SBA · SBA-38 · record R3194

AI Vulnerability Remediation Assistance

Small Business Administration · OCIO: Office of the Chief Information Officer

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not high impact: This AI system does not meet the criteria of any of the six pillars that make up High Impact AI in Memorandum M-25-21.
Start date: 2025-09-16 (day precision)Source: 09/16/2025 00:00:00
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Cybersecurity
Operational functions: No function tag matched Derived by keyword rules; see methodology

Problem the AI is intended to solve

Security teams require environment-specific remediation guidance to determine the optimal patch or configuration change for each identified vulnerability, a process that is currently manual and time-intensive.

Expected benefits

Faster and more accurate remediation recommendations tailored to SBA’s specific environment configurations, reducing mean time to remediate and improving patch accuracy.

System outputs

AI-recommended patches or configuration changes to remediate identified vulnerabilities based on the specific host environment, installed software, and configuration context.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): ServiceNow Vulnerability Response
Custom-developed code: No
Public source code: Not applicable - No custom code

Sourcing

How it was built: Purchased from vendorSource: a) Purchased from a vendor
Vendor (as reported): ServiceNow, Inc. / Tenable
Vendors (standardized): ServiceNow

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: No
Privacy Impact Assessment: Not publicly available
Authorization to Operate: Yes
Demographic features: k) None of the above
Training and evaluation data: Vulnerability scan data, host configuration data, and patch management records. Commercial vendor-managed AI models for remediation recommendation.
Federal Data Catalog: Not applicable - Proprietary vendor training data

Governance

8 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingReported in progressSource: b) In-progress

AI impact assessmentReported in progressSource: b) In-progress

Independent reviewReported in progressSource: d) In-progress

Ongoing monitoringReported in progressSource: b) Development of monitoring protocols is in-progress

Operator trainingReported in progressSource: b) Establishment of sufficient and periodic training is in-progress

Fail-safeReported in placeSource: a) Yes

Appeal processNot applicableSource: b) Not applicable

User and public consultationReported in progressSource: Planning includes direct usability testing with vulnerability remediation team during pilot phase, validation of recommendation accuracy against manual analysis, and feedback collection through security operations channels.Flag: free-text answer

Potential impacts and how they were identified

Impact assessment in progress. Primary risks include incorrect remediation recommendations that could destabilize systems. Mitigated by requiring human approval before any remediation action is applied. Identified through vendor documentation and change management process review.