Advancing AI-Driven Cyber Defence with armasuisse’s Cyber-Defence Campus

Artificial intelligence is now part of how cyberattacks are planned and delivered, and part of how defenders prepare for them. As adversaries automate their decisions and adapt faster than human teams can react, a practical question follows: how can an organisation know an AI-enabled defence will hold before it is relied on in a real operation?

That question is difficult to answer well. Rehearsing against a capable, adaptive adversary has traditionally meant manual red teaming, which is realistic but slow to build and hard to run at scale, and testing an AI-enabled system fairly is harder still. This is the problem that CybExer and the Cyber-Defence Campus of armasuisse set out to tackle together, in a public-private research partnership launched in May 2025.

A public-private partnership for the age of AI

CybExer and the Cyber-Defence Campus of the Swiss Federal Office of Defence Procurement armasuisse joined forces to explore how artificial intelligence can be integrated into cyber range technology. The focus of the collaboration is the application of AI across the core functions of a cyber exercise, from red teaming and blue teaming through to the wider set of tasks that keep a defensive operation running.

The arrangement is a public-private partnership, a model in which a public institution and a private company combine their respective strengths to pursue a shared goal. In this case the balance is clear. CybExer brings access to proven, large-scale cyber training infrastructure and the data that a realistic environment generates. The Cyber-Defence Campus brings deep expertise in research and innovation, and leads on the research and application of artificial intelligence for cyber defence.

From left: Andrus Kivisaar, Lauri Almann, Roland Meier, Vincent Lenders, Kristiina Orm and Aare Reintam.

The Cyber-Defence Campus, or CYD Campus, was founded in 2019 to strengthen Switzerland’s cyber defence and anticipate developments more quickly, linking the Swiss government, industry and academia in research, development and training. That makes it a natural counterpart for a company whose platform is built to test, train and develop cybersecurity capabilities at scale.

Bringing AI into the cyber range

Cyber ranges have long been the laboratories of cybersecurity, controlled environments in which teams train and respond to incidents without real-world consequences. The partnership extends that role into a harder question: how intelligent systems themselves behave when the situation is demanding and the adversary does not follow a script.

Inside the shared environment, researchers can observe how AI performs on both sides of an exercise. On the offensive side, it can drive an adversary that probes, reacts and shifts tactics as defenders respond, closer to how a capable attacker behaves. On the defensive side, it can support the analysis, detection and decision-making a blue team relies on under time pressure. Studying the two together, in the same realistic setting, shows where AI genuinely strengthens cyber defence and where it needs further work.

The joint research is organised around a few concrete lines of enquiry: how AI can support decision-making during a cyber operation, how it can automate both defensive and offensive actions, and how it can make the training environment itself more realistic.

Each presents a significant technical challenge. Making an AI adversary genuinely adaptive, rather than following a more elaborate script, is difficult, and so is judging whether it has succeeded; defensive automation must earn an operator’s trust before it is useful; and a result that holds inside a controlled range has to carry across to a messier operational environment. These are the questions the partnership was formed to address, and it brings together the two things progress depends on: a realistic environment and rigorous research.

For CybExer, the collaboration builds on years of running large-scale exercises across many countries, which generated thousands of hours of observation about how attacks develop and how defences respond under pressure. For the CYD Campus, the value lies in access to that kind of environment, and to datasets rich enough to put research prototypes to a serious test.

The company had also been building AI into its platform before the partnership began. Tools such as its AI Engine and AI Fabric already automate routine work like checking and scoring assignments, freeing instructors and giving participants faster feedback. So the task was not to introduce AI to the cyber range for the first time, but to study, stretch and validate what intelligent systems can do within it.

“Testing new cyber defence systems requires both realistic infrastructure and representative data. Our partnership with CybExer provides us access to a state-of-the-art testing environment and the datasets we need to rigorously evaluate and refine our research prototypes. This collaboration is a step towards translating innovative research into practical, resilient cyber defence solutions.”

Dr Vincent Lenders, Head of the Cyber-Defence Campus, armasuisse

Research that is shared, not siloed

A distinctive feature of the partnership is its commitment to openness. The parties agreed to jointly publish research outcomes and developed systems, as far as security, intellectual-property and classification constraints in defence research allow. In practice, non-sensitive findings and methods can be shared even where specific data or code cannot, which still contributes to transparency and sector-wide innovation. Progress made in one realistic environment is far more useful when others can examine it and build on it.

From research towards a working solution

The May 2025 partnership established the environment and the questions; by October 2025 that work had become the foundation for a related development project, in which CybExer is building an AI-enabled Active Cyber Defence Solution. The solution is intended to bring artificial intelligence, offensive cyber tools and cyber range technology together in a single, modular package, addressing a limitation the research keeps running into: manual red teaming that is realistic but hard to run at scale. The solution is in active development, building directly on the research foundation the partnership created.

This development project widens the circle beyond the original two partners. Alongside the Cyber-Defence Campus, which contributes expertise in AI, red teaming and cybersecurity research, it involves CR14, the state-established Estonian cyber competence centre that operates several NATO-level cyber ranges, and it is supported by Enterprise Estonia with 494,200 euros of funding, part of a total budget of more than 700,000 euros. The pieces sit at different stages: exercise scoring is already part of CybExer’s platform today, while the AI-driven adversary, the defensive support and the integrated Active Cyber Defence Solution are being developed through the collaboration.

All of this is developed and tested inside CybExer’s cyber range, a realistic but fully controlled environment where new AI-driven capabilities can be pushed hard and refined before they are put to use.

Staying ahead of AI-driven conflict

The partnership is focused on the capabilities cyber ranges will need in the years ahead, not only those required today.

“Looking to the future, our responsibility is to anticipate what cyber ranges will need to deliver in three or even five years’ time. This project is one in a series of initiatives ensuring that CybExer stays at the forefront of innovation, especially in the age of AI. This collaboration marks a significant step forward in bringing cutting-edge academic and applied research together to address the evolving needs of cyber defence.”

Lauri Almann, Co-Founder, CybExer

In the partners’ view, AI-driven cyber conflict is already a practical reality rather than a forecast. The collaboration gives them a shared basis for testing ideas developed through hands-on work, and for refining them as the threat landscape changes.

Research and operations, advancing together

The collaboration between CybExer and the Cyber-Defence Campus of armasuisse shows what becomes possible when a realistic testing environment meets rigorous research. What began as a joint research partnership in 2025 has grown into a funded development project, turning research questions into a solution now being built and tested. It points to a clear model for adopting AI in cyber defence: research and operational infrastructure advancing together, so that new systems are examined before anyone has to rely on them.