VA · VA-25-6479 · record R2205

Secure Access Service Edge (SASE)

Department of Veterans Affairs · OIT: Office of Information & Technology

Overview

Development stage: PilotSource: b) Pilot – The use case has been deployed in a limited test or pilot capacity.
High-impact designation: High-impactSource: a) High-impact
Impact justification: Not reported
Start date: Not reported
Withheld from public reporting: Not reported

Mission

Topic area: Cybersecurity
Operational functions: Cyber threat detection, Risk scoring and triage Derived by keyword rules; see methodology

Problem the AI is intended to solve

The AI is intended to identify, prevent, and mitigate risks from unauthorized data access, exfiltration, and misuse of sensitive information, including PHI/PII in cloud applications and network traffic. It addresses gaps in visibility, compliance enforcement, and threat detection across a hybrid work environment.

Expected benefits

- Improved data security by automatically detecting and alerting/blocking risky or non-compliant data transfers in real time. - Operational efficiency by automating policy enforcement and reducing manual review workload. - Enhance compliance with federal mandates by monitoring PHI/PII across all access points, thereby maintaining trust with Veterans and the public through stronger protection of sensitive information.

System outputs

The AI produces actionable security alerts, risk scores, and policy compliance reports that identify potential exposure of PHI/PII. Outputs include prioritized incidents, visualized trends in application usage, anomaly detection summaries, and automated compliance audit logs to support remediation and decision-making.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): Not reported
Custom-developed code: No
Public source code: Not reported

Sourcing

How it was built: Purchased from vendorSource: a) Purchased from a vendor
Vendor (as reported): Not reported
Vendors (standardized): None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Not reported
Privacy Impact Assessment: Not reported
Authorization to Operate: Not reported
Demographic features: Not reported
Training and evaluation data: Not reported
Federal Data Catalog: Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingNo answer reported

AI impact assessmentNo answer reported

Independent reviewNo answer reported

Ongoing monitoringNo answer reported

Operator trainingNo answer reported

Fail-safeNo answer reported

Appeal processNo answer reported

User and public consultationNo answer reported

Potential impacts and how they were identified

Not reported