VulnGym: Evaluating Vulnerability Management Strategies against Advanced Persistent Threats

2026-07-27

AI Summary

This study addresses the challenge of effectively prioritizing vulnerability remediation under resource constraints to counter dynamically evolving advanced persistent threats (APTs). To this end, the authors develop an adversarial simulation platform that integrates real-world network topologies, CVE data, and APT behavioral models. Within this framework, a reinforcement learning–driven attacker dynamically interacts with a defender employing configurable patching strategies, enabling, for the first time, stress testing of vulnerability management policies under realistic attack scenarios. Experimental results demonstrate that effective vulnerability management must be tailored to organizational context, adversary behavior, network structure, and asset criticality. The findings validate the proposed approach as an innovative means to enhance the practical efficacy of cyber defenses.

Abstract

Enterprise networks are continuously targeted by Advanced Persistent Threats (APTs), attack campaigns exploiting software vulnerabilities to compromise critical assets over time. As disclosed vulnerabilities grow, resource-constrained organizations must prioritize which ones to patch. Existing prioritization standards score vulnerabilities individually and cannot capture how a patching policy performs against an adversary that progresses through the network over time. Previous tools have simulated attack campaigns through Reinforcement Learning (RL), but either omit vulnerability management, leaving the attacker unopposed, or rely on synthetic networks disconnected from real threat data, and so cannot assess how a policy would fare against a realistic adversary. To fill this gap, we propose VulnGym, a simulation tool to evaluate vulnerability management policies. VulnGym simulates an RL-trained attacker, calibrated on real APT profiles, against a defender executing a configurable patching policy over a network with real Common Vulnerabilities and Exposures (CVEs). Both agents act on a shared, evolving network representation, so the attacker's progress is directly shaped by the defender's patching activity, allowing a given policy to be stress-tested against a realistic attack campaign. Experiments based on real-world vulnerabilities and two APTs show that vulnerability management must be tailored to organizational context, adversarial behavior, network topology, and asset criticality.

Problem

• Vulnerability Management
• Advanced Persistent Threats
• Patch Prioritization
• Attack Simulation
• Enterprise Network Security

Innovation

• Vulnerability Management
• Advanced Persistent Threats
• Reinforcement Learning
• Cybersecurity Simulation
• CVE