New Math Trick Helps AI Plan Cyber Defenses Without the Long Wait

When a company or government wants to know how to protect a network, it increasingly lets computers play out a pretend war: a simulated hacker attacks, a simulated defender responds, over and over. The trouble is the cost. To find the best strategy — the point where neither side gains by changing tactics, known as a Nash equilibrium — the computer has to estimate the outcome of every possible matchup. Running all those simulations is like checking every square on a giant chessboard before making one move.

Three researchers — Michael Lanier, David Farmer and Yevgeniy Vorobeychik — propose a shortcut called Regret-Weighted Payoff Sampling. Rather than simulating everything, their method simulates only the matchups the final answer actually depends on, and fills in the blanks with a stand-in model trained on everything simulated earlier in the run. It is the difference between researching every move in a chess manual and studying only the openings your opponent actually plays.

On three test games, their new math produced error estimates four to six times tighter than the standard approach. Better still, it could predict in advance which games would be cheap: a simple game needed only 18% of the matchups simulated, while a messier “Colonel Blotto” game needed 82%. On two real cybersecurity simulators, CyGym and ANSG, the method gave the sharpest answers at the smallest budgets — in other words, the cheapest.

Why should you care? Security teams use this kind of simulation to decide where to spend limited money and attention, and the same math applies to any AI that improves by playing against itself. The catch: this is a research paper, tested on modest 21-by-21 games. It is a promising lab result, not a product you can buy yet — and real networks are far more complicated than any test board.