . TOLENTINO Examiner Art Unit 2439 /RODERICK TOLENTINO/Primary Examiner, Art Unit 2439
Read full office action

Prosecution Timeline

Nov 12, 2024
Application Filed
Mar 31, 2026
Non-Final Rejection — §101, §103, §DP (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12603907
SERVER AND METHOD FOR PROVIDING ONLINE THREAT DATA BASED ON USER-CUSTOMIZED KEYWORDS FOR PRIVATE CHANNEL
2y 5m to grant Granted Apr 14, 2026
Patent 12592915
INFERENCE-BASED SELECTIVE FLOW INSPECTION
2y 5m to grant Granted Mar 31, 2026
Patent 12580946
SYSTEMS AND METHODS FOR TRIGGERING TOKEN ALERTS
2y 5m to grant Granted Mar 17, 2026
Patent 12580948
CYBERSECURITY OPERATIONS MITIGATION MANAGEMENT
2y 5m to grant Granted Mar 17, 2026
Patent 12572632
SYSTEMS AND METHODS FOR DATA SECURITY MODEL MODIFICATION AND ANOMALY DETECTION
2y 5m to grant Granted Mar 10, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

1-2
Expected OA Rounds
77%
Grant Probability
99%
With Interview (+35.4%)
3y 4m
Median Time to Grant
Low
PTA Risk
Based on 705 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month