mlsanityData to 14 Oct 2026

A Cyber Range Evaluation of Autonomous Network Incident Response Agents

arXiv 2609.16541 ↗First posted 15 Sep 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

We test the performance of agents for automated network intrusion response in a cyber range intended for human operator training. The range implements an emulated networking environment with a variable network topology, red-team emulation and simulated user agents. The goal of the defensive agents is to prevent hosts in the network from being accessed by the red-team agent, while minimizing the availability costs induced from defensive measures. Alerts are generated using a SIEM platform and mapped to a data modeling language used by the agents. We test a combination of heuristic agents and policies learned using reinforcement learning. The learned policies are optimized to minimize the combined cost using a cyber attack simulator modeling the network. We found that the reinforcement learning agents were overall more efficient at defending the system than the heuristic policy, and that the performance depends highly on the policy of the adversary in combination with the simulated users.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 16 of its 52 references that are in the map. First posted on arXiv 15 Sep 2026.

Builds on

16 of 52 references.

References · 16

  1. 2021A Survey of Zero-shot Generalisation in Deep Reinforcement Learningcited by 170
  2. 2020Dos and Don'ts of Machine Learning in Computer Securitycited by 102
  3. 2022Developing Optimal Causal Cyber-Defence Agents via Cyber Security Simulationcited by 37
  4. 2020Finding Effective Security Strategies through Reinforcement Learning and Self-Playcited by 32
  5. 2022Beyond CAGE: Investigating Generalization of Learned Autonomous Network Defense Policiescited by 23
  6. 2024Overcoming the Sim-to-Real Gap: Leveraging Simulation to Learn to Explore for Real-World RLcited by 21
  7. 2024CybORG++: An Enhanced Gym for the Development of Autonomous Cyber Agentscited by 11
  8. 2023Scalable Learning of Intrusion Responses through Recursive Decompositioncited by 8
  9. 2024Structural Generalization in Autonomous Cyber Incident Response with Message-Passing Neural Networks and Reinforcement Learningcited by 7
  10. 2023In Search of netUnicorn: A Data-Collection Platform to Develop Generalizable ML Models for Network Security Problemscited by 6
  11. 2026CSLE: A Reinforcement Learning Platform for Autonomous Security Managementcited by 5
  12. 2026DeepStage: Learning Autonomous Defense Policies Against Multi-Stage APT Campaignscited by 3
4 more
  1. 2026Building Better Environments for Autonomous Cyber Defencecited by 3
  2. 2024Red Team Redemption: A Structured Comparison of Open-Source Tools for Adversary Emulationcited by 2
  3. 2025Vejde: A Framework for Inductive Deep Reinforcement Learning Based on Factor Graph Color Refinementcited by 2
  4. 2020Evaluation of vulnerability reproducibility in container-based Cyber Rangecited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Autonomous Network Defence using Reinforcement Learning
  2. 2026In-Context Autonomous Network Incident Response: An End-to-End Large Language Model Agent Approach
  3. 2026Distilling Knowledge from Large Language Models into Lightweight Reinforcement Learning Agents for Autonomous Cyber Operations
  4. 2024Hierarchical Multi-agent Reinforcement Learning for Cyber Network Defense
  5. 2026Learning Communication Between Heterogeneous Agents in Multi-Agent Reinforcement Learning for Autonomous Cyber Defence
  6. 2026No One Architecture Fits All: A Cross-Environment Evaluation of Hierarchical Red Team Agents
  7. 2024Exploring reinforcement learning for incident response in autonomous military vehicles
  8. 2025Towards Production-Worthy Simulation for Autonomous Cyber Operations