[{"data":1,"prerenderedAt":656},["ShallowReactive",2],{"uc-threat-intelligence-collection-and-reporting":3,"uc-regulations":434},{"useCase":4,"evidence":215,"blitsAiDeployments":331,"benchmarks":332,"indicative":344,"related":347,"indexability":432,"includeUnpublished":221},{"title":5,"shortTitle":6,"seoTitle":7,"metaDescription":8,"status":9,"definition":10,"aliases":11,"industries":17,"functions":23,"patterns":25,"channels":31,"audience":35,"autonomy":36,"adoptionStage":37,"problem":38,"problemStats":39,"howItWorks":40,"valueDrivers":41,"kpis":45,"indicativeValue":50,"macroEstimates":91,"feasibility":92,"implementation":107,"risk":153,"blitsAi":191,"faq":193,"related":206,"datePublished":210,"dateModified":210,"lastVerified":210,"changelog":211,"slug":214},"AI for threat intelligence collection and reporting","Threat intelligence reporting","AI threat intelligence reporting and summaries","AI that drafts threat reports and briefings. RH-ISAC cut collection from 10 hours to two or three a week, and Elastic says its analysts recouped 75% of their time.","published","Threat intelligence collection and reporting is AI that gathers threat reports, extracts the indicators and drafts summaries and briefings for a human analyst to check and send. It watches news, vendor blogs, advisories and filings against the organization's own priorities, pulls out threat actors, vulnerabilities and indicators of compromise, and writes the first version of the daily digest, the incident report or the customer newsletter.",[12,13,14,15,16],"AI cyber threat intelligence analyst","CTI report drafting","threat intelligence summarization","open source intelligence (OSINT) automation for security","threat briefing automation",[18,19,20,21,22],"cross-industry","retail-and-ecommerce","government","technology","professional-services",[24],"security-operations",[26,27,28,29,30],"summarization","agentic-workflow","rag-knowledge-assistant","classification-and-routing","content-generation",[32,33,34],"internal-tools","email","api","employee-facing","copilot","early-adopters","A cyber threat intelligence (CTI) team answers a short list of questions for its organization:\nwhich attackers are active against our sector, which vulnerabilities are being exploited in the\nsoftware we run, and has anything happened at a company we depend on. The answers sit in hundreds\nof places: vendor blogs, government advisories, news sites, social media, regulatory filings and\npaid feeds. Elastic describes the starting point as analysts who \"have traditionally relied on\nmanual collection, documentation, and analysis\", a process it says can take days or weeks.\n\nThe collecting and writing takes the time. RH-ISAC's threat intelligence team spent 10 hours a week just\ncollecting intelligence, and one of its analysts spent two hours a day summarizing daily news. At gematik, an analyst read each article,\ntranslated it into German, summarized it and copied it into the wiki page for the morning briefing,\nand on busy days it took up to an hour. Sopra Steria's team needed 45 minutes to pull the indicators\nof compromise out of a single article, and some analysts chose not to spend the time.\n\nTime spent collecting is time not spent on the analysis that stakeholders need, which is what a\nthreat means for this organization and what to do about it. It also leaves gaps. Analysts have\ntheir favorite sources, nobody can tell whether the team caught everything, and a stakeholder\nlearns about an incident from the news before the CTI team has said a word.",[],"1. **Turn the intelligence requirements into standing queries.** The team writes down what it must\n   watch: its sector, its technology stack and suppliers, named threat actors, a list of member or\n   customer companies. Each requirement becomes a feed that the AI keeps filtering, so it does not\n   need an endless list of aliases and keywords.\n2. **Collect and extract.** The system scans the configured sources, removes duplicates and tags each\n   article with the threat actors, vulnerabilities, techniques and indicators of compromise it\n   mentions. Extracted indicators can flow straight into a threat intelligence platform such as MISP.\n3. **Draft the summary.** The analyst selects the relevant items and asks the assistant to write a\n   summary, a threat actor profile or a report from a template stored in a knowledge base. Ask the\n   assistant to name the articles it used, so the analyst can check each claim against its source.\n4. **Review and add the analysis.** The analyst checks the draft against the sources, edits it and\n   adds what only a human can: why this matters for this organization and what to do next.\n5. **Distribute.** Approved items go into the daily briefing page, a newsletter, a ticket or a chat\n   channel. Templates and schedules mean the daily and weekly products go out even when part of the\n   team is away.",[42,43,44],"employee-productivity","speed","risk-reduction",[46,47,48,49],"handling-time-reduction","productivity-gain","time-saved-per-task","hours-saved",{"referenceOrg":51,"inputs":52,"formula":86,"currency":87,"period":88,"resultLabel":89,"caveat":90},"An enterprise cyber threat intelligence team of 3 to 8 analysts",[53,59,65,72,79],{"key":54,"label":55,"low":56,"high":57,"unit":54,"note":58},"analysts","Analysts who collect and write threat intelligence",3,8,"Editorial assumption for a large enterprise team. Replace with your own headcount.",{"key":60,"label":61,"low":57,"high":62,"unit":63,"note":64},"hoursPerWeek","Hours per analyst per week spent collecting, summarizing and formatting",16,"hours per week","Editorial assumption. RH-ISAC reports 10 hours a week on collection alone before Feedly, plus two hours a day on summaries. Replace with your own time study.",{"key":66,"label":67,"low":68,"high":69,"unit":70,"note":71},"weeksPerYear","Working weeks per year",44,46,"weeks","Editorial assumption that allows for leave and public holidays.",{"key":73,"label":74,"low":75,"high":76,"unit":77,"note":78},"timeSavedShare","Share of that time the AI saves",0.3,0.6,"fraction of collection and writing time","Below the figures on this page, where RH-ISAC's case study reports a 70% or higher cut in collection time and Elastic says its analysts recouped 75% of their time (one vendor reported, one reported by Elastic about its own team), because a first deployment rarely covers every source and report type.",{"key":80,"label":81,"low":82,"high":83,"unit":84,"note":85},"costPerHour","Fully loaded cost of an analyst hour",60,100,"USD per hour","Editorial assumption, replace with your own fully loaded cost.","analysts * hoursPerWeek * weeksPerYear * timeSavedShare * costPerHour","USD","per year","Analyst time released from collecting and formatting, valued at cost","Counts analyst time only. It leaves out the license cost of the intelligence platform and the AI, the set up of feeds and templates, the time spent checking drafts, and the value of warning a stakeholder earlier, which is the benefit the teams on this page care most about.",[],{"complexity":93,"complexityNote":94,"dataPrerequisites":95,"integrations":101},"medium","The software side is a configured platform plus a few integrations. Written intelligence requirements, a list of trusted sources, one report template per product and an agreement on who checks which output before it leaves the team take longer to settle than the set up. Newsletters sent to customers also need an owner for tone and legal wording.",[96,97,98,99,100],"Written priority intelligence requirements, with the sectors, technologies, suppliers and actors to watch","A list of trusted sources and any paid feeds the organization already licenses","An asset or technology inventory, so vulnerabilities can be matched to what the organization runs","Report templates for each product (daily digest, incident report, actor profile, newsletter)","Past reports, to calibrate tone and level of detail",[102,103,104,105,106],"Threat intelligence platform such as MISP or OpenCTI, for indicators of compromise","SIEM or ticketing system, for vulnerabilities and detection requests","Wiki, email or newsletter tool for the daily and weekly products","Chat tool such as Slack or Microsoft Teams for alerts","Asset inventory or CMDB for matching vulnerabilities to systems",{"steps":108,"guardrails":127,"humanInTheLoop":133,"kpisToInstrument":134,"failureModes":140},[109,112,115,118,121,124],{"title":110,"detail":111},"Write the requirements before you buy a tool","List the questions your stakeholders ask and the sources you read to answer them. Measure how many hours a week the team spends collecting, summarizing and formatting. That baseline is what you compare against later.",{"title":113,"detail":114},"Start with one product","Pick the report with the most routine writing, usually the daily or weekly digest, and build its template and feeds first. A narrow start makes errors easy to spot and gives analysts a reason to trust the next product.",{"title":116,"detail":117},"Keep the analyst as the author","The AI drafts and the analyst signs. Require a source link for every claim in a draft, and have the analyst check indicators and technique names against the source before anything is pushed to a platform or a customer.",{"title":119,"detail":120},"Connect the outputs","Push indicators into the threat intelligence platform, vulnerabilities into the ticketing system and summaries into the briefing page, using the same review step as the manual process.",{"title":122,"detail":123},"Review the misses every month","Compare what the AI surfaced with incidents the team learned about elsewhere, and tune the feeds. Track how often stakeholders learn about something before the team tells them.",{"title":125,"detail":126},"Spend the saved time on analysis","Decide in advance what the freed hours go to: trend reports, stakeholder briefings or hunting requests. Elastic and RH-ISAC both name this as the point of the exercise.",[128,129,130,131,132],"Every claim in a draft links to the source article, and an analyst reads the source before publishing","Indicators of compromise and framework technique identifiers are validated against the source or the framework before they enter a platform","Content from the open web is treated as untrusted input, so text hidden in a page cannot steer the assistant or its tools","Sharing restrictions such as the Traffic Light Protocol are applied by the analyst, never inferred by the model","Confidential or member data is not sent to a model or service the organization has not approved for it","An analyst owns every report that leaves the team. The AI selects, extracts and drafts; the analyst checks the sources, edits the text and adds the assessment of impact. Alerts to members or customers that name a victim need a second reviewer. RH-ISAC's analyst describes a quick fact check and edit of each AI summary, and in a crisis report he added his own analysis to the summary.",[135,136,137,138,139],"Analyst hours per week on collection, summarizing and formatting, before and after","Share of AI drafts published with no change, with light edits and with major edits","Errors found after publication (wrong actor, wrong indicator, wrong date) per month","Time from first public report to an alert reaching stakeholders","Incidents or vulnerabilities the team learned about elsewhere before its own feeds showed them",[141,144,147,150],{"title":142,"detail":143},"Invented details","The model names a threat actor, technique or indicator that the source does not mention. mnemonic reports that its first attempt in 2023 failed because the models invented MITRE techniques that did not exist. Use an output schema, check identifiers against the framework and sample drafts against their sources.",{"title":145,"detail":146},"A confident summary of a wrong article","Vendor blogs and social posts get ahead of the facts during a crisis. A fluent summary hides that. Keep the source list visible in the draft and label reporting by how well it is evidenced.",{"title":148,"detail":149},"Noise instead of signal","Broad feeds return the whole internet. Narrow each feed to a requirement, name the owner of each feed and retire feeds nobody has acted on in a quarter.",{"title":151,"detail":152},"Analysts stop reading sources","Once drafts look right, review becomes a glance. Rotate who reviews, and measure errors found after publication.",{"euAiAct":154,"regulations":157,"guidance":163,"controls":180,"incidents":186},{"tier":155,"basis":156},"minimal","Summarising public threat reporting for an organization's own cyber defense is not an Annex III use, and recital 55 of the AI Act says components used solely for cybersecurity purposes do not qualify as safety components. The tier stays minimal while the assistant works on public sources and an analyst reviews and takes responsibility for what is published. It changes if the same tooling is used to profile or score employees.",[158,159,160,161,162],"eu-ai-act","gdpr","nis2","nist-ai-rmf","iso-42001",[164,170,175],{"title":165,"issuer":166,"region":167,"url":168,"note":169},"Traffic Light Protocol (TLP)","FIRST","global","https:\u002F\u002Fwww.first.org\u002Ftlp\u002F","The standard labels (red, amber, green, clear) that tell recipients how far a piece of intelligence may be shared; a draft written by an AI must keep the label of its sources.",{"title":171,"issuer":172,"region":167,"url":173,"note":174},"MITRE ATT&CK","MITRE","https:\u002F\u002Fattack.mitre.org\u002F","The shared catalog of attacker techniques that reports and extraction tools map to, and the reference to validate technique identifiers against.",{"title":176,"issuer":177,"region":167,"url":178,"note":179},"OWASP Top 10 for LLM Applications","OWASP","https:\u002F\u002Fgenai.owasp.org\u002Fllm-top-10\u002F","Lists prompt injection and excessive agency among the main risks of LLM applications, relevant when an assistant reads attacker controlled web pages.",[181,182,183,184,185],"Named owner for the intelligence requirements and for each feed","Source link on every claim, kept with the published report","Validation of extracted identifiers and indicators before they enter a threat intelligence platform","Approved model and data handling for confidential and member information","Monthly sample of published reports checked against their sources",[187],{"title":188,"url":189,"note":190},"mnemonic's first attempt to extract structured data from threat reports (2023)","https:\u002F\u002Fwww.mnemonic.io\u002Fresources\u002Fblog\u002Fagentic-detection-engineering-turning-threat-reports-into-detections\u002F","The security services company reports that its 2023 experiment with language models on threat intelligence reports was not good enough for production, because the models invented MITRE techniques, could not take long reports and gave inconsistent answers.",{"howToBuild":192},"On Blits.ai this is an **agentic workflow** that runs on a **schedule** and can also be triggered\nthrough an API token. **Custom functions** call the feeds, advisory APIs and ticketing system the\nteam already uses, and **MCP** servers can expose a threat intelligence platform to the agent. A\n**knowledge base** with hybrid retrieval holds the report templates, the intelligence requirements\nand past reports, so a draft follows the house format and cites what it used. The agent writes the\ndigest or summary and hands it to an analyst, and a **human in the loop** approval step sits before\nanything is sent to a newsletter, a ticket or a member.\n\nA **tool execution policy** limits what the agent can call while it reads untrusted web content,\nand every run keeps a **full audit trail** with downloadable run data. **Test suites** can replay\npast articles with known actors and indicators to check extraction, and **monitors** can run the\nsame checks on a schedule. The platform is model agnostic, with EU and UAE data residency for\norganizations that cannot send intelligence data elsewhere.",[194,197,200,203],{"question":195,"answer":196},"How much time does AI save a threat intelligence team?","Two organizations on this page report figures. RH-ISAC's case study, written by its vendor Feedly, says collection fell from 10 hours to two or three hours a week, a 70% to 80% cut. Elastic says its analysts recouped 75% of their time on report aggregation while report output rose by 92%, although its page calls these results illustrative. Both are self reported or vendor reported, so time your own baseline.",{"question":198,"answer":199},"Can AI write the threat intelligence report on its own?","It can write a first draft from your template and the articles you select, and the teams here publish only after an analyst checks it. RH-ISAC's analyst describes a quick fact check and edit of the AI summary, and in a crisis report he added his own analysis to it. The value of the report is the assessment of what the threat means for your organization, which the model does not know without your context.",{"question":201,"answer":202},"What goes wrong when a model reads threat reports?","Invented details and fluent summaries of weak sources. mnemonic says that in 2023 the models invented MITRE techniques that did not exist, and its 2026 detection engineering workflow (a related but separate use case) adds output schemas, tool access and reusable skills and still treats every result as a draft for an analyst. Validate identifiers against the framework and keep the source link on every claim.",{"question":204,"answer":205},"Is this the same as security alert triage?","No. Alert triage works on events inside your own systems. Threat intelligence works on reporting from outside, and its output is a briefing, a report or an indicator list. The two meet when an indicator or a new vulnerability from a report is matched against your own alerts and assets.",[207,208,209],"security-alert-triage-and-investigation","detection-engineering-assistant","software-vulnerability-remediation","2026-10-13",[212],{"date":210,"note":213},"First published","threat-intelligence-collection-and-reporting",[216,254,284,312],{"title":217,"useCases":218,"organization":219,"vendors":223,"summary":226,"stage":227,"year":228,"channels":229,"languages":230,"metrics":232,"outcomeDisclosed":245,"sources":246,"verification":249,"grade":251,"id":252,"organizationSlug":253},"Elastic: Threat Intelligence AI Assistant for the InfoSec team's own reports",[214],{"name":220,"anonymized":221,"region":167,"industry":21,"wikidata":222},"Elastic",false,"Q22074922",[224],{"name":220,"role":225},"in-house","Elastic's own information security team built a threat intelligence reporting assistant on Elastic AI Assistant for Security. The team stored a markdown template for each report type in the assistant's knowledge base, with sections and instructions for the model, and the assistant now drafts intelligence reports, single event reports, threat actor profiles, trend reports and summaries from the collected sources. Analysts refine and update each draft. Elastic says the analysts reclaimed 75% of their time and report output rose by 92% in the six months after launch.","production",2025,[32],[231],"en",[233,241],{"kpi":47,"value":234,"unit":235,"qualifier":236,"period":237,"claimant":238,"quote":239,"sourceUrl":240},75,"percent","exact","share of analysts' time recouped, mainly from less time spent aggregating information for threat intelligence reports, six months after launch","organization","The team has recouped 75% of analysts’ time while increasing threat intelligence report output by 92%.","https:\u002F\u002Fwww.elastic.co\u002Fresources\u002Farticle\u002Felastic-infosec-ai-assistant",{"kpi":47,"value":242,"unit":235,"qualifier":236,"period":243,"claimant":238,"quote":244,"sourceUrl":240},92,"increase in threat intelligence reports created, six months after launch","The assistant drove a 92% increase in threat intelligence reports, enabling a more proactive defense and better stakeholder engagement.",true,[247],{"url":240,"title":248,"publisher":220},"Threat Intelligence AI Assistant built on Elastic",{"level":250,"checkedAt":210},"source-verified","B","elastic-infosec-threat-intelligence-ai-assistant",null,{"title":255,"useCases":256,"organization":257,"vendors":262,"summary":266,"stage":227,"year":228,"channels":267,"languages":268,"metrics":270,"outcomeDisclosed":245,"sources":271,"verification":281,"grade":282,"id":283,"organizationSlug":253},"gematik: Feedly AI Feeds and Boards for daily threat intelligence briefings",[214],{"name":258,"anonymized":221,"country":259,"region":260,"industry":20,"wikidata":261},"gematik","DE","europe","Q1499925",[263],{"name":264,"role":265},"Feedly","platform","gematik, the German agency responsible for digitizing healthcare products, runs a Cyber Defense Center that used to read trusted websites, translate articles into German, summarize them and copy them into a wiki page for the daily threat briefing. With Feedly AI Feeds, Team Boards and its API, the team collects relevant articles, loads them into the briefing page automatically and sends a daily digest to the security department and a weekly report to management. An analyst still chooses which articles go on the daily board.",[32],[231,269],"de",[],[272,276],{"url":273,"title":274,"publisher":264,"date":275},"https:\u002F\u002Ffeedly.com\u002Fcustomers\u002Fposts\u002Fgematik-threat-intelligence","gematik reimagines OSINT: Drastically reducing manual work with Feedly Threat Intelligence","2025-01-16",{"url":277,"title":278,"publisher":279,"date":280},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2025\u002F08\u002F28\u002Ffeedly-threat-intelligence\u002F","Can AI make threat intelligence easier? One platform thinks so","Help Net Security","2025-08-28",{"level":250,"checkedAt":210},"C","gematik-feedly-osint-automation",{"title":285,"useCases":286,"organization":287,"vendors":291,"summary":293,"stage":227,"year":228,"channels":294,"languages":295,"metrics":296,"outcomeDisclosed":245,"sources":305,"verification":310,"grade":282,"id":311,"organizationSlug":253},"RH-ISAC: Feedly AI Feeds and Ask AI for threat intelligence collection and summaries",[214],{"name":288,"anonymized":221,"country":289,"region":290,"industry":19},"RH-ISAC","US","north-america",[292],{"name":264,"role":265},"RH-ISAC, the Retail and Hospitality Information Sharing and Analysis Center, monitors threats for more than 300 member organizations. Its threat intelligence team turned its two priority intelligence requirements into AI Feeds in Feedly, one for the sub industries it covers and one for a list of member companies, and uses the Ask AI panel to write first draft summaries of daily news and of reporting during a geopolitical crisis. The analyst fact checks and edits each summary before it goes out. The ISAC reports that collection time fell from 10 hours to two or three hours a week.",[32],[231],[297],{"kpi":46,"value":298,"unit":235,"qualifier":299,"period":300,"baseline":301,"claimant":302,"quote":303,"sourceUrl":304},70,"at-least","weekly intelligence collection, from 10 hours to two or three hours","10 hours a week of manual collection from blogs, RSS feeds and social media","vendor","The team reduced intel collection time from 10 hours to just two or three hours per week — a 70–80% time savings — and cut report summarization time from two hours per day to just 15–20 minutes.","https:\u002F\u002Ffeedly.com\u002Fcustomers\u002Fposts\u002Frh-isac-threat-intel",[306,309],{"url":304,"title":307,"publisher":264,"date":308},"How RH-ISAC sends more high-fidelity alerts in less time to 300+ member companies","2025-08-06",{"url":277,"title":278,"publisher":279,"date":280},{"level":250,"checkedAt":210},"rh-isac-feedly-threat-intelligence-collection",{"title":313,"useCases":314,"organization":315,"vendors":317,"summary":319,"stage":227,"year":320,"channels":321,"languages":322,"metrics":323,"outcomeDisclosed":245,"sources":324,"verification":329,"grade":282,"id":330,"organizationSlug":253},"Sopra Steria Scandinavia: Feedly AI for IoC extraction and customer threat newsletters",[214],{"name":316,"anonymized":221,"region":260,"industry":22},"Sopra Steria Scandinavia",[318],{"name":264,"role":265},"The cyber threat intelligence team at Sopra Steria Scandinavia, which sells managed security services, uses Feedly AI Feeds to collect indicators of compromise and vulnerabilities that match its customers' technology. Saving an article to a board extracts the indicators and sends them with context to its MISP instance, and Feedly AI writes a summary of each article for daily and weekly newsletters sent to more than 150 recipients. Analysts check the summaries and add notes before sending. The team says inbound customer tickets about threats and new vulnerabilities were significantly reduced.",2023,[32,33],[231],[],[325],{"url":326,"title":327,"publisher":264,"date":328},"https:\u002F\u002Ffeedly.com\u002Fcustomers\u002Fposts\u002Fautomating-threat-intelligence","Sopra Steria automated threat intelligence with Feedly AI, and customer support tickets were significantly reduced","2023-09-19",{"level":250,"checkedAt":210},"sopra-steria-feedly-ioc-newsletters",0,[333,339],{"kpi":46,"label":334,"unit":235,"aggregate":245,"higherIsBetter":245,"n":335,"nUpTo":331,"median":298,"min":298,"max":298,"byClaimant":336,"vendorOnly":245,"points":337},"Handling time reduction",1,{"organization":331,"vendor":335,"regulator":331,"independent":331},[338],{"evidenceId":311,"organization":288,"value":298,"qualifier":299,"claimant":302,"grade":282,"pooled":245},{"kpi":47,"label":340,"unit":235,"aggregate":245,"higherIsBetter":245,"n":335,"nUpTo":331,"median":234,"min":234,"max":234,"byClaimant":341,"vendorOnly":221,"points":342},"Productivity gain",{"organization":335,"vendor":331,"regulator":331,"independent":331},[343],{"evidenceId":252,"organization":220,"value":234,"qualifier":236,"claimant":238,"grade":251,"pooled":245},{"low":345,"high":346},19008,353280,[348,370,388,406],{"slug":207,"title":349,"shortTitle":350,"definition":351,"status":9,"industries":352,"functions":354,"patterns":356,"audience":35,"autonomy":357,"adoptionStage":37,"evidenceCount":358,"publicEvidenceCount":358,"organizations":359,"bestGrade":251,"headline":367,"lastVerified":369,"indexable":245},"AI for security alert triage and investigation in the SOC","Security alert triage","Security alert triage and investigation is an AI agent in the security operations centre that picks up each new alert or user reported phishing email. It gathers the evidence from the SIEM, endpoint, identity and threat intelligence tools, gives a verdict with its reasoning and a draft incident summary, and closes clear false positives while an analyst approves every containment action.",[18,353,21,20,22],"healthcare",[24,355],"it-and-engineering",[27,29,26,28],"supervised-agent",7,[360,361,362,363,364,365,366],"Avanade","Federal Housing Finance Agency","Human Managed","SEP2","St. Luke's University Health Network","TÜV SÜD","U.S. Immigration and Customs Enforcement",{"kpi":47,"label":340,"unit":235,"n":56,"nUpTo":331,"kind":368,"value":82,"qualifier":236,"claimant":253,"organization":253,"vendorReported":221},"median","2026-09-27",{"slug":208,"title":371,"shortTitle":372,"definition":373,"status":9,"industries":374,"functions":375,"patterns":376,"audience":35,"autonomy":36,"adoptionStage":378,"evidenceCount":56,"publicEvidenceCount":56,"organizations":379,"bestGrade":251,"headline":383,"lastVerified":210,"indexable":245},"AI for detection engineering and detection rule writing","Detection engineering","AI detection engineering drafts, tests and tunes the rules that find attacks in security logs, from threat reports, vulnerability disclosures or plain language requests, for an engineer to approve. It also translates rules between query languages, tags them with MITRE ATT&CK techniques and checks them against the organization's own data before they go live.",[18,21],[24],[377,27,29],"code-generation","emerging",[380,381,382],"Amazon","mnemonic","SAP Enterprise Cloud Services",{"kpi":384,"label":385,"unit":235,"n":335,"nUpTo":331,"kind":386,"value":387,"qualifier":236,"claimant":238,"organization":380,"vendorReported":221},"false-positive-reduction","False positive reduction","reported",67,{"slug":209,"title":389,"shortTitle":390,"definition":391,"status":9,"industries":392,"functions":393,"patterns":394,"audience":35,"autonomy":36,"adoptionStage":37,"evidenceCount":395,"publicEvidenceCount":395,"organizations":396,"bestGrade":251,"headline":402,"lastVerified":369,"indexable":245},"AI for software vulnerability triage and remediation","Vulnerability remediation","AI vulnerability remediation is AI that takes security findings from scanners, fuzzers and bug reports and turns the real ones into a drafted code fix for developers. It filters out duplicates and false positives, reproduces and ranks the findings, and drafts a fix with a test for each, which a developer reviews and merges through the normal change process.",[18,21,353],[24,355],[377,27,29],6,[397,398,399,400,401],"AMD","Cathay Pacific","Google","Labelbox","PatientPoint",{"kpi":403,"label":404,"unit":235,"n":335,"nUpTo":331,"kind":386,"value":298,"qualifier":405,"claimant":302,"organization":397,"vendorReported":245},"automation-rate","Automation rate","approximately",{"slug":407,"title":408,"shortTitle":409,"definition":410,"status":9,"industries":411,"functions":414,"patterns":417,"audience":35,"autonomy":36,"adoptionStage":418,"evidenceCount":358,"publicEvidenceCount":358,"organizations":419,"bestGrade":251,"headline":427,"lastVerified":369,"indexable":245},"email-and-ticket-reply-drafting","AI reply drafting for customer email and support tickets","Email and ticket reply drafting","AI reply drafting for customer email and support tickets is a copilot that drafts the reply to an incoming email, message or ticket once it reaches a service agent. It summarizes the request, pulls the relevant customer data and approved knowledge, and drafts the reply in the organization's tone and the customer's language for the agent to check, edit and send. Live calls and chats, and the sorting of the inbox itself, are separate use cases.",[18,20,412,413,21],"banking","telecommunications",[415,416],"customer-service","operations",[30,26,28,29],"mainstream",[420,421,422,423,424,425,426],"Centers for Disease Control and Prevention","First National Bank","HYPE","L'Oréal","Nomad eSIM","Transportation Security Administration","Turing",{"kpi":428,"label":429,"unit":235,"n":430,"nUpTo":331,"kind":386,"value":431,"qualifier":405,"claimant":302,"organization":422,"vendorReported":245},"processing-time-reduction","Cycle time reduction",2,50,{"indexable":245,"reasons":433},[],[435,441,446,452,458,465,471,478,486,493,500,505,511,518,525,532,538,544,551,556,561,568,574,581,586,591,597,602,608,613,621,627,633,639,645,650],{"id":158,"label":436,"issuer":437,"region":260,"url":438,"description":439,"useCases":440,"indexable":245},"EU AI Act","European Union","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj","Regulation (EU) 2024\u002F1689: risk based rules for AI systems, with obligations for high risk systems listed in Annex III and transparency duties under Article 50.",275,{"id":159,"label":442,"issuer":437,"region":260,"url":443,"description":444,"useCases":445,"indexable":245},"GDPR","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj","General Data Protection Regulation, including Article 22 on decisions based solely on automated processing.",246,{"id":162,"label":447,"issuer":448,"region":167,"url":449,"description":450,"useCases":451,"indexable":245},"ISO\u002FIEC 42001","ISO and IEC","https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F81230.html","The international management system standard for AI.",143,{"id":161,"label":453,"issuer":454,"region":290,"url":455,"description":456,"useCases":457,"indexable":245},"NIST AI Risk Management Framework","NIST","https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework","Voluntary US framework to map, measure, manage and govern AI risk, with a generative AI profile.",110,{"id":459,"label":460,"issuer":461,"region":260,"url":462,"description":463,"useCases":464,"indexable":245},"uk-gdpr","UK GDPR","Information Commissioner's Office","https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fuk-gdpr-guidance-and-resources\u002F","The UK's version of the GDPR, including rules on solely automated decisions.",81,{"id":466,"label":467,"issuer":437,"region":260,"url":468,"description":469,"useCases":470,"indexable":245},"dora","DORA","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2022\u002F2554\u002Foj","Digital Operational Resilience Act for financial entities: ICT risk, incident reporting and third party risk, including AI providers.",72,{"id":472,"label":473,"issuer":474,"region":260,"url":475,"description":476,"useCases":477,"indexable":245},"uk-consumer-duty","FCA Consumer Duty","Financial Conduct Authority","https:\u002F\u002Fwww.fca.org.uk\u002Ffirms\u002Fconsumer-duty","UK rules that require firms to deliver good outcomes for retail customers, including through automated channels.",51,{"id":479,"label":480,"issuer":481,"region":482,"url":483,"description":484,"useCases":485,"indexable":245},"mas-ai-risk-management","MAS AI risk management guidelines","Monetary Authority of Singapore","asia-pacific","https:\u002F\u002Fwww.mas.gov.sg\u002Fnews\u002Fmedia-releases\u002F2025\u002Fmas-guidelines-for-artificial-intelligence-risk-management","Singapore's supervisory expectations for AI risk management at financial institutions, building on the FEAT principles.",37,{"id":487,"label":488,"issuer":489,"region":482,"url":490,"description":491,"useCases":492,"indexable":245},"apra-cps-230","APRA CPS 230","Australian Prudential Regulation Authority","https:\u002F\u002Fwww.apra.gov.au\u002Foperational-risk-management","Australian operational risk standard covering critical operations and material service providers.",26,{"id":494,"label":495,"issuer":496,"region":290,"url":497,"description":498,"useCases":499,"indexable":245},"us-sr-11-7","SR 11-7 model risk management","Federal Reserve and OCC","https:\u002F\u002Fwww.federalreserve.gov\u002Fboarddocs\u002Fsrletters\u002F2011\u002Fsr1107.htm","US supervisory guidance on model risk management, applied by banks to AI and machine learning models.",23,{"id":160,"label":501,"issuer":437,"region":260,"url":502,"description":503,"useCases":504,"indexable":245},"NIS2 Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2022\u002F2555\u002Foj","Directive (EU) 2022\u002F2555 on cybersecurity for essential and important entities, including telecom networks, energy and public administration.",22,{"id":506,"label":507,"issuer":508,"region":167,"url":509,"description":510,"useCases":504,"indexable":245},"pci-dss","PCI DSS","PCI Security Standards Council","https:\u002F\u002Fwww.pcisecuritystandards.org\u002F","Security standard for any system that stores, processes or transmits cardholder data.",{"id":512,"label":513,"issuer":514,"region":260,"url":515,"description":516,"useCases":517,"indexable":245},"uk-atrs","UK Algorithmic Transparency Recording Standard","UK Government","https:\u002F\u002Fwww.gov.uk\u002Fgovernment\u002Fcollections\u002Falgorithmic-transparency-recording-standard-hub","Mandatory transparency records for algorithmic tools used by UK central government.",18,{"id":519,"label":520,"issuer":521,"region":290,"url":522,"description":523,"useCases":524,"indexable":245},"hipaa","HIPAA","US Department of Health and Human Services","https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Findex.html","US rules for the privacy and security of protected health information.",17,{"id":526,"label":527,"issuer":528,"region":167,"url":529,"description":530,"useCases":531,"indexable":245},"fatf-recommendations","FATF Recommendations","Financial Action Task Force","https:\u002F\u002Fwww.fatf-gafi.org\u002Fen\u002Fpublications\u002FFatfrecommendations\u002FFatf-recommendations.html","Global standards for anti money laundering and counter terrorist financing that national rules implement.",15,{"id":533,"label":534,"issuer":437,"region":260,"url":535,"description":536,"useCases":537,"indexable":245},"eu-amlr","EU Anti Money Laundering Regulation","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1624\u002Foj","Regulation (EU) 2024\u002F1624: the single EU rulebook for customer due diligence, beneficial ownership and suspicious transaction reporting.",14,{"id":539,"label":540,"issuer":541,"region":290,"url":542,"description":543,"useCases":537,"indexable":245},"us-tcpa","Telephone Consumer Protection Act","Federal Communications Commission","https:\u002F\u002Fwww.fcc.gov\u002Fconsumers\u002Fguides\u002Fstop-unwanted-robocalls-and-texts","US consent rules for automated and prerecorded calls and texts; the FCC has confirmed AI generated voices count as artificial voices.",{"id":545,"label":546,"issuer":547,"region":290,"url":548,"description":549,"useCases":550,"indexable":245},"us-bsa","Bank Secrecy Act","FinCEN","https:\u002F\u002Fwww.fincen.gov\u002Fresources\u002Fstatutes-and-regulations\u002Fbank-secrecy-act","US anti money laundering law: customer due diligence, suspicious activity reports and record keeping.",13,{"id":552,"label":553,"issuer":437,"region":260,"url":554,"description":555,"useCases":550,"indexable":245},"eu-accessibility-act","European Accessibility Act","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2019\u002F882\u002Foj","Directive (EU) 2019\u002F882: accessibility requirements for banking services, ecommerce and other digital services, applicable since June 2025.",{"id":557,"label":558,"issuer":437,"region":260,"url":559,"description":560,"useCases":550,"indexable":245},"solvency-ii","Solvency II","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2009\u002F138\u002Foj","Directive 2009\u002F138\u002FEC: risk based capital, governance and model requirements for insurers.",{"id":562,"label":563,"issuer":564,"region":290,"url":565,"description":566,"useCases":567,"indexable":245},"us-ecoa-reg-b","ECOA and Regulation B","Consumer Financial Protection Bureau","https:\u002F\u002Fwww.consumerfinance.gov\u002Frules-policy\u002Fregulations\u002F1002\u002F9\u002F","US fair lending rules, including specific reasons in adverse action notices, which also apply when credit decisions use AI models.",12,{"id":569,"label":570,"issuer":571,"region":167,"url":572,"description":573,"useCases":567,"indexable":245},"telecom-consumer-rules","Telecom consumer protection rules","National telecom regulators","https:\u002F\u002Fwww.berec.europa.eu\u002F","National rules on telecom contracts, switching, billing disputes and marketing consent.",{"id":575,"label":576,"issuer":577,"region":260,"url":578,"description":579,"useCases":580,"indexable":245},"eba-loan-origination","EBA Guidelines on loan origination and monitoring","European Banking Authority","https:\u002F\u002Fwww.eba.europa.eu\u002Fregulation-and-policy\u002Fcredit-risk\u002Fguidelines-on-loan-origination-and-monitoring","Expectations for credit decisioning, including the use of automated models.",11,{"id":582,"label":583,"issuer":437,"region":260,"url":584,"description":585,"useCases":580,"indexable":245},"eecc","European Electronic Communications Code","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2018\u002F1972\u002Foj","Directive (EU) 2018\u002F1972: consumer protection, contract, switching and security rules for telecom operators.",{"id":587,"label":588,"issuer":437,"region":260,"url":589,"description":590,"useCases":580,"indexable":245},"eu-psd2","PSD2","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2015\u002F2366\u002Foj","Payment Services Directive 2: strong customer authentication, transaction risk analysis exemptions and open banking access.",{"id":592,"label":593,"issuer":481,"region":482,"url":594,"description":595,"useCases":596,"indexable":245},"mas-notice-626","MAS Notice 626","https:\u002F\u002Fwww.mas.gov.sg\u002Fregulation\u002Fnotices\u002Fnotice-626","Singapore's anti money laundering and counter terrorism financing requirements for banks.",10,{"id":598,"label":599,"issuer":437,"region":260,"url":600,"description":601,"useCases":596,"indexable":245},"mifid-ii","MiFID II","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2014\u002F65\u002Foj","Directive 2014\u002F65\u002FEU on markets in financial instruments: suitability and appropriateness of advice, record keeping and product governance.",{"id":603,"label":604,"issuer":605,"region":290,"url":606,"description":607,"useCases":57,"indexable":245},"us-fcra","Fair Credit Reporting Act","Federal Trade Commission","https:\u002F\u002Fwww.ftc.gov\u002Flegal-library\u002Fbrowse\u002Fstatutes\u002Ffair-credit-reporting-act","US rules on consumer reports, their accuracy and permissible use, relevant to credit scoring and screening.",{"id":609,"label":610,"issuer":437,"region":260,"url":611,"description":612,"useCases":358,"indexable":245},"eu-idd","Insurance Distribution Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2016\u002F97\u002Foj","Directive (EU) 2016\u002F97: conduct rules for selling insurance, including demands and needs testing and advice.",{"id":614,"label":615,"issuer":616,"region":617,"url":618,"description":619,"useCases":620,"indexable":245},"cbuae-ai-guidance","CBUAE guidance on AI and ML","Central Bank of the UAE","middle-east","https:\u002F\u002Fwww.centralbank.ae\u002F","UAE central bank expectations for the enabling technologies, AI and machine learning used by licensed financial institutions.",5,{"id":622,"label":623,"issuer":437,"region":260,"url":624,"description":625,"useCases":626,"indexable":245},"eu-mortgage-credit-directive","EU Mortgage Credit Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2014\u002F17\u002Foj","Directive 2014\u002F17\u002FEU: creditworthiness assessment, disclosure and advice rules for residential mortgage lending.",4,{"id":628,"label":629,"issuer":630,"region":260,"url":631,"description":632,"useCases":626,"indexable":245},"pra-ss1-23","PRA SS1\u002F23 model risk management","Prudential Regulation Authority","https:\u002F\u002Fwww.bankofengland.co.uk\u002Fprudential-regulation\u002Fpublication\u002F2023\u002Fmay\u002Fmodel-risk-management-principles-for-banks-ss","UK model risk management principles for banks, covering AI and machine learning models.",{"id":634,"label":635,"issuer":636,"region":260,"url":637,"description":638,"useCases":626,"indexable":245},"uk-psr-app-reimbursement","UK APP scam reimbursement rules","Payment Systems Regulator","https:\u002F\u002Fwww.psr.org.uk\u002Four-work\u002Fapp-scams\u002F","Mandatory reimbursement of authorised push payment scam victims by UK payment firms, which shifts scam losses onto banks.",{"id":640,"label":641,"issuer":642,"region":482,"url":643,"description":644,"useCases":56,"indexable":245},"au-scams-prevention-framework","Australian Scams Prevention Framework","Australian Treasury","https:\u002F\u002Ftreasury.gov.au\u002Fconsultation\u002Fc2024-573813","Economy wide obligations for banks, telcos and digital platforms to prevent, detect, disrupt and respond to scams.",{"id":646,"label":647,"issuer":437,"region":260,"url":648,"description":649,"useCases":56,"indexable":245},"eu-mar","EU Market Abuse Regulation","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2014\u002F596\u002Foj","Regulation (EU) 596\u002F2014: insider dealing and market manipulation, including the duty to detect and report suspicious orders and transactions.",{"id":651,"label":652,"issuer":653,"region":290,"url":654,"description":655,"useCases":56,"indexable":245},"nyc-local-law-144","NYC Local Law 144","New York City","https:\u002F\u002Fwww.nyc.gov\u002Fsite\u002Fdca\u002Fabout\u002Fautomated-employment-decision-tools.page","Bias audits and notices for automated employment decision tools used in hiring and promotion in New York City.",1791904359555]