SBA · SBA-37 · record R3193

AI Vulnerability Ticket Deduplication

Small Business Administration · OCIO: Office of the Chief Information Officer

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not high impact: This AI system does not meet the criteria of any of the six pillars that make up High Impact AI in Memorandum M-25-21.
Start date: 2025-12-12 (day precision)Source: 12/12/2025 00:00:00
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Cybersecurity
Operational functions: No function tag matched Derived by keyword rules; see methodology

Problem the AI is intended to solve

Multiple security scanners (Tenable, Qualys, Rapid7) report the same vulnerability on the same host, generating duplicate tickets that create 'ticket bloat' and waste remediation team effort on redundant work.

Expected benefits

Reduced vulnerability ticket volume, faster remediation prioritization, and elimination of redundant vulnerability response effort across multiple scanning tools.

System outputs

Deduplicated vulnerability tickets with merged findings from multiple scanners per unique vulnerability-host combination, reducing duplicate tickets and consolidating remediation workflows.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): ServiceNow Vulnerability Response
Custom-developed code: No
Public source code: Not applicable - No custom code

Sourcing

How it was built: Purchased from vendorSource: a) Purchased from a vendor
Vendor (as reported): ServiceNow, Inc.
Vendors (standardized): ServiceNow

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: No
Privacy Impact Assessment: Not publicly available
Authorization to Operate: Yes
Demographic features: k) None of the above
Training and evaluation data: Vulnerability scan data from Tenable, Qualys, and Rapid7 scanners integrated into ServiceNow. Commercial vendor-managed AI models for entity matching and deduplication.
Federal Data Catalog: Not applicable - Proprietary vendor training data

Governance

8 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingReported in progressSource: b) In-progress

AI impact assessmentReported in progressSource: b) In-progress

Independent reviewReported in progressSource: d) In-progress

Ongoing monitoringReported in progressSource: b) Development of monitoring protocols is in-progress

Operator trainingReported in progressSource: b) Establishment of sufficient and periodic training is in-progress

Fail-safeReported in placeSource: a) Yes

Appeal processNot applicableSource: b) Not applicable

User and public consultationReported in progressSource: Planning includes direct usability testing with vulnerability management team during pilot phase, accuracy validation against manual deduplication baselines, and feedback mechanisms through security operations channels.Flag: free-text answer

Potential impacts and how they were identified

Impact assessment in progress. Primary risks include incorrect deduplication that could suppress unique vulnerabilities. Mitigated by confidence thresholds and analyst review of merged tickets. Identified through vendor documentation and vulnerability management process review.