Pith. sign in

REVIEW 4 major objections 7 minor 69 references

VulnGym: Evaluating Vulnerability Management Strategies against Advanced Persistent Threats

T0 review · 4 major / 7 minor · reviewed 2026-07-31 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Patching by asset importance beats CVSS severity when an APT is actually moving through the network.

desk verdict Useful open gym that finally puts real CVEs and a budgeted defender opposite an APT-style RL attacker; the headline Importance≫Severity result is partly baked into the shared importance axis, but the tool itself is still worth engaging. read the letter →

arxiv 2607.24552 v1 pith:VDEQAKDZ submitted 2026-07-27 cs.CR

Sofia Della Penna , Lorenzo Parracino , Luciano Pianese , Vittorio Orbinato , Roberto Natella This is my paper
classification cs.CR
keywords vulnerabilitymanagementAdvancedPersistentThreatsreinforcementlearningpatchprioritizationCVSSnetworkattacksimulationCVEassetcriticality
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Organizations cannot patch everything, so they rank vulnerabilities—usually by individual severity scores like CVSS. That ranking ignores how a real attacker chains exploits, steals credentials, and walks the network over time. VulnGym is a simulator that pits a reinforcement-learning attacker, tuned to real APT profiles and real CVEs, against a defender who must patch under a limited budget on a shared, evolving network. On 100-node enterprise topologies with 2020 NVD vulnerabilities, a policy that prioritizes critical assets cuts attacker success far more than severity- or centrality-based ranking—especially against a multi-step exfiltration campaign. The paper’s point is practical: vulnerability management only works when it is matched to the adversary’s goal, the network shape, and which assets actually matter.

What carries the argument

VulnGym: a shared graph environment where a DQN attacker (actions aligned with kill-chain / ATT&CK tactics, reward R = action importance × node importance) and a budget-constrained defender (weekly discovery plus sequential remediation ordered by a chosen policy) co-evolve the same network of real CVEs over simulated time.

What would settle it

Retrain the attacker with a reward that does not encode node importance (or train it online against each defender policy), then re-run the APT41 layered high-effort comparison: if Importance no longer drives goal achievement near zero while Severity and Centrality stay high, the central claim fails.

Watch

Extended reading notes

Core claim

When an RL attacker calibrated to real APT behavior (APT41 exfiltration/wiper, APT28 DoS) runs against configurable patching policies on networks seeded with real CVEs, prioritizing by asset importance suppresses campaign goal achievement much more effectively than CVSS severity or graph centrality—under the same patching budget—so vulnerability management must be tailored to adversarial behavior, topology, and asset criticality rather than individual vulnerability scores.

Load-bearing premise

Training the attacker without a defender and rewarding it with the same notion of node importance that the best defender policy later uses does not bake in the result that importance-based patching wins.

Editorial extensions

If this is right

  • CVSS-only queues can leave database and pivot nodes under-patched even when the backlog is short and mean time-to-patch looks healthy.
  • Defenders should score policies by attacker goal achievement and time-to-goal under realistic APT profiles, not only by backlog length or nodes cleaned.
  • The same budget and policy can look strong against a multi-step exfiltration campaign and weak against a simpler DoS goal on the same topology.
  • Analysts can plug their own CMDB topology, product inventory, and CTI-derived APT product lists into the simulator before committing to a prioritization rule.
  • As automated vulnerability discovery increases volume, context-aware prioritization becomes more necessary, not less.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If attacker training were adversarial (online against the defender), Severity might close some of the gap—or Importance might still win, which would strengthen the paper’s practical advice.
  • The heatmap finding that phishing-origin attacks make external-layer severity focus less useful suggests combining Importance with initial-access vector assumptions in the priority queue.
  • Extending the defender with SOC detection or moving-target agents, as the paper sketches, would let organizations test whether faster detection can substitute for perfect prioritization under low patch budget.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper presents VulnGym, an open-source simulation environment in which a DQN-trained attacker, configured from CTI profiles of APT41/APT28 and restricted to their documented products/KEV exploits, acts on a shared, evolving network graph against a defender running a configurable, budget-constrained patching policy. Networks use real 2020 CVEs from the NVD mapped onto 100-node layered and tree topologies; episodes simulate one year. The authors compare three prioritization policies (CVSS severity, node importance, node centrality) at three effort levels plus a no-defender baseline, over 100 episodes per cell, using goal-achievement rate and companion metrics (NVI, TTRG, TTPV, VIB). The headline result (Table 5) is that Policy-Importance sharply suppresses goal achievement (e.g., APT41 layered, high effort: 3% vs 83% Severity and 92% Centrality), supporting the claim that prioritization must account for adversarial behavior, topology, and asset criticality rather than per-CVE scores.

Significance. If the results hold, the paper makes a useful dual contribution: (i) a genuinely reproducible tool — full source and experiment configs are released, the environment is Gymnasium-based, configurable, and grounded in real CVEs and real APT CTI rather than synthetic abstractions, which addresses a real gap relative to NASim and CyberBattleSim; and (ii) a quantified demonstration that campaign-level outcomes depend on defender–attacker–topology alignment, with a sensible multi-metric scorecard (NVI/TTRG/TTPV/VIB) that correctly cautions against reading backlog or patching speed as effectiveness. The tool itself is likely to be used and extended. However, the evidentiary weight of the central comparative claim (Importance ≫ Severity/Centrality) is currently weakened by an alignment between the attacker's training objective and the winning policy, and by the absence of uncertainty quantification on the headline percentages.

major comments (4)
  1. [§4.2 (Eq. 4), §5.2.1–5.2.2, Table 5] The headline comparison is partially built into the experimental design. The attacker reward is R = A × I, where I is node importance 'defined in terms of proximity to sensitive assets'; Policy-Importance (§5.2.2) ranks vulnerabilities by average importance of affected nodes — the same attribute; and the campaign goal (§5.2.1: exfil/wiper/DoS on ≥3 Database nodes) targets the same designated critical assets. The two losing baselines are defined on orthogonal axes (CVSS, centrality). The RL training can only steer the attacker toward high-I nodes, so Table 5's 3% vs 83%/92% gap is to a substantial degree expected by construction rather than discovered. §7 acknowledges the alignment and defends it as realistic for goal-oriented APTs — defensible for the tool, but the paper's slogan-level claim ('tailor to context') needs evidence that is not tautological. A fix within scope: add at least o
  2. [§5.2.1 (training protocol), Table 5 'None' row] The attacker is trained for 1,000 episodes 'in a standalone setting (i.e., without a defender)' and then frozen and evaluated against active defenders. Two consequences are load-bearing: (i) the None row of Table 5 (100% goal achievement everywhere) essentially reports performance in the training condition and is not an informative baseline; (ii) the paper's framing of evaluating policies 'against a realistic adversary' implicitly assumes the adversary adapts to the defense, but the measured attacker never encounters patching during learning — a real APT facing heavy Database-zone patching would reroute. At minimum, the paper should train (or fine-tune) the attacker in the presence of each defender policy for at least one configuration, or soften claims of adversarial realism accordingly. Relatedly, only one training run per APT–topology pair is reported; with 4-minute training runs, rep
  3. [§6, Tables 5–9] The paper states each cell was run over 100 episodes 'to ensure statistical significance,' but no confidence intervals, standard errors, or significance tests appear anywhere in Tables 5–9, and the text occasionally interprets small differences (e.g., Table 5 APT28 Low: 98 vs 99; NVI differences of 1–2 points). For a proportion with n=100, the 95% Wilson interval around 83% is roughly ±7.5 points, and around 3% is roughly [1%, 8.5%]; the headline Importance-vs-baselines gaps survive this, but several secondary comparisons and the effort-level monotonicity claims (e.g., APT28 Tree: 98/93/57) need CIs to be interpretable. Adding Wilson intervals to Table 5 and standard errors to Tables 6–9 is a small change that materially strengthens the paper.
  4. [§5.1, §6, §8] The conclusion that 'vulnerability management must be tailored to organizational context, adversarial behavior, network topology, and asset criticality' is broader than what is varied. Only one importance assignment (Database = critical), one CVE year (2020), one success threshold (≥3 nodes), one vulnerability cap (10/node), and one stratified subsample of 4,137 CVEs are used; two topologies differ only in structure. The APT41-vs-APT28 contrast is also confounded with campaign type (exfil/wiper vs DoS), so the topology/adversary conclusions rest on thin variation. Either add a small sensitivity sweep (importance assignment, success threshold, CVE year, subsample seed) or scope the claims in §6/§8 to the configurations actually tested. The free parameters in Eq. 5 (α, β, γ, κ) are also fixed at single values; a brief statement of how results shift under plausible alternatives would addres
minor comments (7)
  1. [Table 9] Table 9, APT41 Tree / Centrality: VIB is 15 (Low), 12 (Regular), but 13 (High) — non-monotonic in effort, contradicting the §6 statement that backlog decreases with effort. Likely a transcription error; please check. Similarly Severity/APT28: 17/11/6 layered vs 16/12/5 tree — the '3' in the Severity/APT28/Regular/Layered cell looks like an outlier worth verifying.
  2. [§4.2, Table 3] §4.2, PERSISTENCE post-condition: if the defender patches a node where persistence was established, 'the attacker still retains access' — it is unclear whether the node's vulnerability is removed (blocking re-compromise of other nodes via that CVE) and whether the retained access persists indefinitely. This rule is load-bearing for TTRG and should be stated precisely.
  3. [§5.1, §5.2.1] The number of nodes in the Database zone is never given, which matters for interpreting the '≥3 database nodes' success threshold (§5.2.1) — if the zone has only 3–4 nodes the threshold is near-total compromise; if 20, it is a light footprint. Please report per-zone node counts for both topologies.
  4. [§6, Tables 5–6] Table 5 (None row) and Table 6 (None row) reveal an inconsistency worth explaining: with no defender, NVI is only 22–39% even though goal achievement is 100%. Presumably the attacker stops acting after reaching the goal; stating episode termination conditions explicitly would prevent misreading.
  5. [§8 (typo), §5.2.2] Conclusion, first paragraph: 'Our experiments show highlight the need' — grammatical error. Also Eq. (5) is referenced in §5.2.2 before the factor definitions are restated; consider forward-referencing the parameter values into a small table for readability.
  6. [Figure 6] Figure 6 heatmaps are described qualitatively ('node 68 emerges as a key pivot'); please state in the caption which scenario/effort level each panel corresponds to and the color scale, and consider marking zone boundaries, since the layered structure is central to the interpretation.
  7. [§3, §5.2.2] Related work omits EPSS/SSVC-based prioritization as evaluated baselines even though §2.1 motivates them; a sentence in §5.2.2 explaining why only CVSS/importance/centrality were chosen (e.g., EPSS scores unavailable retroactively for 2020 CVEs) would preempt an obvious question.

Circularity Check

2 steps flagged · score 5.0 of 10

Policy-Importance’s win is substantially built into a shared importance axis: attacker reward R=A×I, defender ranking by I, and goals on Database nodes all use the same attribute.

  1. self definitional [§4.2 Eq. 4; §5.2.2 Policy-Importance; §6 Table 5]
    "The reward is defined as: R=A×I (4) ... I denotes the importance of the node, defined in terms of its proximity to sensitive assets, with higher values assigned to nodes closer to critical resources. ... Policy-Importance ranks vulnerabilities according to the average importance of the nodes they affect, prioritizing those impacting more critical assets. ... Policy-Importance provides the strongest mitigation effect. This is particularly evident for APT41 in the Layered topology, where increasing defender effort leads to a near-complete suppression of attacker success."

    Attacker training objective, winning defender policy, and success metric all optimize the same node-importance attribute I. The headline ranking Importance ≫ Severity/Centrality is largely predetermined by that shared axis: RL can only steer the attacker toward high-I nodes, and Importance is defined to patch exactly those nodes first, while baselines use orthogonal criteria (CVSS, centrality). The ‘finding’ that asset criticality must guide VM is partly the experimental setup restated as a result.

  2. self definitional [§5.2.1 campaign success; §7 Threats to validity]
    "In these experiments, we define campaign success as Exfiltration/Wiper or DoS on at least three database nodes, to represent multi-node impact on critical assets. ... A direct consequence of this modelling choice is that the RL attacker is explicitly rewarded for targeting critical assets. While our abstraction might not capture every possible real-world attack or defense vector, we preserved this alignment because it realistically reflects goal-oriented APTs targeting an organization's pivotal assets."

    Goal achievement is defined on Database nodes—the same critical assets that define I in the reward and that Policy-Importance prioritizes. Section 7 concedes the attacker is ‘explicitly rewarded for targeting critical assets,’ so outperformance of Importance over policies not aligned to that goal is expected by the joint definition of reward, policy, and metric, not an independent discovery about real APT path preferences beyond the authors’ I encoding.

full rationale

VulnGym is an empirical simulation paper, not a first-principles derivation, so classical math-style circularity is limited. The load-bearing experimental claim—that Policy-Importance strongly outperforms Severity and Centrality (e.g., APT41 layered high effort: 3% vs 83% vs 92% goal achievement)—is nonetheless partly forced by construction. Section 4.2 defines the attacker reward as R=A×I with I = node importance (proximity to sensitive assets); §5.2.2 defines Policy-Importance as ranking by average importance of affected nodes; and campaign success is hitting ≥3 Database nodes (the designated critical assets). The RL attacker is trained without a defender and can only learn preferences along this I-axis. Section 7 explicitly acknowledges the alignment. Severity/Centrality losing is therefore expected from objective mismatch, not solely discovered against external ground truth. This is partial, not total, circularity: magnitudes, effort gradients, APT28’s residual success, topology differences, and the practical failure of CVSS remain empirical content. Score 5 reflects one central by-construction alignment without collapsing the whole evaluation.

Assumptions & free parameters 8 free parameters · 6 assumptions · 2 invented entities

The central ranking of policies rests on a constructed multi-agent environment: DQN attacker with hand-shaped rewards, APT product/KEV filters from CTI-HAL, synthetic layered/tree graphs, a multiplicative patch-time model, and three priority rules. None of these are derived from first principles; they are modeling choices whose outputs are then interpreted as guidance for real vulnerability management.

free parameters (8)
  • baseline patch time α = 1 day
    Set to 1 day by authors; scales all T_fix values.
  • defender effort factor β = 0.5 / 1.0 / 1.5
    Discrete Low/Regular/High mapped to 1.5/1.0/0.5; drives backlog and TTPV.
  • OS vs app patch multiplier γ = 2 (OS), 1 (APP)
    γ_OS=2, γ_APP=1 chosen to reflect higher OS complexity.
  • node-count weight κ in δ = 0.3
    κ=0.3 linear growth; caps worst-case patch ~12 days.
  • action importance weights A in reward R=A×I = not numerically tabulated
    Hand-assigned higher A for exfil/wiper vs scan; shapes learned policy.
  • RL hyperparameters (α_lr, γ_disc, ε schedule, buffer, batch) = lr=0.001, γ=0.99, ε=1→0.01, decay=0.995, mem=10k, batch=64
    Table 4 values taken from prior cyber-RL work; affect converged attacker.
  • campaign success threshold = 3 DB nodes
    Goal = impact on ≥3 database nodes; configurable but fixed for all tables.
  • max vulnerabilities per node / stratified CVE subsample size = ≤10 per node
    4137 CVEs from 2020 subsampled onto 100 nodes, ≤10 vulns/node; sample not fully specified.
assumptions (6)
  • domain assumption DQN with ε-greedy exploration and the stated reward yields a policy representative of real APT campaign sequencing.
    Core of §4.2 and training protocol §5.2.1; no external validation against recorded APT timelines.
  • ad hoc to paper Patch cost factors multiplicatively as T_fix=α·β·γ·δ with linear node scaling.
    Eq. 5 §4.3; authors note it is configurable but all results use this form.
  • domain assumption CVSS-derived Remote Control vs DoS labels plus KEV/product filters suffice to gate exploit actions.
    §4.1–4.2 vulnerability typing and attacker capability model.
  • domain assumption Weekly discover-then-remediate cycles without preemption model enterprise vulnerability management.
    §4.3 and §5.2.2; cited as typical but not fitted to a specific org’s SLA data.
  • domain assumption 100-node layered and tree graphs with four security layers represent SME enterprise structure for policy comparison.
    §5.1; justified by SME size literature, not by mapped real enterprise graphs.
  • standard math Standard DQN / Bellman update and Gymnasium MDP framing are valid for this sequential attack-defense game.
    Background §2.2 Eqs. 1–3.
invented entities (2)
  • VulnGym shared evolving network MDP (attacker+defender on one graph with real CVE timeline) independent evidence
    purpose: Enable quantitative stress-testing of patch ranking policies against adaptive APT-like agents.
    Primary artifact; composition of known pieces (Gymnasium, NetworkX, NVD, ATT&CK-style actions) into a new evaluation harness.
  • Network Vulnerability Index (NVI) and companion metrics TTRG/TTPV/VIB as policy scorecard
    purpose: Summarize exposure, speed, and backlog beyond binary goal success.
    Defined operationally in §5; useful but paper-specific aggregates.

how reviews work

0 comments
Cite this review

Pith. "Pith review of VulnGym: Evaluating Vulnerability Management Strategies against Advanced Persistent Threats." pith.science (2026). https://pith.science/paper/VDEQAKDZ

@misc{pith2026260724552,
  author       = {Pith},
  title        = {Pith review of: VulnGym: Evaluating Vulnerability Management Strategies against Advanced Persistent Threats},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VDEQAKDZ}},
  note         = {Machine review of arXiv:2607.24552}
}
read the original abstract

Enterprise networks are continuously targeted by Advanced Persistent Threats (APTs), attack campaigns exploiting software vulnerabilities to compromise critical assets over time. As disclosed vulnerabilities grow, resource-constrained organizations must prioritize which ones to patch. Existing prioritization standards score vulnerabilities individually and cannot capture how a patching policy performs against an adversary that progresses through the network over time. Previous tools have simulated attack campaigns through Reinforcement Learning (RL), but either omit vulnerability management, leaving the attacker unopposed, or rely on synthetic networks disconnected from real threat data, and so cannot assess how a policy would fare against a realistic adversary. To fill this gap, we propose VulnGym, a simulation tool to evaluate vulnerability management policies. VulnGym simulates an RL-trained attacker, calibrated on real APT profiles, against a defender executing a configurable patching policy over a network with real Common Vulnerabilities and Exposures (CVEs). Both agents act on a shared, evolving network representation, so the attacker's progress is directly shaped by the defender's patching activity, allowing a given policy to be stress-tested against a realistic attack campaign. Experiments based on real-world vulnerabilities and two APTs show that vulnerability management must be tailored to organizational context, adversarial behavior, network topology, and asset criticality.

Figures

Figures reproduced from arXiv: 2607.24552 by the authors.

Figure 1
Figure 1. Architecture of the simulated environment. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Execution flow of an episode. graph, where nodes represent potentially vulnerable assets, and edges define the connections between them, shaping the possible paths for attacker movement. The network is logically divided into zones, which are typical of IT enterprise networks [5]. The network is fully customizable and supports the definition of multiple zones (e.g., DMZ, Database) as well as intra-zone and inter-zone… view at source ↗
Figure 3
Figure 3. Propagation of the attack across the network. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Layered network topology. Layered topology ( [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Tree network topology. 5.2 Agents 5.2.1 Attacker. In the following experiments, we evaluate the impact of APT campaigns on the target network. We consider two common types of campaign: Exfiltration/Wiper and Denial of Service (DoS). In the Exfiltration/Wiper campaign, …
Figure 6
Figure 6. Figure 6: Heatmaps of attacker and defender node targets in a layered network topology. [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

69 extracted references · 5 linked inside Pith

  1. [1]

    2026.The Broken Physics of Remediation

    Saeed Abbasi and Qualys Threat Research Unit (TRU). 2026.The Broken Physics of Remediation. Technical Report. Qualys. https://cdn2.qualys.com/ docs/mktg/qualys-tru-the-broken-physics-of-remediation.pdf

    2026

  2. [2]

    Amrin Maria Khan Adawadkar and Nilima Kulkarni. 2022. Cyber-security and reinforcement learning - A brief survey.Eng. Applications of Artificial Intelligence114 (2022)

    2022

  3. [3]

    Anthropic. 2026. Project Glasswing: Securing Critical Software for the AI Era. https://www.anthropic.com/glasswing. Accessed: 2026-07-05

    2026

  4. [4]

    Arctic Wolf. 2025. 2025 Threat Report. https://www.arcticwolf.com/resource/arctic-wolf-threat-report-2025-lp/arctic-wolf-threat-report-2025

    2025

  5. [5]

    Aman Bansal. 2020. Security Zoning in Network Architecture. https://medium.com/@aman.bansal93/security-zoning-in-network-architecture- ff7693b91556

    2020

  6. [6]

    Ntagiou, Marcus Wallum, and Hans D

    Norman Becker, Daniel Reti, Evridiki V. Ntagiou, Marcus Wallum, and Hans D. Schotten. 2024. Evaluation of Reinforcement Learning for Autonomous Penetration Testing using A3C, Q-learning and DQN. arXiv:2407.15656 [cs.CR] https://arxiv.org/abs/2407.15656

    arXiv 2024

  7. [7]

    2017.A Growing Risk Ignored: Critical Updates

    BitSight Technologies, Inc. 2017.A Growing Risk Ignored: Critical Updates. Technical Report. BitSight. https://info.bitsight.com/bitsight-insights-a- growing-risk-ignored-critical-updates. 20 Della Penna et al

    2017

  8. [8]

    Brooks and Philip A

    Charles J. Brooks and Philip A. Craig Jr. 2022.Practical Industrial Cybersecurity: ICS, Industry 4.0, and IIoT. Wiley

    2022

Show all 69 references
  1. [9]

    CISA. 2026. Known Exploited Vulnerabilities Catalog (KEV). https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    2026

  2. [10]

    CISA. 2026. Stakeholder-Specific Vulnerability Categorization (SSVC). https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc

    2026

  3. [11]

    2023.Prioritization to Prediction, Vol

    Cisco and Cyentia Inst. 2023.Prioritization to Prediction, Vol. 9: Role of the Known Exploited Vulnerability Catalog in Risk-Based Vulnerability Management. Technical Report. Cisco Systems

    2023

  4. [12]

    Coalition, Inc. 2025. Cyber Threat Index 2025: Deciphering the Ransomware Playbook. https://web.coalitioninc.com/DLC-Cyber-Threat-Index- 2025.html

    2025

  5. [13]

    2024.Spotlight Report 2024: Ransomware Through the Lens of Threat and Vulnerability Management

    Cyber Security Works. 2024.Spotlight Report 2024: Ransomware Through the Lens of Threat and Vulnerability Management. Technical Report

    2024

  6. [14]

    Sofia Della Penna, Roberto Natella, Vittorio Orbinato, Lorenzo Parracino, and Luciano Pianese. 2025. CTI-HAL: A Human-Annotated Dataset for Cyber Threat Intelligence Analysis. In8th Workshop on Attackers and Cyber-Crime Operations (W ACCO)

    2025

  7. [15]

    2024.A Global View of the CISA KEV Catalog: Prevalence and Remediation

    Ben Edwards. 2024.A Global View of the CISA KEV Catalog: Prevalence and Remediation. Technical Report. Bitsight Technologies

    2024

  8. [16]

    Jianqing Fan, Zhaoran Wang, Yuchen Xie, and Zhuoran Yang. 2020. A theoretical analysis of deep Q-learning. InLearning for Dynamics and Control

    2020

  9. [17]

    Farama Foundation. 2026. Gymnasium: An API standard for reinforcement learning with a diverse collection of reference environments. https: //gymnasium.farama.org/

    2026

  10. [18]

    Katheryn A Farris, Ankit Shah, George Cybenko, Rajesh Ganesan, and Sushil Jajodia. 2018. VULCON: A System for Vulnerability Prioritization, Mitigation, and Management.ACM Trans. on Priv. and Sec.21, 4 (2018)

    2018

  11. [19]

    Sylvia Feng and Muharman Lubis. 2022. Defense-in-depth security strategy in LOG4J vulnerability analysis. InIntl. Conf. Adv. in Data Science, E-learning and Inf. Sys. (ICADEIS)

    2022

  12. [20]

    Dave Ferguson. 2026. 2017 - 2026 Vulnerability Severity By Year. https://securityvulnerability.io/

    2026

  13. [21]

    Fernao Group. 2024. CVSS: The 5 Biggest Misconceptions in Risk Assessment. https://www.fernao.com/de/blog/cvss-the-5-biggest-misconceptions- in-risk-assessment

    2024

  14. [22]

    FIRST. 2025. Exploit Prediction Scoring System (EPSS). https://www.first.org/epss/

    2025

  15. [23]

    FIRST. 2026. Common Vulnerability Scoring System (CVSS). https://www.first.org/cvss/

    2026

  16. [24]

    2026.Mid-Year Vulnerability Forecast 2026

    FIRST.org. 2026.Mid-Year Vulnerability Forecast 2026. Technical Report. Forum of Incident Response and Security Teams (FIRST). https: //www.first.org/newsroom/releases/20260615

    2026

  17. [25]

    Jerry Gamblin. 2026. CVE Publications by Year. https://cve.icu/

    2026

  18. [26]

    Patrick Garrity. 2023. Insights Into Vulnerability Management. https://nucleussec.com/blog/insights-into-vulnerability-management-v1/

    2023

  19. [27]

    Google LLC. 2026. APT groups and threat actors. https://cloud.google.com/security/resources/insights/apt-groups

    2026

  20. [28]

    IBM Corp. 2026. Hierarchical Tree Topology. https://www.ibm.com/docs/en/informix-servers/15.0.x?topic=systems-high-availability-clusters-in- hierarchical-tree-topology

    2026

  21. [29]

    2024.Patterns and Targets for Ransomware Exploitation of Vulnerabilities: 2017–2023

    Insikt Group. 2024.Patterns and Targets for Ransomware Exploitation of Vulnerabilities: 2017–2023. Technical Report. Recorded Future. https: //www.recordedfuture.com/research/patterns-targets-ransomware-exploitation-vulnerabilities-2017-2023

    2024

  22. [30]

    Syed Islam and Ankur Sand. 2024. The CVSS Deception: How We’ve Been Misled on Vulnerability Severity. https://i.blackhat.com/EU-24/ Presentations/EU-24-Islam-The-CVSS-Deception.pdf

    2024

  23. [31]

    Caiyan Liu, Wentao Shen, Wenling Lyu, Xiaojie Xu, and Xufeng Ling. 2025. A Study on network architectures and security for small and medium- sized enterprises. InProceedings of the 2025 8th International Conference on Computer Information Science and Artificial Intelligence (C...

    2025

  24. [32]

    Lockheed Martin Corp. 2025. Cyber Kill Chain®. https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html

    2025

  25. [33]

    Microsoft Corp. 2026. What is an advanced persistent threat (APT)? https://www.microsoft.com/en-us/security/business/security-101/what-is- advanced-persistent-threat-apt

    2026

  26. [34]

    Microsoft Defender Research Team. 2021. CyberBattleSim. https://www.microsoft.com/en-us/research/project/cyberbattlesim/

    2021

  27. [35]

    MITRE. [n. d.]. Initial Access. https://attack.mitre.org/tactics/TA0001/

  28. [36]

    MITRE. 2026. APT28. https://attack.mitre.org/groups/G0007/

    2026

  29. [37]

    MITRE. 2026. APT41. https://attack.mitre.org/groups/G0096/

    2026

  30. [38]

    MITRE. 2026. CVE - Common Vulnerabilities and Exposures. https://www.cve.org

    2026

  31. [39]

    MITRE Corp. 2025. MITRE ATT&CK: Adversarial Tactics, Techniques, and Common Knowledge. https://attack.mitre.org/

    2025

  32. [40]

    Volodymyr Mnih, Koray Kavukcuoglu, David Silver, Alex Graves, Ioannis Antonoglou, Daan Wierstra, and Martin Riedmiller. 2013. Playing Atari with Deep Reinforcement Learning.arXiv preprint arXiv:1312.5602(2013)

    2013 arXiv

  33. [41]

    Luis Muñoz-González, Daniele Sgandurra, Martín Barrère, and Emil C Lupu. 2017. Exact inference techniques for the analysis of Bayesian attack graphs.IEEE Transactions on Dependable and Secure Computing(2017)

    2017

  34. [42]

    National Cyber Security Centre. 2023. Verify and regularly review your vulnerability management process. https://www.ncsc.gov.uk/collection/ vulnerability-management/guidance/verify-review-process

    2023

  35. [43]

    National Institute of Standards and Technology (NIST). 2026. National Vulnerability Database (NVD). https://nvd.nist.gov

    2026

  36. [44]

    NetworkX Developers. 2024. NetworkX: Software for Complex Networks. https://networkx.org/

    2024

  37. [45]

    2024.The NIST Cybersecurity Framework (CSF) 2.0

    NIST. 2024.The NIST Cybersecurity Framework (CSF) 2.0. Technical Report CSWP 29. NIST

    2024

  38. [46]

    Jason RC Nurse. 2025. To Patch or Not to Patch: Motivations, Challenges, and Implications for Cybersecurity.arXiv preprint arXiv:2502.17703(2025). VulnGym: Evaluating Vulnerability Management Strategies against Advanced Persistent Threats 21

    2025 arXiv

  39. [47]

    Oracle Corp. 2018. Deploying Services Gatekeeper in a Demilitarized Zone. https://docs.oracle.com/communications/E81149_01/doc.70/e95424/ sgsec_dmz.htm#SGSEC215

    2018

  40. [48]

    Xinming Ou, Sudhakar Govindavajhala, Andrew W Appel, et al. 2005. MulVAL: A logic-based network security analyzer. InUSENIX Security Symp

    2005

  41. [49]

    2019.Costs and Consequences of Gaps in Vulnerability Response

    Ponemon Institute LLC. 2019.Costs and Consequences of Gaps in Vulnerability Response. Technical Report. Ponemon Institute, sponsored by ServiceNow. https://media.bitpipe.com/io_15x/io_152272/item_2184126/ponemon-state-of-vulnerability-response-.pdf

    2019

  42. [50]

    ProjectDiscovery. 2026. Nuclei: A fast and customisable vulnerability scanner. https://docs.projectdiscovery.io/opensource/nuclei/

    2026

  43. [51]

    PurpleSec. 2024. What is Vulnerability Management? (The Definitive Guide). https://purplesec.us/learn/what-is-vulnerability-management/

    2024

  44. [52]

    Rapid7. 2026. Metasploit - Penetration Testing Software. https://www.metasploit.com

    2026

  45. [53]

    Red Hat. 2019. Why CVSS Does Not Equal Risk: How to Think About Risk in Your Environment. https://www.redhat.com/en/blog/why-cvss-does- not-equal-risk-how-think-about-risk-your-environment

    2019

  46. [54]

    Michael Roytman. 2026. Capacity is King. https://research.empiricalsecurity.com/research/capacity-is-king

    2026

  47. [55]

    Jonathon Schwartz and Hanna Kurniawati. 2019. Autonomous Penetration Testing using Reinforcement Learning. arXiv:1905.05965 [cs.CR] https://arxiv.org/abs/1905.05965

    2019 arXiv

  48. [56]

    SentinelOne. 2025. What is Continuous Vulnerability Management? https://www.sentinelone.com/cybersecurity-101/cybersecurity/what-is- continuous-vulnerability-management/

    2025

  49. [57]

    Deana Shick. 2018. Towards Improving CVSS. https://insights.sei.cmu.edu/blog/towards-improving-cvss/

    2018

  50. [58]

    John Shier, Angela Gunn, and Hilary Wood. 2025. Sophos Active Adversary Report. https://news.sophos.com/en-us/2025/04/02/2025-sophos- active-adversary-report/

    2025

  51. [59]

    Saurabh Singh, Pradip Kumar Sharma, Seo Yeon Moon, Daesung Moon, and Jong Hyuk Park. 2019. A comprehensive study on APT attacks and countermeasures for future networks and communications: Challenges and solutions.J. of Supercomp.75, 8 (2019)

    2019

  52. [60]

    Anoop Singhal and Xinming Ou. 2017. Security risk analysis of enterprise networks using probabilistic attack graphs. InNetwork security metrics. Springer

    2017

  53. [61]

    Xining Song, Yuting Li, and Decai Zhang. 2025. Design and Implementation of Building a Small and Medium sized Enterprise Office LAN. In Proceedings of the 2025 11th Annual International Conference on Network and Information Systems for Computers (ICNISC ’25). Association for C...

    2025

  54. [62]

    2022.Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology

    Murugiah Souppaya and Karen Scarfone. 2022.Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology. Technical Report SP 800-40r4. NIST

    2022

  55. [63]

    Jonathan Spring. 2022. Probably Don’t Rely on EPSS Yet. https://www.sei.cmu.edu/blog/probably-dont-rely-on-epss-yet/

    2022

  56. [64]

    UK National Audit Office. 2017. Investigation: WannaCry cyber attack and the NHS. https://www.nao.org.uk/reports/investigation-wannacry- cyber-attack-and-the-nhs/

    2017

  57. [65]

    Ping Wang and Christopher Johnson. 2018. Cybersecurity incident handling: A case study of the Equifax data breach.Issues in Inf. Systems19, 3 (2018)

    2018

  58. [66]

    Christopher JCH Watkins and Peter Dayan. 1992. Q-learning.Machine learning8 (1992), 279–292

    1992

  59. [67]

    Jacob Wiebe, Ranwa Al Mallah, and Li Li. 2023. Learning cyber defence tactics from scratch with multi-agent reinforcement learning.arXiv preprint arXiv:2310.05939(2023)

    2023 arXiv

  60. [68]

    Wiz, Inc. 2025. What is Continuous Vulnerability Management? https://www.wiz.io/academy/continuous-vulnerability-management

    2025

  61. [69]

    Awad A Younis and Yashwant K Malaiya. 2015. Comparing and evaluating CVSS base metrics and Microsoft rating system. InIEEE Intl. Conf. on Software Quality, Reliability and Security (QRS)

    2015

Pith tools

Reviewed July 31, 2026 · model on record in the stance chip above.