Blue wins if we cheat (and that's fair) home-turf advantage for AI defenders in Active Directory

We built two autonomous LLM agents and locked them in an Active Directory forest together.

The Red Agent knows AD the way attackers do: tradecraft, tooling, BloodHound, Kerberoast, DCSync, and the patience to try everything twice. 

In Round 1, the Blue Agent knows AD the way a fresh-hire SOC analyst does — general knowledge, no environment specifics, just vibes and event logs. Red wins. It is not even close.

Then we cheat.

In Round 2, we hand Blue the thing every real defender already has — or should: an asset inventory, a tier model, a list of legitimate service accounts and their SPNs, a crown-jewel map, and the detections already deployed in the SIEM. Same Red Agent. Same forest. Same foothold. Different outcome.

The argument of the talk is simple and slightly uncomfortable: AI defenders don't lose because the models are weak. They lose because we point them at environments they've never been told about and expect them to out-improvise attackers who only need to be right once. Context isn't cheating. Context is the whole job. Red has zero-days; Blue has the blueprints — if anyone bothered to write them down.

You'll watch duels with the agents'. We'll talk exactly which Red actions Blue caught only after being grounded, which ones it missed in both rounds, and moments Blue hallucinated a detection and got it wrong anyway.

Everyone is selling AI SOC analyst. Almost none of them are talking about the prerequisite that determines whether those analysts work at all: whether the defender has written down what its own environment looks like in a form a model can consume. This talk puts that prerequisite on stage and measures it in a duel, against a real autonomous adversary, in the environment that still owns most enterprises: Active Directory.