FHFA · FHFA-3 · record R0069

Phishing Email Identification

Federal Housing Finance Agency · OCOO

Overview

Development stage: DeployedSource: c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not reported
Start date: 2021-04-01 (day precision)Source: 04/01/2021 00:00:00
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Cybersecurity
Operational functions: Cyber threat detection Derived by keyword rules; see methodology

Problem the AI is intended to solve

Knowbe4 PhishER is a tool to report and manage suspicious emails. This tool use ML and AI to analyze suspicious emails to identify if the email is spam, phishing, or malicious. The primary benefit of this tool is to automate responses without requiring human intervention to analyze each email that end users identify as suspicious.

Expected benefits

Risk Reduction

System outputs

Output is a response to suspicious emails without requiring a cybersecurity specialist to analyze hundreds of emails. This tool reduces time to respond to end user requests concerning suspicious activity.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): GSS
Custom-developed code: No
Public source code: Not reported

Sourcing

How it was built: Purchased from vendorSource: a) Purchased from a vendor
Vendor (as reported): Knowbe4 Phish ER
Vendors (standardized): None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: No
Privacy Impact Assessment: Not reported
Authorization to Operate: Yes
Demographic features: k) None of the above
Training and evaluation data: This is a subscription service from a third-party vendor and confidential business information of this nature is not available.
Federal Data Catalog: Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingNo answer reported

AI impact assessmentNo answer reported

Independent reviewNo answer reported

Ongoing monitoringNo answer reported

Operator trainingNo answer reported

Fail-safeNo answer reported

Appeal processNo answer reported

User and public consultationNo answer reported

Potential impacts and how they were identified

Not reported