VulnGym: Evaluating Vulnerability Management Strategies against Advanced Persistent Threats
2026-07-27 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors designed VulnGym, a tool that simulates attackers and defenders in a network using real data on vulnerabilities and attacker behavior. Unlike prior methods, VulnGym shows how patching policies work against attackers moving through the network over time. Using real-world attack profiles and vulnerabilities, the authors demonstrate that effective patching depends on factors like the organization's setup, attacker strategies, and which assets are most important. This approach helps organizations test how well their patching plans can resist realistic attacks.
Advanced Persistent Threats (APTs)vulnerability managementCommon Vulnerabilities and Exposures (CVEs)Reinforcement Learningpatching policynetwork securityattack simulationnetwork topologyasset criticality
Authors
Sofia Della Penna, Lorenzo Parracino, Luciano Pianese, Vittorio Orbinato, Roberto Natella
Abstract
Enterprise networks are continuously targeted by Advanced Persistent Threats (APTs), attack campaigns exploiting software vulnerabilities to compromise critical assets over time. As disclosed vulnerabilities grow, resource-constrained organizations must prioritize which ones to patch. Existing prioritization standards score vulnerabilities individually and cannot capture how a patching policy performs against an adversary that progresses through the network over time. Previous tools have simulated attack campaigns through Reinforcement Learning (RL), but either omit vulnerability management, leaving the attacker unopposed, or rely on synthetic networks disconnected from real threat data, and so cannot assess how a policy would fare against a realistic adversary. To fill this gap, we propose VulnGym, a simulation tool to evaluate vulnerability management policies. VulnGym simulates an RL-trained attacker, calibrated on real APT profiles, against a defender executing a configurable patching policy over a network with real Common Vulnerabilities and Exposures (CVEs). Both agents act on a shared, evolving network representation, so the attacker's progress is directly shaped by the defender's patching activity, allowing a given policy to be stress-tested against a realistic attack campaign. Experiments based on real-world vulnerabilities and two APTs show that vulnerability management must be tailored to organizational context, adversarial behavior, network topology, and asset criticality.