Cyber Gym environments train security agents on deterministic scenarios — every alert triaged, every remediation claim signed and replayable.
Bench: Cyber Gym
Overview
Cyber Gym is our controlled arena for security agents: synthetic estates, injected findings, and known-good ground truth so we can score triage and response without touching customer production.
Why it matters
SOC automation fails when vendors demo on cherry-picked alerts. Cyber Gym scenarios include contradictory telemetry, false positives, and chained incidents — the messy reality ArkSecure and Sentry must handle with proof.
Methodology
- Scenario packs mapped to MITRE-aligned tactics with seeded randomness
- Agents run through
guardian_risk,sensitivity_detection, and remediation domains - Outputs: signed remediation claims, escalation logs, and Hedera-ready attestations where configured
- Red-team variants measure false escalation and missed critical paths
Results & next steps
Leaderboards track precision, time-to-contain, and calibration on severity labels. Cyber Gym feeds product roadmaps and customer pilots with reproducible scorecards — not slide-deck promises.
Arkivist Research
Updated February 1, 2026
