Search papers, labs, and topics across Lattice.
This paper introduces VulnGym, a simulation tool designed to evaluate vulnerability management strategies against Advanced Persistent Threats (APTs) by simulating an RL-trained attacker using real-world vulnerability data. The tool enables organizations to assess how different patching policies perform in the face of evolving adversarial tactics, addressing the limitations of existing prioritization methods that fail to consider the dynamic nature of cyber threats. Key findings indicate that effective vulnerability management requires customization based on organizational context, adversarial behavior, network topology, and asset criticality to mitigate risks effectively.
Tailoring vulnerability management strategies to specific organizational contexts can significantly enhance defenses against sophisticated APTs.
Enterprise networks are continuously targeted by Advanced Persistent Threats (APTs), attack campaigns exploiting software vulnerabilities to compromise critical assets over time. As disclosed vulnerabilities grow, resource-constrained organizations must prioritize which ones to patch. Existing prioritization standards score vulnerabilities individually and cannot capture how a patching policy performs against an adversary that progresses through the network over time. Previous tools have simulated attack campaigns through Reinforcement Learning (RL), but either omit vulnerability management, leaving the attacker unopposed, or rely on synthetic networks disconnected from real threat data, and so cannot assess how a policy would fare against a realistic adversary. To fill this gap, we propose VulnGym, a simulation tool to evaluate vulnerability management policies. VulnGym simulates an RL-trained attacker, calibrated on real APT profiles, against a defender executing a configurable patching policy over a network with real Common Vulnerabilities and Exposures (CVEs). Both agents act on a shared, evolving network representation, so the attacker's progress is directly shaped by the defender's patching activity, allowing a given policy to be stress-tested against a realistic attack campaign. Experiments based on real-world vulnerabilities and two APTs show that vulnerability management must be tailored to organizational context, adversarial behavior, network topology, and asset criticality.
