How to Test AI Defending Networks When EDR Is Autonomous

👁 119 reads

Kerri Prinos and Lilianne Brush published a 17-page paper on arXiv (2606.08168) examining how to evaluate autonomous defense agents working with commercial endpoint detection and response (EDR) systems. The first version appeared on 6 June 2026, followed by a second on 21 October 2026.

Why testing autonomous EDR is difficult

Modern commercial EDR systems are no longer passive tools configured by an operator. The authors say these products have evolved from operator-configured rule sets into multi-component systems, where autonomous AI components operate alongside - and increasingly in place of - operator-deployed policies. In other words, when an autonomous defense agent tries to configure such a system, it is not adjusting settings in a passive tool. It is interacting with a black box that makes its own decisions according to the vendor’s logic.

This raises a fundamental question: how can you evaluate whether a defense agent is doing anything useful when the EDR itself performs some of the defensive actions?

What the researchers built

Prinos and Brush present what they describe as the first evaluation framework for autonomous defense agents configuring commercial EDR. They ran it in the Game of Active Directory (GOAD) lab. They used Horizon3’s NodeZero as the autonomous penetration tester and Microsoft Defender XDR as the primary EDR under test. They then extended the same framework to CrowdStrike Falcon and SentinelOne Singularity to see whether the findings from testing Defender were specific to Microsoft or more general.

A pilot benchmark of defense agents used two language models as its backbones: Claude Sonnet 4.6 and Cisco Foundation-Sec-8B. The paper does not provide detailed numerical results for this benchmark. Instead, the authors focus on the methodology and qualitative findings.

Three lessons simulations can miss

The authors report three lessons that, they argue, cannot be learned from simulations or tests using open-source software alone.

First, commercial EDR telemetry is designed for SOC analyst workflows, not for measuring policy effectiveness. That means the data an agent receives from the system cannot directly show whether its own actions made a difference.

Second, per-policy attribution is essential for distinguishing what the agent did from what the EDR did autonomously. Without that distinction, it is impossible to know which deserves credit or blame for an outcome.

Third, EDR behavior varies across runs, largely because containment accumulates and changes the state of the environment. As a result, tests are not repeatable in any straightforward way.

The authors’ conclusion

Together, these observations point to what the authors call the “sim-to-real gap” - the difference between results in simulation and behavior in a real corporate environment. In their view, this gap motivates a new methodology for benchmarking defense agents in environments that include autonomous black boxes.

What this means for AI security testing

In my view, this paper addresses an issue that is rarely discussed directly: when you combine an autonomous attacker with an autonomous defender, and that defender configures a system that also acts autonomously, you have three layers of agents and no simple way to determine who did what. The paper’s value lies not in benchmark results - there are effectively none - but in clearly identifying three specific methodological problems. This is a paper about how to measure performance, not one that claims to have measured it and produced results. If you build or evaluate AI security systems in corporate environments, these lessons offer a practical guide to what you should not assume when designing tests.

Source: arXiv cs.AI: Closing the Sim-to-Real Gap: An Evaluation Framework for Autonomous Cyber Defense Configuration of Commercial EDR (paper dated 22 October 2026). This article is based on the full paper, not on coverage by other media.

// read moreClaude Code: AI Agent That Edits Your Project AutonomouslyAI ToolsAI Coding Agents Installed Malicious Code in Fortune 500 NetworksNewsPoeLLM Malware: A GitHub Poem Controlled 3,400 AI ServersNews

Kinetyra