COHORT automates mitigation generation for network attacks via collaborative LLMs on emulated topologies with offensive replay evaluation, reporting 46.7% success rate that is 4.4 times higher than a single-agent baseline.
Richer, Junae Kim, and Damian Marriott
7 Pith papers cite this work. Polarity classification is still indexing.
7
Pith papers citing it
citation-role summary
background 2
citation-polarity summary
years
2026 7roles
background 2representative citing papers
Dynamic Cyber Ranges with LLM defender agents reduce attacker success to 0-55% and preserve evaluation headroom as models advance by using comparable capabilities on both sides.
Shield synthesis is repositioned as a design-time defensibility analysis framework for adversarial networks, generating verdicts, winning regions, and fingerprints that separate formal safety from operational behavior under adaptive play.
Introduces an evaluation framework for autonomous defense agents hardening commercial EDR, tested in a GOAD lab with Microsoft Defender XDR and two LLMs, revealing three lessons on telemetry design, per-policy attribution, and variable EDR behavior.
CT-GMARL outperforms R-MAPPO and QMIX in the new continuous-time NetForge_RL cyber-defense simulator, restoring 12x more services and transferring zero-shot to Docker exploits.
FORGE is a staged population protocol that evolves prompt-injected memory (Rules, Examples, or Mixed) for ReAct agents via reflection and broadcast, yielding 1.7-7.7× gains over zero-shot and 29-72% over Reflexion on CybORG CAGE-2.
A DRL framework maps CSF governance assessments to ATT&CK mitigations, simulates attacks via VOMM, and optimizes resource-constrained defense policies with stable, interpretable outcomes.
citing papers explorer
-
COHORT: Collaborative Orchestration for Hardening via Offensive Replay on Emulated Topologies
COHORT automates mitigation generation for network attacks via collaborative LLMs on emulated topologies with offensive replay evaluation, reporting 46.7% success rate that is 4.4 times higher than a single-agent baseline.
-
Dynamic Cyber Ranges
Dynamic Cyber Ranges with LLM defender agents reduce attacker success to 0-55% and preserve evaluation headroom as models advance by using comparable capabilities on both sides.
-
Beyond Runtime Enforcement: Shield Synthesis as Defensibility Analysis for Adversarial Networks
Shield synthesis is repositioned as a design-time defensibility analysis framework for adversarial networks, generating verdicts, winning regions, and fingerprints that separate formal safety from operational behavior under adaptive play.
-
Closing the Sim-to-Real Gap: An Evaluation Framework for Autonomous Cyber Defense Configuration of Commercial EDR
Introduces an evaluation framework for autonomous defense agents hardening commercial EDR, tested in a GOAD lab with Microsoft Defender XDR and two LLMs, revealing three lessons on telemetry design, per-policy attribution, and variable EDR behavior.
-
NetForge RL: A Multi-Agent Simulation Environment for Cyber Defense with Durative Actions
CT-GMARL outperforms R-MAPPO and QMIX in the new continuous-time NetForge_RL cyber-defense simulator, restoring 12x more services and transferring zero-shot to Docker exploits.
-
FORGE: Self-Evolving Agent Memory With No Weight Updates via Population Broadcast
FORGE is a staged population protocol that evolves prompt-injected memory (Rules, Examples, or Mixed) for ReAct agents via reflection and broadcast, yielding 1.7-7.7× gains over zero-shot and 29-72% over Reflexion on CybORG CAGE-2.
-
Operationalizing Cybersecurity Governance for Mitigation Planning with Attack-Path Modeling and Reinforcement Learning
A DRL framework maps CSF governance assessments to ATT&CK mitigations, simulates attacks via VOMM, and optimizes resource-constrained defense policies with stable, interpretable outcomes.