VA · VA-24-585 · record R2072

Forescout: AI Behavioral Anomaly Detection w/ Automated Enforcement

Department of Veterans Affairs · OIT: Office of Information & Technology

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: High-impactSource: a) High-impact
Impact justification: Not reported
Start date: Not reported
Withheld from public reporting: Not reported

Mission

Topic area: Cybersecurity
Operational functions: No function tag matched Derived by keyword rules; see methodology

Problem the AI is intended to solve

Leverage AI/ML models to learn normal behavior patterns across endpoints, IoT, and OT devices. Identify zero-day threats, insider attacks, or lateral movement by compromised devices that are missed by point-in-time tools within the network. Use these patterns to detect anomalies in real time. When an anomaly (unusual data transfer, unauthorized protocol, lateral movement) is detected Forescout automatically enforces a response policy—such as quarantining the device, notifying SOC security teams, or triggering an orchestration workflow.

Expected benefits

Benefits include real-time response to unknown threats, reduced time to detect and respond, eliminates manual correlation with siloed tools.

System outputs

Response policy; quarantining the device, notifying SOC security teams, or triggering an orchestration workflow

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): Not reported
Custom-developed code: Not reported
Public source code: Not reported

Sourcing

How it was built: Not reported
Vendor (as reported): Not reported
Vendors (standardized): None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Not reported
Privacy Impact Assessment: Not reported
Authorization to Operate: Not reported
Demographic features: Not reported
Training and evaluation data: Not reported
Federal Data Catalog: Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingNo answer reported

AI impact assessmentNo answer reported

Independent reviewNo answer reported

Ongoing monitoringNo answer reported

Operator trainingNo answer reported

Fail-safeNo answer reported

Appeal processNo answer reported

User and public consultationNo answer reported

Potential impacts and how they were identified

Not reported