microsoft/CyberBattleSim

What is it?

Key features

• 01Simulates lateral movement and vulnerability exploitation in an abstract enterprise network.
• 02Provides an OpenAI Gym interface for training reinforcement learning agents.
• 03Includes a stochastic defender that detects and re-images compromised nodes.
• 04Ships baseline agents, sample topologies and benchmark notebooks.
• 05Compares agents by steps to goal and cumulative rewards.

Use cases

• Researching how network topology and configuration affect lateral movement attacks.
• Benchmarking reinforcement learning algorithms on large discrete action spaces.
• Studying attacker and defender agent interactions in a safe, abstract setting.
• Teaching students about automated cyber-security concepts through interactive notebooks.

Quick start

1. 1

   Clone the repository

   git clone https://github.com/microsoft/CyberBattleSim.git
2. 2

   Install the uv package manager (skip if already installed)

   bash install-uv.sh
3. 3

   Run the initialization script to create the virtual environment

   bash init.sh
4. 4

   Run a short simulation with the baseline RL agent

   python -m cyberbattle.agents.baseline.run --training_episode_count 5 --eval_episode_count 3 --iteration_count 100 --rewardplot_width 80 --chain_size=4 --ownership_goal 0.2

Things to know

• !The simulation is a highly abstract research model, not a tool for real-world networks.
• !Linux or WSL is the supported environment; running directly on Windows is unsupported.
• !The prebuilt Docker image is private, so you must rebuild it from the Dockerfile yourself.

In collections

Topics

FAQ

What is CyberBattleSim?

A research platform for studying how automated attacker and defender agents interact in simulated enterprise networks, with an OpenAI Gym interface. CyberBattleSim is a research platform for studying how automated agents behave in an abstract simulated enterprise network. The network is defined by a fixed topology and a set of vulnerabilities planted in its nodes. An attacker agent tries to gain ownership of part of the network by moving laterally and exploiting those vulnerabilities, while a basic stochastic defender detects attacks and mitigates them by re-imaging infected nodes.

Is CyberBattleSim free to use? What license does it have?

CyberBattleSim is open source under the MIT license. Check the license terms before using it in commercial products.

Is CyberBattleSim still maintained?

Actively maintained. The last commit to CyberBattleSim was on Oct 30, 2026.

What can I use CyberBattleSim for?

Researching how network topology and configuration affect lateral movement attacks. Benchmarking reinforcement learning algorithms on large discrete action spaces. Studying attacker and defender agent interactions in a safe, abstract setting. Teaching students about automated cyber-security concepts through interactive notebooks.

How do I install CyberBattleSim?

Clone the repository: git clone https://github.com/microsoft/CyberBattleSim.git Install the uv package manager (skip if already installed): bash install-uv.sh Run the initialization script to create the virtual environment: bash init.sh Run a short simulation with the baseline RL agent: python -m cyberbattle.agents.baseline.run --training_episode_count 5 --eval_episode_count 3 --iteration_count 100 --rewardplot_width 80 --chain_size=4 --ownership_goal 0.2

Where can I get CyberBattleSim?

The source code and installation instructions are on GitHub: https://github.com/microsoft/CyberBattleSim