# CybORG: An Autonomous Cyber Operations Research Gym

arXiv: https://arxiv.org/abs/2002.10667 · HTML: https://mlsanity.com/paper/2002.10667/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Feb 2020.

## Built on by (most cited first, 16 of 16)

- [Deep hierarchical reinforcement agents for automated penetration testing](https://mlsanity.com/paper/2109.06449/) (2021)
- [CyGIL: A Cyber Gym for Training Autonomous Agents over Emulated Network Systems](https://mlsanity.com/paper/2109.03331/) (2021)
- [Deep Reinforcement Learning for Autonomous Cyber Defence: A Survey](https://mlsanity.com/paper/2310.07745/) (2023)
- [Network Defense is Not a Game](https://mlsanity.com/paper/2104.10262/) (2021)
- [Enabling A Network AI Gym for Autonomous Cyber Agents](https://mlsanity.com/paper/2304.01366/) (2023)
- [Interpreting Agent Behaviors in Reinforcement-Learning-Based Cyber-Battle Simulation Platforms](https://mlsanity.com/paper/2506.08192/) (2025)
- [A Comparative Evaluation of Teacher-Guided Reinforcement Learning Techniques for Autonomous Cyber Operations](https://mlsanity.com/paper/2508.14340/) (2025)
- [Countering Autonomous Cyber Threats](https://mlsanity.com/paper/2410.18312/) (2024)
- [Multi-Agent Reinforcement Learning in Cybersecurity: From Fundamentals to Applications](https://mlsanity.com/paper/2505.19837/) (2025)
- [Training RL Agents for Multi-Objective Network Defense Tasks](https://mlsanity.com/paper/2505.22531/) (2025)
- [PHASE: Passive Human Activity Simulation Evaluation](https://mlsanity.com/paper/2507.13505/) (2025)
- [OpenSec: Measuring Incident Response Agent Calibration Under Adversarial Evidence](https://mlsanity.com/paper/2601.21083/) (2026)
- [A Red Teaming Framework for Evaluating Robustness of AI-enabled Security Orchestration, Automation, and Response Systems](https://mlsanity.com/paper/2605.17075/) (2026)
- [Distilling Knowledge from Large Language Models into Lightweight Reinforcement Learning Agents for Autonomous Cyber Operations](https://mlsanity.com/paper/2607.28826/) (2026)
- [SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center](https://mlsanity.com/paper/2609.04159/) (2026)
- [No One Architecture Fits All: A Cross-Environment Evaluation of Hierarchical Red Team Agents](https://mlsanity.com/paper/2610.00557/) (2026)

## Abstract (arXiv)

Autonomous Cyber Operations (ACO) involves the consideration of blue team (defender) and red team (attacker) decision-making models in adversarial scenarios. To support the application of machine learning algorithms to solve this problem, and to encourage such practitioners to attend to problems in the ACO setting, a suitable gym (toolkit for experiments) is necessary. We introduce CybORG, a work-in-progress gym for ACO research. Driven by the need to efficiently support reinforcement learning to train adversarial decision-making models through simulation and emulation, our design differs from prior related work. Our early evaluation provides some evidence that CybORG is appropriate for our purpose and may provide a basis for advancing ACO research towards practical applications.