Cybersecurity

No reviewed outcome evidence is attached to this theme. That is a gap in review, not evidence of no activity.

• Structured extraction from free-text records for policy researchMinistry of Justice (UK)The ministry reports that Laurium extracts structured information from free-text case records for analysts and policymakers. It has been rolled out to work on parental imprisonment, community sentence treatment requirements, children on remand, prison safety and drug recovery wings. This is analytical use, not an automated individual decision.Scaled · reported stage
• AI-assisted cybersecurity event analysis and responseBanco de ReservasThe 24/7 SOC uses AI tools alongside digital forensics and threat hunting; certified staff analyze cases and determine responses.Production · reported stage
• Behavioral email defense and malicious-link containmentBank OneThe case describes email protection after evaluation, including blocking links in a malicious RFP sent from a compromised trusted partner.Production · reported stage
• Behavioral email threat detection and graymail triageClearBankClearBank integrated Abnormal with Microsoft 365 to contextualize communication behavior, detect impersonation/phishing and reduce email-report workload.Production · reported stage
• AI telemetry feeding cyber risk selection and preventionCoalitionCoalition says it uses global honeypots and AI to monitor evolving threat behavior and inform risk models; underwriters build organization-specific cyber-risk profiles. The July launch extends its offering to large US enterprises with Allianz capacity.Production · reported stage
• AI network monitoring and incident investigationConfiarSofistic describes Confiar using learned user/device behavior for threat detection, automated incident investigation and SOC escalation.Production · reported stage
• Layered contract review for cyber-incident notice obligationsDinsmore & ShohlA 26,000-contract incident review combined search culling, repeated GenAI classifications, human validation and traditional predictive coding trained from reviewed labels. The vendor reports sampled recall improving from 92% to 98.2%.Production · reported stage
• AI attack-surface monitoring and autonomous cyber responseDirect FCUSelf-learning models identify abnormal activity and trigger responses across email, cloud and network environments.Production · reported stage
• Multi-agent first assessment of cyber-security alertsDNBDNB uses coordinating, information-gathering, assessment and control agents to draft security cases and recommend priority. Agents have limited tools and sources; analysts review their work.Production · reported stage
• Cloud behavior anomaly detection and insider-risk triageFunding CircleFunding Circle deployed the system after a proof of value to monitor AWS behavior and prioritize anomalies, including unauthorized SaaS, BitTorrent and resource misuse.Production · reported stage
• AI-assisted threat hunting and incident briefingsIntesa SanpaoloIntesa analysts generate and analyze KQL queries and prepare executive incident briefings with Copilot alongside Sentinel threat detection.Production · reported stage
• Auspex security threat-model generationJPMorgan ChaseGenerates threat matrices and suggested mitigations from system designs for security review.Production · reported stage
• Copilot-assisted endpoint exposure and device operationsMicrosoftMicrosoft Digital uses natural-language queries over Defender and Intune to scope vulnerable devices, retrieve ownership context and interpret logs. GitHub Copilot helps generate KQL used to validate suspected incident causes.Production · reported stage
• Agentic vulnerability discovery integrated with Firefox patchingMozillaMozilla built a harness on existing fuzzing infrastructure, running targeted investigations in ephemeral VMs. Findings enter deduplication, triage and patch delivery; the team reports actual Firefox fixes and explains that earlier static LLM audits had too many false positives.Production · reported stage
• Security-event log interrogation and endpoint investigationNABNAB’s workplace technology leader describes engineers using Microsoft Copilot for Security to question security-event logs, particularly around Intune-managed endpoints.Production · reported stage
• GenAI-assisted security monitoring migrationNationwide Building SocietyGenAI supported migration of security information and event data into Sentinel.Production · reported stage
• Network anomaly detection, investigation and autonomous containmentNKGSB BankNKGSB deployed unsupervised ML to detect behavioral deviations, prioritize incidents and contain malicious activity; security staff receive action alerts.Production · reported stage
• AI security triage for coding-agent endpoint alertsOpenAIOpenAI's security agent correlates endpoint alerts with Codex request, tool, approval and network logs. It presents analysis to the security team to distinguish expected behavior, benign mistakes and cases needing escalation.Production · reported stage
• ML-assisted cyber threat curation and alert monitoringOur Community Credit UnionOCCU used DefenseStorm Grid for event monitoring and alert workflows. The announcement explicitly says the TRAC team used machine learning to curate threats and triggers relevant to OCCU; the CIO described formerly manual tasks already being automated.Production · reported stage
• IT security monitoringPBGCAI monitors security of pension-insurer systems and data.Production · reported stage
• Seattle Children's inappropriate-record-access detectionSeattle Children'sThe hospital uses AI-supported privacy monitoring to distinguish appropriate from inappropriate record access and support investigations.Production · reported stage
• Agentic vulnerability discovery and remediation triageVisaVisa uses a multi-model test harness to map its codebase, run security agents, prioritize vulnerabilities and prepare developer/remediation reports.Pilot · reported stage
• Raven cyber-resilience assessment and reportingBISBIS is developing AI-assisted access to cyber standards and analysis of financial-sector resilience evidence.Announced · reported stage
• Citigroup AI Cybersecurity OperationsCitigroupCitigroup deploys AI across its cybersecurity operations to detect and respond to threats in real-time. The system uses behavioral analytics and anomaly detection to identify potential security incidents, providing security operations center analysts with prioritized alerts and automated response capabilities.Not assessed · legacy label
• JPMorgan Chase AI Cybersecurity Threat DetectionJPMorgan ChaseJPMorgan Chase uses AI for real-time cybersecurity threat detection across its technology infrastructure. The system monitors network traffic, user behavior, and system logs to identify potential cyber threats and anomalous activity, protecting the bank's operations and customer data.Not assessed · legacy label
• Security and privacy control assessmentPBGCPlanned GenAI evaluates controls and evidence and drafts findings.Announced · reported stage
• Sanlam AI-enabled security and digital identity controlsSanlamSanlam reports implementing AI-enabled security and biometric client verification.Announced · reported stage