HYPER-CAP | SBIR

OUSW (R&E) CRITICAL TECHNOLOGY AREA(S): Applied Super Intelligence, Quantum and Battlefield Information Dominance

The technology within this topic is restricted under the International Traffic in Arms Regulation (ITAR), 22 CFR Parts 120-130, which controls the export and import of defense-related material and services, including export of sensitive technical data, or the Export Administration Regulation (EAR), 15 CFR Parts 730-774, which controls dual use items. Offerors must disclose any proposed use of foreign nationals (FNs), their country(ies) of origin, the type of visa or work permit possessed, and the statement of work (SOW) tasks intended for accomplishment by the FN(s) in accordance with the Announcement. Offerors are advised foreign nationals proposed to perform on this topic may be restricted due to the technical data under US Export Control Laws.

PROJECTED CMMC LEVEL REQUIREMENT: Level 2 (self)

Objective: Develop and demonstrate prototype technologies that enable human planners and distributed cyber reasoning elements to generate, compare, explain, and rapidly replan cyber courses of action (COAs) under obfuscation, partial observability, degraded communications, and changing mission constraints using hyperdimensional and neurosymbolic representations that support compact memory, compositional reasoning, analogical retrieval, and low-overhead knowledge sharing.

Description: Future cyber operations will be conducted in contested environments in which observations are incomplete, timing is compressed, adversaries actively manipulate defender beliefs, and the state of the mission cannot be fully observed from any single node or operator position. In such settings, success depends not only on detecting malicious behavior, but on understanding what actions remain feasible, what dependencies govern those actions, which alternatives best satisfy mission objectives, and how plans should be revised as assumptions fail or new opportunities emerge.

Current cyber tools do not adequately support this planning problem. Many existing capabilities focus on alerting, anomaly scoring, static attack-path enumeration, or post hoc analytics. These functions are valuable, but they do not provide operators with an integrated capability to construct, compare, and revise cyber COAs as the environment changes. Rule-based playbooks can be brittle under novelty and obfuscation. Optimization and reinforcement-learning approaches may generate recommendations but often provide limited interpretability and can be difficult to adapt when observations are sparse, manipulated, or only partially relevant. Large-model assistants may accelerate interaction, but by themselves do not provide a persistent, auditable, machine-interpretable planning state suitable for operational use.

This topic seeks a new class of cyber planning technologies built around hyperdimensional, vector-symbolic, neurosymbolic, or closely related compositional reasoning methods. Of particular interest are approaches that maintain explicit internal representations of cyber objectives, prerequisites, access dependencies, branching opportunities, constraints, anticipated adversary reactions, and uncertainty in forms that are robust, updateable, and inspectable by both machines and operators. Hyperdimensional and related high-dimensional symbolic representations are of interest when they enable compact encoding of structured cyber context; efficient binding of entities, roles, temporal order, and dependencies; similarity-based retrieval across partially matching situations; graceful degradation under incomplete or deceptive observations; and deployment in resource-constrained or communications-constrained environments where retraining-heavy or centralized approaches are poor fits.

This topic seeks prototype capabilities that support cyber COA planning and replanning as structured decision processes rather than static checklists. Desired systems should represent plans through inspectable mission graphs, task webs, tiled workspaces, or comparable compositional artifacts in which each element captures sub-objectives, preconditions, dependencies, candidate actions, supporting evidence, uncertainty, timing, cost, reversibility, and mission relevance. The system should generate multiple feasible COAs for a stated objective, compare alternatives using explicit decision criteria, identify key assumptions and information gaps, and recommend revisions when new evidence changes branch viability or reveals newly feasible options.

A responsive solution should not treat hyperdimensional or neurosymbolic reasoning as novelty for its own sake. Instead, the proposer should clearly show how the chosen representation materially improves cyber planning performance in one or more of the following ways:

• compact encoding of evolving cyber context and plan structure without exhaustive recomputation;
• compositional updates as new observations, constraints, or objectives arrive;
• retrieval of relevant prior plan fragments or analogous situations under partial mismatch;
• maintenance of competing plan branches or hypotheses under obfuscation and ambiguity;
• lightweight exchange of decision-relevant symbolic or semantic representation among distributed agents or operator cells;
• interpretable rationale linking recommended actions to plan structure, assumptions, and uncertainty.

Representative operational settings of interest may include distributed mission networks, cyber support to software-reliant tactical platforms, planning for AI-enabled mission systems whose data or control pathways may be degraded or manipulated, or collaborative cyber planning cells operating with intermittent connectivity and incomplete common operating pictures. In these settings, no single operator or software agent may possess the entire relevant state. Accordingly, solutions should support selective sharing of compact, decision-relevant abstractions rather than requiring full-state synchronization, centralized fusion, or cloud-dependent reasoning.

The topic is especially interested in technologies that support one or more of the following planning functions:

• representation of cyber objectives, constraints, prerequisites, opportunities, and dependencies in machine-reasonable structured form;
• generation of multiple feasible COAs rather than a single opaque recommendation;
• comparison and ranking of alternative COAs using explicit criteria such as mission value, exposure, time-to-effect, reversibility, resource burden, and uncertainty;
• rapid replanning when observations are incomplete, delayed, deceptive, or contradictory, or when mission priorities change;
• distributed coordination through compact semantic or symbolic representation appropriate for degraded communications;
• operator-facing explanation that identifies why a plan is recommended, what assumptions drive it, what alternatives remain available, and what additional information would most improve the decision.

This topic is not seeking generic dashboards, static attack-graph visualizers, anomaly detectors, signature-only defenses, or chatbot-style assistants that provide recommendations without persistent structured state and auditable reasoning. Likewise, the topic is not primarily seeking exploit-generation tools, malware development, or automated offensive cyber execution. Proposed efforts should remain centered on interpretable planning and replanning support for cyber decision-making in contested environments.

Proposals should clearly define the operational user, the planning loop being supported, the boundaries of autonomy, and the expected decision advantage over current practice. Proposals should also explain why the chosen hyperdimensional, neurosymbolic, or related representation is superior to conventional rule tables, static graph models, retraining-heavy black-box approaches, or exhaustive search in the proposer’s target setting.

Relevant evaluation measures may include, but are not limited to: time to first viable COA;

• quality and diversity of top-k recommended COAs;
• calibration of predicted plan utility or mission success likelihood;
• replanning latency after injected contradictory, incomplete, or deceptive evidence;
• robustness to novel tactics, techniques, and procedures or unseen mission contexts;
• bandwidth and compute burden for distributed coordination;
• memory, latency, and power performance on representative constrained hardware;
• operator comprehension, trust, workload, and explanation usefulness;
• performance relative to appropriate baseline approaches such as rule-based playbooks, static graph methods, optimization-only planners, reinforcement learning without explicit symbolic structure, or large-language-model-based planning assistants without grounded internal state.

Phase I

This topic solicits Direct-to-Phase-II (DP2) proposals only. Phase I proposals will not be accepted. Offerors must demonstrate Phase I-equivalent feasibility established outside of the SBIR program. DP2 feasibility documentation should substantiate meaningful prior technical maturity in one or more of the following relevant areas:

• hyperdimensional, vector-symbolic, or neurosymbolic reasoning applied to cyber or mission-planning problems;
• structured cyber COA generation or comparison;
• adaptive replanning under uncertainty, obfuscation, or partial observability;
• distributed reasoning or semantic state sharing under bandwidth or communications constraints;
• operator-facing planning interfaces with interpretable rationale or recommendation support.

Feasibility evidence may include technical reports, white papers, architecture documents, prototype screenshots or videos, publications, patents, test data, cyber-range results, performance measurements, human-user studies, or other documentation sufficient to establish scientific merit, technical feasibility, and implementation maturity.

DP2 feasibility packages should clearly describe:

• the operational problem and target user;
• the core representational and reasoning approach;
• the existing prototype components or demonstrated technical building blocks;
• performance relative to baseline or alternative methods where available;
• major technical risks and mitigation strategy;
• a credible path to an integrated Phase II prototype demonstration in an operationally relevant environment.

Phase II

Phase II efforts will focus on developing, integrating, and demonstrating an operational prototype for hyperdimensional/neurosymbolic cyber COA planning and replanning under obfuscation. The prototype should enable planners or operators to construct or inspect planning structures, generate and compare multiple candidate COAs, revise recommendations as evidence evolves, and coordinate across distributed reasoning elements under realistic constraints.

At a minimum, the Phase II prototype should demonstrate:

• machine-interpretable representation of cyber objectives, sub-objectives, prerequisites, actions, constraints, dependencies, and uncertainty;
• generation of multiple feasible COAs for at least one representative cyber mission objective;
• comparison and ranking of COAs using explicit decision criteria and interpretable rationale;
• rapid replanning after injected ambiguity, contradiction, obfuscation, or mission change;
• lightweight knowledge exchange among distributed agents or planning cells using compact symbolic or semantic representations;
• operator-facing outputs suitable for human review, modification, intervention, and after-action analysis.

Of particular interest are prototypes that expose modular interfaces, documented APIs, and data structures suitable for future integration with cyber ranges, digital twins, mission rehearsal environments, or government evaluation infrastructure.

Phase II Base (18 months) – Schedule / Milestones / Deliverables

Month 1: Kickoff briefing and Systems Requirements Review. Deliverables should include updated technical approach, operational scenarios, user roles, architecture, evaluation metrics, baseline comparison plan, key technical risks, and mitigation strategy.

Month 3: Initial architecture package and end-to-end steel-thread demonstration. Prototype should show ingestion of representative planning context, construction of an initial structured mission graph or equivalent planning artifact, and generation of at least one candidate COA with operator-viewable rationale. Deliverables should include representation strategy, initial data model, and draft user workflow.

Month 6: Prototype v1 demonstrating generation and comparison of multiple COAs using hyperdimensional/neurosymbolic internal representations. Deliverables should include documented architecture, interface specifications, initial quantitative metrics, and updated test and evaluation plan.

Month 9: Interim demonstration of rapid replanning in at least one contested scenario involving incomplete, delayed, conflicting, or deceptive observations. The system should show how plan structure, recommended alternatives, and uncertainty change in response to new evidence. Deliverables should include interim performance report and comparison against at least one relevant baseline.

Month 12: Demonstration of distributed reasoning or coordination under degraded or intermittent communications using compact decision-relevant symbolic or semantic summaries. Deliverables should quantify communications burden, update behavior, and planning performance relative to an appropriate centralized or non-symbolic baseline.

Month 15: Operationally relevant demonstration with multiple COAs, dynamic mission constraints, and operator-in-the-loop plan revision. Deliverables should include updated APIs, user guidance, architecture documentation, and interim human-factors or usability assessment.

Month 18: Final Phase II demonstration and report. Deliverables should include documented prototype software, system design documentation, scenario definitions, evaluation results, baseline comparisons, operator guidance, known limitations, and recommended transition path.

Phase II Option (6 months)

If included, the Option period may focus on prototype maturation in a more operationally realistic environment, expanded scenario diversity, stronger red-team challenge problems, or additional integration with government-relevant infrastructure.

Illustrative Option activities may include:

• scaling to larger mission graphs or larger distributed planning teams;
• expanded evaluation against state-of-the-art baseline methods;
• integration with a government-identified cyber range, digital twin, or mission-planning environment;
• demonstration of unseen-scenario generalization and robustness.

Illustrative Option deliverables may include:

Month 21: Expanded prototype demonstration with additional scenario complexity, broader coordination requirements, or stronger adversarial challenge conditions.

Month 24: Final Option-period demonstration and final report documenting performance, scalability, limitations, integration guidance, and transition recommendations.

Phase III dual use applications

Military applications include cyber mission planning, decision support for software-reliant and AI-enabled systems, decision support for cyber operators in contested environments, planning support for distributed mission networks, cyber range training and rehearsal, and support to broader multi-domain operational planning where cyber actions and dependencies must be reasoned about explicitly.

Commercial applications include enterprise cyber planning, incident response decision support, critical infrastructure resilience, industrial control system operations, managed security operations, complex remediation planning, cloud-edge cyber coordination, and other settings in which organizations must compare and revise multi-step cyber response options under uncertainty, incomplete information, and time pressure.

The resulting technology is intended to provide an interpretable and operationally relevant planning capability rather than a standalone analytic. Transition opportunities may exist wherever rapid comparison and replanning of cyber action sequences are required under constrained communications, partial observability, or high operator workload.

References

1. R. Masukawa, S. Yun, S. Jeong, W. Huang, Y. Ni, I. Bryant, N. D. Bastian, and M. Imani. PACKETCLIP: Multi-Modal Embedding of Network Traffic and Language for Cybersecurity Reasoning. Frontiers in Artificial Intelligence, Vol. 8, Art. 1593944, 2025. doi: 10.3389/frai.2025.1593944. Available: https://www.frontiersin.org/journals/artificial-intelligence/articles/10.3389/frai.2025.1593944/full
2. S. B. Hakim, M. Adil, A. Velasquez, S. Xu, and H. H. Song. Neuro-Symbolic AI for Cybersecurity: State of the Art, Challenges, and Opportunities. arXiv preprint arXiv:2509.06921, 2026. Available: https://arxiv.org/pdf/2509.06921
3. 3. B. Jalaian and N. D. Bastian. Neurosymbolic AI in Cybersecurity: Bridging Pattern Recognition and Symbolic Reasoning. In MILCOM 2023 - 2023 IEEE Military Communications Conference (MILCOM), pp. 268-273, 2023. doi: 10.1109/MILCOM58377.2023.10356283. Available: https://ieeexplore.ieee.org/document/10356283
4. 4. A. Sheth, K. Roy, and M. Gaur. Neurosymbolic AI — Why, What, and How. IEEE Intelligent Systems, Vol. 38, No. 3, pp. 56-62, 2023. arXiv preprint arXiv:2305.00813. doi: 10.48550/arXiv.2305.00813. Available: https://arxiv.org/abs/2305.00813

Keywords

Cyber operations, course of action planning, replanning, obfuscation, partial observability, hyperdimensional computing, neurosymbolic reasoning, vector-symbolic architectures, distributed planning, human-machine teaming,

TPOC-1-PoC

DARPA BAA Help Desk

Email

SBIR_BAA@darpa.mil

Ready to apply?

For additional information and to submit your full proposal package, visit the DSIP Portal.