SEC · SEC-36 · record R0029

Augmenting cyber threat alerts on the ACES platform with ACES's specific information.

Securities and Exchange Commission · Office of Information Technology (OIT)

Overview

Development stage: PilotSource: b) Pilot – The use case has been deployed in a limited test or pilot capacity.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not reported
Start date: Not reported
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Cybersecurity
Operational functions: Summarization Derived by keyword rules; see methodology

Problem the AI is intended to solve

The current Cyberthreat alerts on the ACES platform are difficult to understand and we often see false positives relative to new use cases.

Expected benefits

The current Cyberthreat alerts on the ACES platform are difficult to understand and we often see false positives relative to new use cases. We would like to run the alerts through a RAG-enabled AI model to: • Add SEC specific guidance and context to the emails based on a curated knowledge base. • Provide more guidance on how to respond to the alert. • Make the notification email easier to read and understand.

System outputs

The AI system will output the cyberthreat alert along with information on the context of the threat in the SEC environment. It will summarize the information and provide suggested guidance in a more readable format.

Technology

AI classification: Generative AISource: Generative AI: AI that generates new or synthetic content (e.g., images, videos, audio, text, code).
System name(s): ACES
Custom-developed code: Not reported
Public source code: Not reported

Sourcing

How it was built: Developed in-houseSource: b) Developed in-house
Vendor (as reported): Not reported
Vendors (standardized): None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Not reported
Privacy Impact Assessment: Not reported
Authorization to Operate: Yes
Demographic features: k) None of the above
Training and evaluation data: The ACES team will develop a knowledge base using existing documentation on the workings of the ACES environment in the SEC in order to provide the RAG implementation.
Federal Data Catalog: Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingNo answer reported

AI impact assessmentNo answer reported

Independent reviewNo answer reported

Ongoing monitoringNo answer reported

Operator trainingNo answer reported

Fail-safeNo answer reported

Appeal processNo answer reported

User and public consultationNo answer reported

Potential impacts and how they were identified

Not reported