RLShield: Practical Multi-Agent RL for Financial Cyber Defense with Attack-Surface MDPs and Real-Time Response Orchestration

Researchers have developed RLShield, a multi-agent reinforcement learning system designed to automate cyber defense in financial institutions. The system uses AI to coordinate real-time responses across multiple assets and services during cyberattacks, balancing containment speed with operational costs and business disruption.

• →RLShield uses multi-agent reinforcement learning to automate financial cyber defense, replacing static rule-based security systems.
• →The system models enterprise attack surfaces as Markov decision processes to enable real-time coordinated responses across multiple assets.
• →It optimizes a risk-sensitive objective balancing containment speed, business disruption, and response costs within operational budgets.
• →Experiments show RLShield reduces time-to-containment and exposure while maintaining service availability compared to traditional methods.
• →The research addresses practical deployment challenges in financial systems that require continuous operation during security incidents.