Normshield, Inc. d/b/a Black Kite Inc. v. BitSight Technologies, Inc.

Petition

Petition summary

## 1. Case Identification
- Case Number: [IPR2025-00276](https://ai-lab.exparte.com/case/ptab/IPR2025-00276)
- Patent #: [11,777,976](https://ai-lab.exparte.com/patent/11777976)
- Filed: December 10, 2024
- Petitioner(s): [Normshield Inc.](https://ai-lab.exparte.com/party/normshield-inc) d/b/a Black Kite Inc.
- Patent Owner(s): [BitSight Technologies, Inc.](https://ai-lab.exparte.com/party/bitsight-technologies-inc)
- Challenged Claims: 1-16

## 2. Patent Overview
- Title: Method and System for Determining a Security Rating of an Entity
- Brief Description: The [’976](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1001) patent discloses a method for determining a composite security rating for an entity by gathering both internal and external security data, generating separate internal and external security ratings from that data, and then combining those ratings.

## 3. Grounds for Unpatentability
#### Ground 1: Obviousness over Tippett - Claims 1-2, 4-10, and 12-16 are obvious over U.S. Patent Application Publication No. 2005/0278786 (“Tippett”).
  - **Prior Art Relied Upon:** [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006) ([’786](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006) application).
  - **Core Argument for this Ground:**
    - **Prior Art Mapping:** Petitioner argued that [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006) discloses all limitations of the challenged claims. [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006) teaches a system for determining a "security risk index" for an entity, which is analogous to the claimed "security rating." This index is calculated by combining multiple factors, including a "local vulnerability factor" derived from internal data and a "general threat factor" derived from external data.
      - Petitioner asserted that [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006)’s "local vulnerability factor" is equivalent to the claimed "internal security rating." It is generated from "internal factor component[s]" such as mitigating security measures and past security breaches, which are data indicative of internal security obtained from internal data sources.
      - Similarly, Petitioner contended that [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006)’s "general threat factor" is the claimed "external security rating." It is generated from data about security events discovered in external sources like chat rooms and message boards.
      - Petitioner mapped [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006)’s disclosure of extracting, weighting (a transformation function), and combining these factors to the corresponding steps in independent claims 1 and 9. For example, [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006) discloses weighting "local vulnerability factor components" and combining them to generate the overall "local vulnerability factor."
      - The final limitation of providing a composite rating associated with a malicious IP address was argued to be met by [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006)’s disclosure of using a "past history of at least one type of security breach" on the entity's network. Petitioner asserted that a person of ordinary skill in the art (POSITA) would understand a network security breach to inherently be malicious activity associated with an IP address on the entity's network.
    - **Motivation to Combine (for §103 grounds):** The motivation to combine the various elements is found entirely within [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006), which explicitly teaches generating a composite risk index from both internal and external factors. Petitioner argued that it would have been an obvious design choice for a POSITA to store sensitive internal data (like security breach history) within the entity's own internal databases for control and confidentiality, as taught by [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006)'s disclosure of an entity having "one or more databases."
    - **Expectation of Success (for §103 grounds):** A POSITA would have had a reasonable expectation of success because [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006) itself describes a complete system for combining these factors, and using conventional databases to store information was well within the skill of an ordinary artisan.

#### Ground 2: Obviousness over Tippett and McGovern - Claims 3 and 11 are obvious over Tippett in view of U.S. Patent Application Publication No. 2009/0024663 (“McGovern”).
  - **Prior Art Relied Upon:** [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006) ([’786](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006) application), [McGovern](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1007) ([’663](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1007) application).
  - **Core Argument for this Ground:**
    - **Prior Art Mapping:** Claims 3 and 11 depend from claims 1 and 9, respectively, and add a specific list of "internal data sources" (e.g., vulnerability scan data, firewall rules, software inventory). While [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006) teaches using internal data, it does not expressly list all these specific sources. Petitioner argued that [McGovern](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1007), which teaches a method for information security assessment, explicitly discloses collecting and using these exact types of data. [McGovern](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1007) describes using "vulnerability management" tools for "security scanning," collecting data on "firewalls" and "access policies," using information about "hardware and software configuration," and monitoring user login behavior.
    - **Motivation to Combine (for §103 grounds):** Petitioner argued that a POSITA, seeking to implement [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006)’s system, would have been motivated to incorporate the well-known and specific data sources described in [McGovern](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1007) to improve the accuracy and comprehensiveness of [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006)'s "local vulnerability factor." Since [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006) broadly teaches using information "related to the local vulnerability of the information resources," a POSITA would have naturally looked to conventional data sources, like those in [McGovern](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1007), to give effect to this teaching. Both references are analogous art focused on network security assessment.
    - **Expectation of Success (for §103 grounds):** A POSITA would have had a high expectation of success in this combination. [McGovern](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1007) describes these data sources as fundamental to security assessments, and integrating these standard data types into [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006)’s more general framework would have been a routine task. [McGovern](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1007)’s teachings on quantifying security parameters would be directly compatible with [Tippett](https://ai-lab.exparte.com/case/ptab/IPR2025-00276/doc/1006)’s system of weighting and combining factors into a final risk index.

## 7. Relief Requested
- Petitioner requests institution of an inter partes review and cancellation of claims 1-16 of Patent [11,777,976](https://ai-lab.exparte.com/patent/11777976) as unpatentable under 35 U.S.C. §103.

Entity security rating patent challenged: Tippett & McGovern prior art supports obviousness of all 16 claims for combining internal/external data.