RFI - AI Cyber Defense for Commercial Internet.pdf

REQUEST FOR INFORMATION

U.S. Special Operations Command

AI Based Protections on Commercial Internet

27 April 2026

The United States Special Operations Command (USSOCOM), J6 is requesting information regarding AI driven cybersecurity solutions for use on its commercial internet service that can perform the following capabilities:

Real-time threat detection, behavioral analytics, automated incident response, and continuous learning are necessary to counter increasingly sophisticated threats to enhance the defensive posture of HQs USSOCOM commercial internet.

This Request for Information (RFI) is for planning purposes only and shall not be considered as an invitation for bid, request for proposal, or as an obligation on the part of the Government to acquire any products or services. Your response to this RFI will be treated as information only. No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of contractor submission of responses to this announcement of the Government use of such information. Interested parties are responsible for adequately marking proprietary or competition sensitive information contained in their response. The Government does not intend to award a contract on the basis of this RFI or to otherwise pay for the information submitted in response to this RFI.

There are no guarantees of a follow-on contract for this requirement.

The intent of the RFI is to:

1) Identify artificial intelligence (AI) driven cybersecurity solutions that meet the minimum technical requirements identified below.

The minimum technical requirements are as follows:

• On-prem or hybrid deployment model and integration with existing security stacks and tools (e.g. MDE)

• Protection of Windows, Linux, and Mac operating systems

• Policy enforcement capabilities (blocking, prompting, step-up verification, session restriction)

• Logging and auditing

• Enhanced detection for exfiltration attempts, unauthorized access, and anomalous file activity

• Zero Trust cybersecurity principles

• Real-Time Web Filtering: Ability to analyze and block access to malicious websites, including phishing sites, and malware distribution points in real-time.

• Predictive Threat Intelligence: Identify and block new and emerging (zero-day) malicious domains and URLs based on behavioral analysis, rather than relying solely on known threat feeds.

• Encrypted Traffic Analysis: Capability to inspect encrypted traffic (e.g., TLS 1.3) for threats without compromising data privacy.

• Anti-Phishing and Social Engineering Prevention: Advanced detection of sophisticated phishing, spear-phishing, and social engineering attempts by analyzing content, context, and sender behavior.

• Behavioral Baselining: Establish and dynamically update a baseline of normal behavior for each user and entity (e.g., servers, devices, applications) on the network.

• Anomaly Detection: Identify and flag statistically significant deviations from established baselines that may indicate an insider threat, compromised credentials, or account takeover. This includes detecting unusual login times/locations, abnormal data access patterns, and atypical system interactions.

• Risk Scoring: Assign risk scores to anomalous activities to help security teams prioritize alerts and focus on the most critical threats, reducing alert fatigue and false positives.

• Data Discovery and Classification: Automatically discover and classify sensitive data, such as CUI, across the domain

• Data Loss Prevention (DLP): Monitor and prevent the unauthorized exfiltration of sensitive data across various channels (e.g., email, web uploads, removable media). The system should understand the content and context of data to prevent leaks.

• AI Governance: Provide visibility and control over the use of internal and external AI tools by employees to prevent the leakage of sensitive data into generative AI platforms.

Responses to the RFI must include:

i. Indicate if purchase can be made through NASA SEWP, GSA, FedBizOpps, or on some other Government Contract or Blanket Purchase Agreement (BPA)

Responses should be no greater than a five page info paper or 15 slide PowerPoint presentation. Do not provide price quotes.

Please provide the name of the firm, address, POC, phone/fax number, and email address.

Responses will be viewed by both Government and non-Government employees. If a Non-Disclosure Agreement (NDA) is required, submit the NDA with your response.

E-mail responses only. All communication must be conducted via e-mail to Kristen.colyer@socom.mil.