Dynamic Attack Surfaces: A Queue of Branching Processes
Abstract
Modern attack surfaces are inherently dynamic. Vulnerabilities emerge over time and they remain exposed to exploit until defenders discover and patch them. Artificial intelligence (AI) amplifies these dynamics by accelerating both offensive and defensive processes, making modern cybersecurity increasingly a competition among interacting time scales and resources. We capture this competition using a queue of branching processes that couples vulnerability discovery and resource-constrained patching with the evolving attacker population targeting each vulnerability. Our primary risk metric is the cumulative number of exploits a vulnerability experiences before it is patched. We derive the expected cumulative number of exploits under birth-death-immigration (BDI) and rise-decay (RD) models of attacker activity. Under a BDI model of attacker activity, we identify a phase transition: the expected cumulative number of exploits is finite only when attacker growth remains below both the vulnerability discovery rate and the effective patching rate. Across both attacker models, increasing the exploit rate does not necessarily increase the expected number of exploits because faster attacker departure can sufficiently limit the active attacker population. Finally, we show that equal proportional AI amplification of offensive and defensive capabilities need not preserve security: accelerating both sides can shift the defensive bottleneck and move the system into an unbounded-risk regime.
Related
- Continuous-state branching processes with Lévy-Khintchine drift-interaction: Laplace duality and Fellerian extensions
- Limit theorems for supercritical branching processes in Markovian environment with linear fractional offspring distributions
- Longest-Queue Policies in Dynamic Matching with Abandonments
- Domains of Attraction for Quasi-Stationary Distributions of Branching Processes in Random Environments
- On conservativity of multitype continuous-state branching processes
BibTeX
@misc{cosandal2026dynamic,
title = {{Dynamic Attack Surfaces: A Queue of Branching Processes}},
author = {Ismail Cosandal and Abdullah Y. Etcibasi and C. Emre Koksal and Sennur Ulukus},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2610.18721},
eprint = {2610.18721},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.18721},
}
RIS
TY - UNPB
TI - Dynamic Attack Surfaces: A Queue of Branching Processes
AU - Ismail Cosandal
AU - Abdullah Y. Etcibasi
AU - C. Emre Koksal
AU - Sennur Ulukus
PY - 2026
DA - 2026/10/13
PB - arXiv
DO - 10.48550/arxiv.2610.18721
UR - https://arxiv.org/abs/2610.18721
AB - Modern attack surfaces are inherently dynamic. Vulnerabilities emerge over time and they remain exposed to exploit until defenders discover and patch them. Artificial intelligence (AI) amplifies these dynamics by accelerating both offensive and defensive processes, making modern cybersecurity increasingly a competition among interacting time scales and resources. We capture this competition using a queue of branching processes that couples vulnerability discovery and resource-constrained patching with the evolving attacker population targeting each vulnerability. Our primary risk metric is the cumulative number of exploits a vulnerability experiences before it is patched. We derive the expected cumulative number of exploits under birth-death-immigration (BDI) and rise-decay (RD) models of attacker activity. Under a BDI model of attacker activity, we identify a phase transition: the expected cumulative number of exploits is finite only when attacker growth remains below both the vulnerability discovery rate and the effective patching rate. Across both attacker models, increasing the exploit rate does not necessarily increase the expected number of exploits because faster attacker departure can sufficiently limit the active attacker population. Finally, we show that equal proportional AI amplification of offensive and defensive capabilities need not preserve security: accelerating both sides can shift the defensive bottleneck and move the system into an unbounded-risk regime.
ER -