A cyber security appliance comprising: one or more modules configured to utilize probes to interact with entities in a cloud infrastructure environment that include one or more cloud infrastructure elements reliant on packet transmission, where the one or more modules are configured to utilize the probes in one or more of the following ways whether by API interaction, accessing logging tools, observing virtualized network traffic, and/or making relevant requests, where the one or more modules are configured to use the probes to feed information about relevant changes in the cloud infrastructure environment to the one or more modules in a central location of the cyber-security appliance, where the probes to observe virtualized network traffic include one or more probes that include a virtual sensor configured to capture a record of virtual traffic that flows between two or more virtual machines; a cloud module configured to 1) use the information about relevant changes in the cloud infrastructure environment fed from the probes, and 2) use one or more machine learning models that are trained on a normal behavior of at least a first entity associated with the cloud infrastructure environment; and thus, are able to indicate when a behavior of the first entity falls outside of being a normal pattern of life, where the cloud module and the one or more machine learning models trained on the cloud infrastructure environment, examine at least a behavior of the traffic that flows between the two or more virtual machines; a cyber threat module configured to use one or more machine learning models trained on cyber threats in the cloud infrastructure environment and examine at least the behaviors of a first entity of the entities in the cloud infrastructure environment falling outside of the normal pattern of life to determine 'what is a likelihood of a chain of unusual behaviors under analysis that fall outside of being the normal behavior' is a cyber threat; and an autonomous response module, rather than a human taking an action, configured to cause one or more actions to be taken to counter the cyber threat, identified by the cyber threat module, within an organization's portion of the cloud infrastructure environment when a cyber-threat risk parameter is indicative of a likelihood of a cyber-threat is equal to or above an actionable threshold. one or more modules configured to utilize probes to interact with entities in a cloud infrastructure environment that include one or more cloud infrastructure elements reliant on packet transmission, where the one or more modules are configured to utilize the probes in one or more of the following ways whether by API interaction, accessing logging tools, observing virtualized network traffic, and/or making relevant requests, where the one or more modules are configured to use the probes to feed information about relevant changes in the cloud infrastructure environment to the one or more modules in a central location of the cyber-security appliance, where the probes to observe virtualized network traffic include one or more probes that include a virtual sensor configured to capture a record of virtual traffic that flows between two or more virtual machines; a cloud module configured to 1) use the information about relevant changes in the cloud infrastructure environment fed from the probes, and 2) use one or more machine learning models that are trained on a normal behavior of at least a first entity associated with the cloud infrastructure environment; and thus, are able to indicate when a behavior of the first entity falls outside of being a normal pattern of life, where the cloud module and the one or more machine learning models trained on the cloud infrastructure environment, examine at least a behavior of the traffic that flows between the two or more virtual machines; a cyber threat module configured to use one or more machine learning models trained on cyber threats in the cloud infrastructure environment and examine at least the behaviors of a first entity of the entities in the cloud infrastructure environment falling outside of the normal pattern of life to determine 'what is a likelihood of a chain of unusual behaviors under analysis that fall outside of being the normal behavior' is a cyber threat; and an autonomous response module, rather than a human taking an action, configured to cause one or more actions to be taken to counter the cyber threat, identified by the cyber threat module, within an organization's portion of the cloud infrastructure environment when a cyber-threat risk parameter is indicative of a likelihood of a cyber-threat is equal to or above an actionable threshold.