Netskope Patent for Phishing Detection and Prevention

ChangeBridge: Patent Grants - Business Methods (G06Q)

Published March 17th, 2026

Detected March 22nd, 2026

Summary

The USPTO has granted Netskope, Inc. patent US12580960B2 for a phishing detection and prevention system. The technology intercepts and analyzes webpages, identifying potential phishing attacks by comparing resource addresses and blocking the exfiltration of confidential information to unsanctioned resources.

View original document View source feed page

What changed

The United States Patent and Trademark Office (USPTO) has granted patent US12580960B2 to Netskope, Inc. This patent covers a method for metadata-based detection and prevention of phishing attacks. The disclosed technology intercepts webpages, analyzes images and fields to identify hosted services and confidential information requests, and intercepts user requests containing confidential information. It determines if the information is being sent to an unsanctioned resource by comparing the request's resource address with sanctioned addresses for the hosted service, thereby identifying and blocking phishing attempts.

This patent grant is a non-binding notice of intellectual property protection for Netskope's technology. While it does not impose new regulatory obligations on other entities, it signifies a technological advancement in cybersecurity. Companies involved in cybersecurity, data protection, and network security, particularly those offering solutions to prevent phishing and protect confidential information, should be aware of this patented technology. The patent's effective date is March 17, 2026, with a filing date of November 6, 2023.

Source document (simplified)

← USPTO Patent Grants

Metadata-based detection and prevention of phishing attacks

Grant US12580960B2 Kind: B2 Mar 17, 2026

Assignee

Netskope, Inc.

Inventors

Krishna Narayanaswamy

Abstract

The technology disclosed intercepts a webpage rendered by a server in response to a user action executed on a client. The technology disclosed analyzes one or more images of the webpage and determines that a particular hosted service is represented by the images. It analyzes one or more fields of the webpage and determines that the fields elicit confidential information. The technology disclosed intercepts a request generated by the client in response to another user action providing the confidential information via the fields. The technology disclosed analyses the request and determines that the confidential information is being exfiltrated to an unsanctioned resource. This determination is made by comparing a resource address in the request with one or more sanctioned resource addresses used by the particular hosted service. The technology disclosed determines that the webpage is effectuating a phishing attack and blocks transmission of the confidential information to the unsanctioned resource.

CPC Classifications

G06N 3/084 G06N 20/20 G06N 5/01 G06N 3/045 G06N 3/044 G06N 3/048 H04L 69/22 H04L 63/20 H04L 63/1466 H04L 63/1425 H04L 63/1483 H04W 12/12 G04L 67/02 G06F 21/6245 G06F 2221/2119 G06Q 10/107