Poison Arrow: AI Cyber Adversary Simulation for AF Cyber Ranges

Ad Hoc Research (AHR) proposes the development of Poison Arrow, an adaptive cyber training solution that equips Air Force personnel to confront the rising challenge of AI-powered cyber threats. Built upon AHR’s commercially deployed DarkStax™ platform, Poison Arrow introduces self-learning adversary simulations powered by reinforcement learning (RL) to create dynamic, evolving cyber scenarios that adapt to trainee behavior in real time. This advancement addresses a critical capability gap faced by the 318th Range Squadron (318 RANS) and broader Air Force cyber operations, which currently rely on static, labor-intensive training environments that fail to reflect the speed and sophistication of modern threats. Poison Arrow enables a major shift from scripted cyber range exercises to intelligent, AI-driven training environments. By leveraging ontology-based attack modeling and RL-driven Opposition Forces (OPFOR), the system generates adaptive attack paths, simulates advanced adversary tactics, and reduces scenario planning time from two weeks to two days. This not only accelerates training cycles but also provides Airmen with realistic, mission-relevant pressure they are likely to encounter in operational environments.  The proposed effort builds upon a completed Phase I feasibility study conducted in close coordination with 318 RANS. During Phase I, AHR validated the platform’s technical viability, integration pathways with existing cyber ranges, and performance improvements in scenario generation and adversary realism. Poison Arrow is currently assessed at TRL 6 and, through this proposed Phase II effort, will be matured to TRL 8 by developing operational prototypes, conducting usability assessments with 318 RANS operators, and performing mission-aligned testing events in coordination with end-user stakeholders. AHR’s core DarkStax platform is commercially mature (TRL 9) and deployed with industry leaders such as AT&T and Nokia to support secure network testing and optimization at enterprise scale. Poison Arrow extends these proven capabilities into the defense domain, aligning with multiple DoD Critical Technology Areas (CTAs), including Advanced Computing & Software (ACS), Trusted AI & Autonomy (TAIA), Integrated Network Systems-of-Systems (INSS), and Integrated Sensing & Cyber (ISC). This solution offers a scalable, cost-effective, and technically differentiated path to accelerate cyber readiness and close the training gap posed by emerging AI-enabled threats.