Cyber Threat Analysis (Recorded Future)

Overview

Development stage

DeployedSource: c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.

High-impact designation

Not high-impactSource: c) Not high-impact

Impact justification

Not reported

Start date

2024-06-20 (day precision)Source: 2024-06-20T00:00:00

Withheld from public reporting

Not reported

Mission

Topic area

Law Enforcement

Operational functions

Document processing and extraction, Forecasting and prediction Derived by keyword rules; see methodology

Problem the AI is intended to solve

The system uses the Recorded Future's platform to streamline CBP Cyber Threat Intelligence (CTI) operations by automating the identification and analysis of relevant cyber threat activity and leverages AI/ML to transform unstructured text into structured data using natural language processing, classify events and entities to prioritize threats, forecast events through predictive modeling, and represent structured knowledge using ontologies. It enables analysts to rapidly assess vulnerabilities in CBP’s IT environment, identify adversary data, and generate cyber risk assessments, providing actionable intelligence to enhance efficiency and support Security Operations and Cyber Risk Management investigations.

Expected benefits

Cyber Threat Analysis quickly populates query results when searching against adversary tactics, techniques, and procedures, establishing a threat scorecard. This service can also provide cyber risk scorecards for third party vendors, companies, and organizations.

System outputs

Actionable intelligence supporting Security Operations Center (SOC) and Cyber Risk Management (CRM) investigations and reports.

Technology

AI classification

Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…

System name(s)

Not reported

Custom-developed code

No

Public source code

Not reported

Sourcing

How it was built

Purchased from vendorSource: a) Purchased from a vendor

Vendor (as reported)

Recorded Future

Vendors (standardized)

None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

No

Privacy Impact Assessment

Not reported

Authorization to Operate

No

Demographic features

Not reported

Training and evaluation data

Recorded Future AI is trained on over 10 years of threat analysis from Insikt Group, the company’s threat research division, and is combined with the insights of the Recorded Future Intelligence Graph.

Federal Data Catalog

Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported