{"id":"534a7cd9-6b5f-4304-b4d7-1172d38d39e4","arxiv_id":"2607.24552","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":8,"one_line_summary":"A shared-network RL simulator shows importance-based patching cuts APT goal success far more than CVSS or centrality policies under limited defender budget.","lead":"VulnGym is a simulation that pits an RL-trained APT-style attacker against a budget-limited patching defender on networks seeded with real CVEs. Experiments on two topologies and two APT profiles find that patching by asset importance beats CVSS severity and centrality, so prioritization must be context-specific.","discovery_kind":"new_method","skeptic_critique":{"model":"moonshotai/kimi-k3","headline":"The winning policy and the attacker's reward share the same \"importance\" axis (§4.2, Eq. 4), so Importance beating Severity/Centrality is substantially built into the experimental design rather than discovered by it.","rationale":"The reader's weakest_assumption identified exactly this load-bearing point, and I agree with their CONDITIONAL verdict and their reasoning. My read adds two specifics: (1) the alignment is threefold — reward, winning policy, and success metric all index the same node-importance attribute — which makes the comparison's direction near-deterministic rather than merely \"structurally favorable\"; and (2) the fix is cheap and uses the authors' own released artifacts (code, configs, notebooks are public), so the conditionality is easily dischargeable. The paper's real contribution — a configurable gym pairing an RL attacker with budget-constrained patching policies on real CVE timelines — stands independently of whether this particular comparison is confounded, which is why REJECT would be wrong: the tool's usefulness does not depend on the importance result. But the paper's stated conclusion (\"vulnerability management must be tailored to... asset criticality\") leans on Table 5, and Table 5 as constructed cannot distinguish \"importance-aware patching is better\" from \"the attacker was built to want what importance-aware patching protects.\" The ablation settles it in an afternoon of compute (training took ~4 minutes per run on an M2 Pro). Until it is run, CONDITIONAL is the right verdict; after it, the paper either gains a clean empirical claim or needs to reframe Table 5 as an illustration of the tool rather than evidence for the slogan.","tokens_in":17136,"tokens_out":1518,"duration_ms":57928,"concrete_test":"Run one ablation with the released code: retrain the APT41-layered attacker with the per-node importance term removed (set I = 1 in Eq. 4, or replace the dense reward with a sparse reward paid only on goal-achieving actions on Database nodes), keeping topology, CVEs, and hyperparameters identical. Then recompute the Table 5 row for Policy-Importance at all three effort levels. If Importance still clearly beats Severity (e.g., ≤ 40% at high effort vs 83%), the empirical ranking survives; if the gap collapses or reverses, the headline reflects reward–policy alignment rather than a property of patching policy.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The strongest empirical claim — Policy-Importance achieves 3% vs 83% (Severity) and 92% (Centrality) goal achievement for APT41-layered at high effort — rests on a comparison whose outcome is heavily predetermined. In §4.2, the attacker's reward is R = A × I, where I is node importance \"defined in terms of its proximity to sensitive assets.\" Policy-Importance (§5.2.2) ranks vulnerabilities by the average importance of affected nodes — the same attribute. The campaign goal itself (exfil/wiper/DoS on ≥3 Database nodes) is also importance-aligned, since Database nodes are the designated critical assets. So all three components — what the attacker is trained to want, what the winning defender protects, and what counts as success — live on the same axis, while the two losing baselines are defined on orthogonal axes (CVSS score, graph centrality). The RL training can only steer the attacker toward high-I nodes; it cannot discover any other preference. Section 7 acknowledges the alignment (\"the RL attacker is explicitly rewarded for targeting critical assets\") and defends it as realistic for goal-oriented APTs — which is fair as a modeling choice for the tool — but it converts the headline comparison from an empirical finding into something close to a tautology: a defender that patches exactly what this constructed attacker wants, beats defenders that patch on unrelated criteria. The genuinely open question the paper's slogan (\"tailor to context\") depends on — whether importance-based patching beats severity-based patching against an attacker whose target preferences are not defined by the importance labels — is never tested. Secondary soft spots compound this: the attacker is trained for 1,000 episodes with no defender present and then frozen against defenders that actively evict it via patching (a distribution shift favoring whichever defender happens to block its learned paths), and Table 5 reports percentages from 100 episodes with no confidence intervals (3% vs 83% is","agreement_with_reader":"agree"},"referee_report":{"model":"moonshotai/kimi-k3","summary":"The paper presents VulnGym, an open-source simulation environment in which a DQN-trained attacker, configured from CTI profiles of APT41/APT28 and restricted to their documented products/KEV exploits, acts on a shared, evolving network graph against a defender running a configurable, budget-constrained patching policy. Networks use real 2020 CVEs from the NVD mapped onto 100-node layered and tree topologies; episodes simulate one year. The authors compare three prioritization policies (CVSS severity, node importance, node centrality) at three effort levels plus a no-defender baseline, over 100 episodes per cell, using goal-achievement rate and companion metrics (NVI, TTRG, TTPV, VIB). The headline result (Table 5) is that Policy-Importance sharply suppresses goal achievement (e.g., APT41 layered, high effort: 3% vs 83% Severity and 92% Centrality), supporting the claim that prioritization must account for adversarial behavior, topology, and asset criticality rather than per-CVE scores.","tokens_in":17511,"tokens_out":2995,"duration_ms":111260,"significance":"If the results hold, the paper makes a useful dual contribution: (i) a genuinely reproducible tool — full source and experiment configs are released, the environment is Gymnasium-based, configurable, and grounded in real CVEs and real APT CTI rather than synthetic abstractions, which addresses a real gap relative to NASim and CyberBattleSim; and (ii) a quantified demonstration that campaign-level outcomes depend on defender–attacker–topology alignment, with a sensible multi-metric scorecard (NVI/TTRG/TTPV/VIB) that correctly cautions against reading backlog or patching speed as effectiveness. The tool itself is likely to be used and extended. However, the evidentiary weight of the central comparative claim (Importance ≫ Severity/Centrality) is currently weakened by an alignment between the attacker's training objective and the winning policy, and by the absence of uncertainty quantification on the headline percentages.","major_comments":[{"comment":"The headline comparison is partially built into the experimental design. The attacker reward is R = A × I, where I is node importance 'defined in terms of proximity to sensitive assets'; Policy-Importance (§5.2.2) ranks vulnerabilities by average importance of affected nodes — the same attribute; and the campaign goal (§5.2.1: exfil/wiper/DoS on ≥3 Database nodes) targets the same designated critical assets. The two losing baselines are defined on orthogonal axes (CVSS, centrality). The RL training can only steer the attacker toward high-I nodes, so Table 5's 3% vs 83%/92% gap is to a substantial degree expected by construction rather than discovered. §7 acknowledges the alignment and defends it as realistic for goal-oriented APTs — defensible for the tool, but the paper's slogan-level claim ('tailor to context') needs evidence that is not tautological. A fix within scope: add at least o","section":"§4.2 (Eq. 4), §5.2.1–5.2.2, Table 5"},{"comment":"The attacker is trained for 1,000 episodes 'in a standalone setting (i.e., without a defender)' and then frozen and evaluated against active defenders. Two consequences are load-bearing: (i) the None row of Table 5 (100% goal achievement everywhere) essentially reports performance in the training condition and is not an informative baseline; (ii) the paper's framing of evaluating policies 'against a realistic adversary' implicitly assumes the adversary adapts to the defense, but the measured attacker never encounters patching during learning — a real APT facing heavy Database-zone patching would reroute. At minimum, the paper should train (or fine-tune) the attacker in the presence of each defender policy for at least one configuration, or soften claims of adversarial realism accordingly. Relatedly, only one training run per APT–topology pair is reported; with 4-minute training runs, rep","section":"§5.2.1 (training protocol), Table 5 'None' row"},{"comment":"The paper states each cell was run over 100 episodes 'to ensure statistical significance,' but no confidence intervals, standard errors, or significance tests appear anywhere in Tables 5–9, and the text occasionally interprets small differences (e.g., Table 5 APT28 Low: 98 vs 99; NVI differences of 1–2 points). For a proportion with n=100, the 95% Wilson interval around 83% is roughly ±7.5 points, and around 3% is roughly [1%, 8.5%]; the headline Importance-vs-baselines gaps survive this, but several secondary comparisons and the effort-level monotonicity claims (e.g., APT28 Tree: 98/93/57) need CIs to be interpretable. Adding Wilson intervals to Table 5 and standard errors to Tables 6–9 is a small change that materially strengthens the paper.","section":"§6, Tables 5–9"},{"comment":"The conclusion that 'vulnerability management must be tailored to organizational context, adversarial behavior, network topology, and asset criticality' is broader than what is varied. Only one importance assignment (Database = critical), one CVE year (2020), one success threshold (≥3 nodes), one vulnerability cap (10/node), and one stratified subsample of 4,137 CVEs are used; two topologies differ only in structure. The APT41-vs-APT28 contrast is also confounded with campaign type (exfil/wiper vs DoS), so the topology/adversary conclusions rest on thin variation. Either add a small sensitivity sweep (importance assignment, success threshold, CVE year, subsample seed) or scope the claims in §6/§8 to the configurations actually tested. The free parameters in Eq. 5 (α, β, γ, κ) are also fixed at single values; a brief statement of how results shift under plausible alternatives would addres","section":"§5.1, §6, §8"}],"minor_comments":[{"comment":"Table 9, APT41 Tree / Centrality: VIB is 15 (Low), 12 (Regular), but 13 (High) — non-monotonic in effort, contradicting the §6 statement that backlog decreases with effort. Likely a transcription error; please check. Similarly Severity/APT28: 17/11/6 layered vs 16/12/5 tree — the '3' in the Severity/APT28/Regular/Layered cell looks like an outlier worth verifying.","section":"Table 9"},{"comment":"§4.2, PERSISTENCE post-condition: if the defender patches a node where persistence was established, 'the attacker still retains access' — it is unclear whether the node's vulnerability is removed (blocking re-compromise of other nodes via that CVE) and whether the retained access persists indefinitely. This rule is load-bearing for TTRG and should be stated precisely.","section":"§4.2, Table 3"},{"comment":"The number of nodes in the Database zone is never given, which matters for interpreting the '≥3 database nodes' success threshold (§5.2.1) — if the zone has only 3–4 nodes the threshold is near-total compromise; if 20, it is a light footprint. Please report per-zone node counts for both topologies.","section":"§5.1, §5.2.1"},{"comment":"Table 5 (None row) and Table 6 (None row) reveal an inconsistency worth explaining: with no defender, NVI is only 22–39% even though goal achievement is 100%. Presumably the attacker stops acting after reaching the goal; stating episode termination conditions explicitly would prevent misreading.","section":"§6, Tables 5–6"},{"comment":"Conclusion, first paragraph: 'Our experiments show highlight the need' — grammatical error. Also Eq. (5) is referenced in §5.2.2 before the factor definitions are restated; consider forward-referencing the parameter values into a small table for readability.","section":"§8 (typo), §5.2.2"},{"comment":"Figure 6 heatmaps are described qualitatively ('node 68 emerges as a key pivot'); please state in the caption which scenario/effort level each panel corresponds to and the color scale, and consider marking zone boundaries, since the layered structure is central to the interpretation.","section":"Figure 6"},{"comment":"Related work omits EPSS/SSVC-based prioritization as evaluated baselines even though §2.1 motivates them; a sentence in §5.2.2 explaining why only CVSS/importance/centrality were chosen (e.g., EPSS scores unavailable retroactively for 2020 CVEs) would preempt an obvious question.","section":"§3, §5.2.2"}],"recommendation":"major_revision","confidential_remarks":"The tool contribution is solid and the release of code/configs is commendable; positioning against NASim/CyberBattleSim is fair. The concern I would flag privately is that the headline empirical result (Table 5) currently functions more as a demonstration that matching the defender's priority axis to the attacker's reward axis works — which is close to definitional — than as evidence about real-world prioritization. The decoupling experiment requested in major comment 1 is inexpensive given the released artifact (12-minute runs) and would determine whether the paper's central claim is empirical or definitional; I would want to see it before acceptance. This is fixable within the manuscript's scope, hence major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The thing worth knowing is that VulnGym is a real, shipped integration: real 2020 NVD CVEs on 100-node layered/tree topologies, a multi-phase budgeted patcher, and DQN attackers calibrated to APT41/APT28 product and KEV profiles, all on one evolving Gymnasium graph. Prior pieces (CyberBattleSim, NASim extensions, VULCON, MulVAL) each miss at least one of those. Code is promised; that alone makes it useful for people who actually have to order patches.\n\nWhat they do well is the evaluation surface. Tables 5–9 are consistent across two APTs, two topologies, and three effort levels: Importance cuts goal achievement hard (APT41 layered high-effort 3% vs 83%/92% for Severity/Centrality; none-defender 100%), stretches TTRG, and the secondary metrics (NVI, TTPV, VIB) behave sensibly. Heatmaps make the path-vs-asset story concrete. The cost model (α·β·γ·δ) is simple enough that an analyst can retune it from their own ticket data. Section 7 is unusually honest about the modeling choices.\n\nThe soft spot the stress-test flags is real and load-bearing for the slogan, not fatal for the tool. Attacker reward is R=A×I with I = proximity to sensitive assets; Policy-Importance ranks by the same I; campaign success is ≥3 Database nodes. So Importance beating orthogonal baselines (CVSS, centrality) is partly by construction. Training the attacker for 1k episodes with no defender, then freezing it against active patchers, adds a distribution shift. No CIs on the percentages. None of that makes the gym useless; it means the “must tailor to context” claim is demonstrated inside a gym whose attacker was told to care about the same labels the winning policy protects. An ablation that removes I from the reward, or holds out importance labels, would turn the comparison into a real finding.\n\nWho it is for: vulnerability-management and red-team researchers who want a configurable testbed, and practitioners who can drop their own topology/CVE/APT profile in. Math is standard DQN; citations are fair; free parameters are numerous but documented.\n\nI would send it to referees. Ask for the importance ablation, error bars, and the CVE sample identifiers. Accept as a methods/tool paper once those are addressed. I would bring it to reading group and I would cite the tool.","headline":"Useful open gym that finally puts real CVEs and a budgeted defender opposite an APT-style RL attacker; the headline Importance≫Severity result is partly baked into the shared importance axis, but the tool itself is still worth engaging.","tokens_in":18429,"tokens_out":617,"would_cite":true,"duration_ms":11665,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"Patching by asset importance beats CVSS severity when an APT is actually moving through the network.","keywords":["vulnerability management","Advanced Persistent Threats","reinforcement learning","patch prioritization","CVSS","network attack simulation","CVE","asset criticality"],"falsifier":"Retrain the attacker with a reward that does not encode node importance (or train it online against each defender policy), then re-run the APT41 layered high-effort comparison: if Importance no longer drives goal achievement near zero while Severity and Centrality stay high, the central claim fails.","tokens_in":18027,"feed_emoji":"🛡️","tokens_out":892,"duration_ms":18890,"temperature":0.7,"pith_summary":"Organizations cannot patch everything, so they rank vulnerabilities—usually by individual severity scores like CVSS. That ranking ignores how a real attacker chains exploits, steals credentials, and walks the network over time. VulnGym is a simulator that pits a reinforcement-learning attacker, tuned to real APT profiles and real CVEs, against a defender who must patch under a limited budget on a shared, evolving network. On 100-node enterprise topologies with 2020 NVD vulnerabilities, a policy that prioritizes critical assets cuts attacker success far more than severity- or centrality-based ranking—especially against a multi-step exfiltration campaign. The paper’s point is practical: vulnerability management only works when it is matched to the adversary’s goal, the network shape, and which assets actually matter.","feed_headline":"Asset-first patching stops APTs better than CVSS scores","feed_subtitle":"A shared simulator with real CVEs and RL attackers shows context beats individual severity rankings.","key_machinery":"VulnGym: a shared graph environment where a DQN attacker (actions aligned with kill-chain / ATT&CK tactics, reward R = action importance × node importance) and a budget-constrained defender (weekly discovery plus sequential remediation ordered by a chosen policy) co-evolve the same network of real CVEs over simulated time.","core_discovery":"When an RL attacker calibrated to real APT behavior (APT41 exfiltration/wiper, APT28 DoS) runs against configurable patching policies on networks seeded with real CVEs, prioritizing by asset importance suppresses campaign goal achievement much more effectively than CVSS severity or graph centrality—under the same patching budget—so vulnerability management must be tailored to adversarial behavior, topology, and asset criticality rather than individual vulnerability scores.","pith_inferences":["If attacker training were adversarial (online against the defender), Severity might close some of the gap—or Importance might still win, which would strengthen the paper’s practical advice.","The heatmap finding that phishing-origin attacks make external-layer severity focus less useful suggests combining Importance with initial-access vector assumptions in the priority queue.","Extending the defender with SOC detection or moving-target agents, as the paper sketches, would let organizations test whether faster detection can substitute for perfect prioritization under low patch budget."],"forward_implications":["CVSS-only queues can leave database and pivot nodes under-patched even when the backlog is short and mean time-to-patch looks healthy.","Defenders should score policies by attacker goal achievement and time-to-goal under realistic APT profiles, not only by backlog length or nodes cleaned.","The same budget and policy can look strong against a multi-step exfiltration campaign and weak against a simpler DoS goal on the same topology.","Analysts can plug their own CMDB topology, product inventory, and CTI-derived APT product lists into the simulator before committing to a prioritization rule.","As automated vulnerability discovery increases volume, context-aware prioritization becomes more necessary, not less."],"fun_headline_variants":["Asset priority beats CVSS against RL-calibrated APTs","VulnGym: asset-first patching curbs real CVE APT campaigns","Context-aware patching outperforms severity scores on APTs","Asset criticality tops CVSS when stopping APT29-style goals","Tailor patches to topology and assets, not just CVSS ranks"],"cache_read_input_tokens":128,"weakest_assumption_plain":"Training the attacker without a defender and rewarding it with the same notion of node importance that the best defender policy later uses does not bake in the result that importance-based patching wins.","fun_headline_variants_meta":{"raw":{"variants":["Asset priority beats CVSS against RL-calibrated APTs","VulnGym: asset-first patching curbs real CVE APT campaigns","Context-aware patching outperforms severity scores on APTs","Asset criticality tops CVSS when stopping APT29-style goals","Tailor patches to topology and assets, not just CVSS ranks"]},"model":"grok-4.5","effort":"low","cost_usd":0.003633,"raw_usage":{"total_tokens":1202,"prompt_tokens":786,"num_sources_used":0,"completion_tokens":93,"cost_in_usd_ticks":36328000,"prompt_tokens_details":{"text_tokens":786,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":323,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":786,"tokens_out":93,"duration_ms":5360,"temperature":1.0,"reasoning_tokens":323,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-31T11:48:38.184725+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Retrain the attacker with a reward that does not encode node importance (or train it online against each defender policy), then re-run the APT41 layered high-effort comparison: if Importance no longer drives goal achievement near zero while Severity and Centrality stay high, the central claim fails.","supporting_citations":[],"review_version":1}