In late August 2026, the Military’s chief of Community Command (NETCOM) introduced that to take full benefit of synthetic intelligence (AI), the Military wanted a complete simulation of its networks. Whereas acknowledging the issue in constructing a digital twin, Maj. Gen. Jacqueline Denise McPhail acknowledged in Breaking Protection {that a} simulation would create “an ultra-realistic coaching floor for community operators, cyber defenders, and AI algorithms on how the community works and the way to preserve it working, even when underneath assault.”
Since 2017, the SEI has been creating and increasing the GHOSTS framework as a platform for simulating complicated human, organizational, and machine conduct for cyber-training simulations. It started with simulated customers working actual purposes on hosts, producing the visitors, logs, recordsdata, browser historical past, and different artifacts defenders anticipate to come across. It has since expanded into social and cognitive simulation, the place actors talk, type relationships, maintain data and beliefs, make selections, and have an effect on each other throughout a situation—together with by means of social affect, data propagation, belief, and the methods these interactions can change conduct and decision-making over time.
GHOSTS doesn’t try to breed a complete operational setting. It fashions the components wanted to assist a specific experiment, train, or mission rehearsal. A whole illustration is pricey to construct, troublesome to validate, and infrequently pointless. On the similar time, omitting the unsuitable factor can undermine the occasion even when every little thing else is modeled properly.
Digital twins re-expose a permanent simulation-design downside: How a lot of the operational setting truly must be reproduced? Each added system, conduct, and dependency will increase value and complexity. GHOSTS approaches the issue from the opposite route, specializing in the human and organizational exercise wanted to make mission-relevant components of the setting behave realistically. The query just isn’t whether or not a simulation completely duplicates actuality, however which components of actuality should maintain up for the mission at hand. That is analogous, within the context of take a look at and analysis, to the idea of mission assurance.
This weblog put up, tailored from a lately revealed report, layers a philosophical perspective onto the engineering issues of enough realism in cyber simulations and proposes a five-step framework for figuring out the wanted realism of a simulated setting.
Defining Realism
This has raised a typical query amongst our mission companions: How are you aware what’s practical?
Extra usually, do we have to precisely mannequin all features of the actual working setting? For years, CERT has operated simulated environments for coaching, train, struggle gaming, and mission rehearsal, and retains arriving on the similar conclusion: Realism is tied to train validity and worth. Dobson constructed that conclusion into the R-EACTR framework the place the premise is that an train is effective to the diploma it feels actual, and so realism belongs inside each design determination that brings that train to life. The first GHOSTS technical report, revealed in 2018, confirmed that members who rated the train extra practical additionally rated the coaching extra worthwhile. GHOSTS grew from there as equipment to simulate a sensible setting inhabited by folks performing actions that we might anticipate, given their function in a corporation.
Out of this background and expertise got here enough realism. “Prepare as you battle” is a typical phrase in navy operations, and it units a bar for coaching, train, and simulation. In any other case, if the terrain, instruments, or processes {that a} group trains with are considerably completely different from real-world operations, is it actually a legitimate mission rehearsal? On the similar time, value, timing, and different constraints can usually put full constancy out of attain. Adequate realism is the working reply to that pressure—sufficient of the fitting elements within the setting, on the proper constancy, for the mission being rehearsed. Adequate realism overlaps with lots of the considerations captured by R-EACTR, and, in an train, resembles an affordable and constant storyline, practical tactical maneuvers, outlined guidelines of engagement, and authorization for motion.
Navy simulation has handled a intently associated downside earlier than. The SIMNET Program known as its method selective constancy. Somewhat than reproduce a tank in full bodily element, SIMNET started with the duties troopers wanted to carry out and included the controls, cues, and dynamics required to provide these coaching behaviors. Its designers may omit a practical bilge-pump swap as a result of it contributed nothing to platoon- or company-level tactical coaching, whereas seemingly minor cues similar to seat rumble and visible motion mattered as a result of crews used them to evaluate velocity and terrain.
Adequate realism is rooted in the identical spirit, however the cyber setting provides a complication. Some issues need to be practical even when they aren’t straight a part of the coaching goal as a result of they type the background in opposition to which the mission-relevant exercise is interpreted. A defender could by no means be requested to judge odd worker internet looking, for instance, but when all simulated customers go to the identical few websites, observe no deep hyperlinks, produce nearly no POST visitors, and start work on the similar on the spot, the background inhabitants turns into identifiable as artificial. As soon as members can separate simulation artifacts from odd exercise, the train itself adjustments.
Selective constancy tells us one thing essential about the place to spend constancy, whereas enough realism additionally asks what minimal situations the encompassing setting should fulfill earlier than these selective decisions stay legitimate. Above that baseline, mission evaluation once more determines the place extra constancy earns its value.
Selective realism describes what the engineering method does by narrowing the setting to the components that want constancy for the mission, whereas preserving sufficient background realism for these components to be interpreted appropriately. We use the benign time period “style” to explain how skilled folks make troublesome decisions inside that method when evaluation doesn’t uniquely decide a solution.
Mission evaluation can inform us which methods, behaviors, relationships, and alerts matter. It may constrain the vary of acceptable fashions. However it doesn’t at all times inform us whether or not a specific conduct is plausible sufficient, whether or not a discrepancy is consequential, or when one other increment of constancy stops bettering the rehearsal.
An extended reply to the realism query runs by means of our current technical report, A Decade of GHOSTS within the Machine, and is woven into the framework’s evolution from host-based exercise technology by means of cyber-social-cognitive mission rehearsal. This put up takes up one a part of that reply in additional element: Style.
Judgment With out a System
Style can enter the image solely after the engineering downside has been narrowed. It’s not an alternative to mission evaluation, measurement, or validation. Selective realism and mission-focused modeling set up what components of the operational setting matter, what operators want to watch and act on, and the place constancy ought to be concentrated. Style is the educated judgment used inside that constrained area when evaluation doesn’t absolutely decide whether or not a conduct is plausible sufficient, whether or not a discrepancy issues, or when extra constancy stops bettering the simulation.
Questions on “adequate” are a lot older than simulation. Philosophers of science have approached completely different variations of the identical downside: How will we choose one thing that can not be lowered to a rule?
Engineers may object that if a declare rests on style, which is seemingly subjective, then it can’t be confirmed unsuitable. This touches straight on the demarcation downside within the philosophy of science: What separates scientific claims from non-scientific ones? Karl Popper argued {that a} declare must also specify the situations underneath which it may very well be refuted. Philosophers proceed to debate the place to attract the road of what’s science, however falsifiability provides us a helpful commonplace of accountability right here.
Different fields have needed to make consequential selections underneath related simulation situations. RAND developed the Delphi methodology for protection forecasting underneath uncertainty. Nuclear danger evaluation formalized professional elicitation as a result of reactor failure possibilities can not merely be established from noticed frequency. The probabilistic danger assessments behind NUREG-1150, a danger evaluation for accidents at 5 U.S. nuclear energy crops by the Nuclear Regulatory Fee, relied on structured professional judgment. The intelligence group constructed structured analytic strategies for related causes, and Heuer’s therapy of them stays commonplace coaching materials. Naturalistic determination analysis likewise grew out of finding out how hearth commanders and navy officers determine underneath time stress.
The sensible reply is to make judgment accountable. Establish who’s certified to make the decision, seize the judgment earlier than the end result is understood, after which evaluate it with the outcomes.
The Very Outdated Downside of “Good Sufficient”
Features of simulation realism could be measured—visitors distributions could be in contrast in opposition to actual captures, and classifiers can distinguish artificial hosts from precise ones. But knowledge alone can not set the edge or choose which metrics matter for a mission.
Mission evaluation narrows the issue significantly: What should members observe, determine, and do? Which components of the setting can have an effect on these selections? What surrounding situations should stay credible for these observations to be significant?
Even after answering these questions, some decisions stay. How good is sweet sufficient? Judged by whom? When does one other increment of constancy cease bettering the rehearsal?
It is a long-standing philosophical query, and there are helpful philosophical insights:
Aristotle recognized this problem within the Nicomachean Ethics, observing that an informed particular person calls for precision solely so far as the topic permits. Utilized to simulation, constancy have to be tailor-made to the mission. Aristotle argues that over-engineering precision is a design flaw moderately than rigor. Whereas his precept is a vital a part of our argument, it additionally dangers permitting a self-discipline to keep away from measurement completely if it defines its personal limits—a pressure we deal with beneath.
Within the Poetics, Aristotle additional notes that possible impossibilities are preferable to inconceivable potentialities. Utilized to simulation, this level means that an approximation that preserves the cues members have to motive appropriately could also be extra helpful than literal constancy to particulars that don’t have an effect on the mission.
Plato makes the same distinction within the Sophist, contrasting arts that replicate actual proportions with sculptors who deliberately distort colossal statues, so they give the impression of being appropriate from the viewer’s perspective. In our expertise, Plato’s distinction is a helpful approach to consider constancy from the participant’s perspective.
To navigate these selections, Aristotle depends on phronesis—sensible knowledge grounded in expertise and judgment moderately than inflexible guidelines. Gadamer later confirmed this capability advanced into the trendy idea of style, a central theme for Enlightenment thinkers. Although formalized centuries later, the core downside of evaluating “adequate” stays unchanged. We see it at this time at any time when a mission companion asks for a digital twin, a sensible cyber vary, or a simulation of human conduct. No setting can reproduce each element of the operational world, nor would each element contribute equally to the mission. Designers nonetheless determine which options members should have the ability to motive about, how faithfully these options should behave, and the place extra realism doesn’t enhance the rehearsal.
Certified Judges
A cyber vary has a very unforgiving viewers. Its customers are actively searching for the perimeters and the seams. In contrast to an viewers prepared to increase a suspension of disbelief, members stake actual operational judgment on the setting’s accuracy. As a result of a misunderstanding of realism carries real-world assets and prices, the setting has to show itself to them. Adequate realism ought to maintain up underneath that scrutiny.
A current AI cyber-range incident illustrates this downside from one other route. In a current analysis, a configuration error gave an OpenAI mannequin entry to the general public web despite the fact that the mannequin had been advised that web entry was not out there. A fictional goal additionally occurred to correspond to an actual area, which the mannequin then attacked as if it was throughout the simulated setting. The mannequin reasoned from the setting it noticed, moderately than the meant setting. On this sense, realism consists of boundaries in addition to visitors, methods, and conduct. So, if the simulated world exposes a functionality, members can deal with that functionality as a part of the situation.
The primary mission level right here is that realism ought to be judged by individuals who know what the operational setting truly seems like.
A design group can decide whether or not the simulation behaves as meant. That’s completely different from figuring out whether or not the conduct would survive scrutiny from somebody who works within the setting being simulated. The folks making the second judgment want expertise with the actual factor and sufficient comparative expertise to acknowledge when one thing is off.
There are helpful philosophical insights right here as properly:
David Hume provides us helpful language for this. In Of the Normal of Style, he grounds style in certified judges—these with “robust sense, united to delicate sentiment, improved by follow, perfected by comparability”—and illustrates these with the story of Sancho’s kinsmen. Two tasters pattern wine. One detects a faint style of leather-based, the opposite of iron, and the remainder of the room ridicules them each. However when the barrel is drained, an previous key on a strip of leather-based lies on the backside.
On this story, Hume specifies choice standards for a choose. Cooke later developed formal strategies for calibrating and weighing professional judgments. The intelligence group codified this as analytic tradecraft requirements. The analogy to cyber train simulation is becoming. The analyst who says community visitors feels unsuitable whereas each dashboard reads inexperienced is Sancho’s kinsman. The drained barrel is telemetry. The important thing on the leather-based is the beacon firing on a metronome, the scripted user-agent string, the looking historical past with no deep hyperlinks—no matter artifact turns up, after the very fact and within the logs, to show a hunch proper that no rule may have produced within the second.
The second mission level is that professional judgment has to depart proof behind.
The preliminary hunch can’t be the tip of the evaluation. If the skilled analyst thinks the visitors is unsuitable, the vary ought to protect sufficient proof to find out why. So, style right here is making claims that may later be examined. Hume’s certified choose seems to look lots like an skilled blue teamer watching community visitors and saying, “One thing about that is unsuitable.”
Moreover, Immanuel Kant observed that these sorts of judgments are subjective but additionally include an expectation of settlement—name one thing stunning and also you anticipate different practiced observers to concur, earlier than any proof. Simulation judgments work equally. When a designer says the looking conduct seems unsuitable, they anticipate each practiced eye to see it too. The declare has the pressure of an instance, and within the cyber area, with artifacts, logs, and community visitors, we will confirm.
The third mission level is that this type of judgment needs to be developed and preserved, exactly as a result of a lot of it can’t be transferred by means of a rulebook.
Somebody who has spent years taking a look at enterprise visitors acquires a way for timing, density, software conduct, person rhythms, and different patterns that could be troublesome to enumerate prematurely. That experience issues when the simulator produces one thing technically permissible however operationally unusual.
Polanyi provides us one other piece of the issue: “We will know greater than we will inform.” Connoisseurship—in wine, in radiology, in visitors evaluation—travels by means of apprenticeship and expertise. On this sense, our decade of open-source growth has proceeded in the same spirit. The problem threads on GitHub, the train after-action studies, and the behaviors constructed out of lots of of train situations are the circumstances from which the sensibility could be learn, taught, and criticized. Whereas our documentation says what the system is and might do, it’s the file of its being constructed that signifies the style we have now used over time to construct the platform.
Susan Sontag synthesizes these concepts in Notes on ‘Camp’, providing an account of how judgment operates with out inflexible guidelines. Sontag argues that creative sensibility applies equally to domains the place practitioners consider high quality quicker than they’ll formalize why. Sontag notes that whereas style lacks formal proofs, particular person judgments reveal a coherent sensibility—one which dangers being destroyed if compelled into inflexible methods.
We didn’t start GHOSTS with a proper concept of enough realism. As a substitute, the idea emerged by means of years of pragmatically-informed concrete modeling selections. A lot of its essential design selections centered on what not to simulate.
This underlying logic turns into clear in contemplating what we have now chosen to omit within the growth evolution. Early makes an attempt to imitate full person conduct overburdened vary infrastructure, prompting GitHub discussions on which particulars had been pointless to duplicate. Losing assets on constancy that’s imperceivable is poor design, and omitting this type of work is an train in developer style. The identical reasoning shapes GHOSTS’ defaults, very like Hansson’s omakase argument for having default configurations embody decisions about what ought to work out of the field.
In cyber simulation, hardening style into fastened guidelines carries operational dangers past aesthetics. Formulaic realism creates predictable patterns that defenders can simply filter out—a flaw in early simulation instruments. When a sensibility turns into a inflexible guidelines, we will search for that guidelines and discover its identifiable signature.
There may be one other downside: Style doesn’t switch cleanly between domains. Somebody who can spot artificial community visitors instantly could don’t have any comparable instinct for whether or not a simulated persona or belief relationship is believable. As GHOSTS expands throughout cyber, social, and cognitive domains, realism subsequently will depend on a number of sorts of specialised judgment moderately than one inflexible rulebook.
A 5-Step Framework for Sufficiency
We will make this idea of judgment extra reusable by asking 5 ordered questions. Observe that beginning with constancy or tooling as a substitute of goal tends to provide a simulation constructed round what is feasible moderately than what the mission requires.
Stage 5 does a lot of the work right here, and it’s straightforward to skip. It pertains to the idea of defeasible reasoning and the idea of defeaters utilized in security and assurance circumstances. Somewhat than solely accumulating proof that helps a declare, we additionally ask what proof would undermine it. Right here, the declare is that the simulated setting is sufficiently practical for its meant goal. The SEI’s work in producing cyber workouts during the last decade has helped us develop an inventory of tells that point out enough realism has not been attained, and would problem our declare:
- Defenders discover a filter that isolates artificial visitors.
- Basic visitors patterns are too predictable.
- GET visitors overwhelms POST exercise.
- Shopping patterns stay too slim all through the train.
- Timelines spike in methods no workday can produce.
- The setting fails to assist the coaching goal.
Writing these down earlier than the occasion—and instrumenting the setting to detect them—makes the after-action dialogue rather more concrete.
Three Assessments for Making Judgment Accountable
Adequate realism nonetheless faces an apparent downside: If it rests on judgment, how can the judgment be evaluated? We famous earlier that Aristotle’s declare allows a discipline to flee measurement. An identical downside seems in model-based methods engineering (MBSE), the place reasoning can start with tacit fashions within the heads of designers, transfer by means of casual representations, and finally attain formal fashions with specific semantics. Reasoning is feasible at every stage, however assumptions change into simpler to examine and problem because the mannequin turns into extra specific.
The identical precept applies right here. The way in which out of this circle is to make judgements specific sufficient that events outdoors the venture can take a look at them. The next three checks can be found:
- First, the declare that realism judgment resists codification could be refuted by codifying it. If a rule set identifies issues in a simulated setting extra reliably than skilled reviewers do, the rule set ought to be adopted. We might absolutely undertake it as properly.
- Second, the social gathering evaluating whether or not an setting is plausible ought to be unbiased of the group that constructed it. Stage 4 of the framework exists for that reason.
- Third, disagreement amongst certified reviewers could be measured. When practiced analysts working from the identical proof proceed to succeed in completely different conclusions, the restrict of accessible precision is actual and its location is identifiable. After they converge, extra precision was out there and the design didn’t pursue it. Inter-rater settlement measures this straight.
The fifth stage makes falsification sensible: State prematurely what would point out that the setting is inadequate, conduct the train, and decide which of these statements survive contact with members. That is the odd take a look at of an empirical declare, and it requires no modification to use right here.
The 2018 GHOSTS report discovered that greater perceived realism correlates with higher coaching worth—a measurable assemble that has seen improved instrumentation.
What we get is a normal of accountability moderately than formal proof. A declare about sufficiency ought to be acknowledged earlier than the train, evaluated by certified events outdoors the design group, checked in opposition to recorded proof, and revised when an train contradicts it. That commonplace is identical one Delphi, professional elicitation, and structured analytic strategies settled on, utilized to a special topic.
Sontag’s warning applies to the framework, in {that a} set of questions that we’d harden right into a compliance type would produce regularity that makes artificial environments identifiable. The framework specifies the questions and requires that the solutions be documented. The solutions stay judgments.
A Observe on Style within the Age of AI
The AI area is altering shortly, and GHOSTS has needed to change with it. Earlier, we constructed GHOSTS Shadows as a server-side approach to handle LLM integration and join mannequin outputs to GHOSTS exercise. That was helpful, however it mirrored an earlier stage of the issue—offering GHOSTS brokers with entry to domestically hosted LLMs, significantly inside closed or air-gapped environments. RangerAI is turning into our AI infrastructure stack round our cyber vary and simulation work, the place the place planning, mannequin integration, orchestration, device use, and exercise-level AI management can dwell. In that mannequin, GHOSTS doesn’t have to personal your complete AI layer.
GHOSTS stays the realism and actuation engine, the system that makes artificial customers, teammates, organizations, and public actors behave contained in the simulated world. RangerAI can deal with extra of the AI infrastructure, which continues to evolve fairly quickly. As that ecosystem matures, GHOSTS stays centered on its core mission.
AI additionally adjustments what adversaries and defenders can do contained in the simulated world. It may enhance the size and variation of content material technology, adapt actions based mostly on situation state, assist richer NPC conduct, speed up situation development, and assist operators discover alternate paths.
The facility of AI is most helpful when related to a disciplined simulation structure together with actor fashions, situation constraints, workflow logic, telemetry, repeatability, and after-action evaluate.
For GHOSTS, the principle AI query just isn’t whether or not a mannequin can generate a believable sentence or exercise directive. As a substitute, we’re involved with how a generated motion matches right into a simulation. What state did the mannequin see? Why did the NPC act? What modified afterward? Was the motion executed? Was it noticed? Did it have an effect on one other NPC, a defender, a public narrative, or a mission final result? By specializing in these impacts, we work to make use of AI output in a methodical, centered method. In different phrases, with AI we have now a extra responsive and highly effective method to experimentation in assist of our decisions relating to style—what constitutes enough realism and the way to validate the modeling that’s performed.
The tougher downside stays. AI can generate extra various conduct, adapt NPC actions to altering situations, and assist simulations discover many extra doable situations, however scale doesn’t reply the query of what realism the mission requires. As GHOSTS expands throughout cyber, social, and cognitive environments, enough realism will rely upon understanding what state an actor can observe, why it acts, what adjustments in consequence, and whether or not these results matter to the precise mission being rehearsed. Future work will subsequently be much less about making simulations ever extra full and extra about creating, testing, and transmitting the judgment wanted to determine what have to be practical, for whom, and to what finish.
