Zero-Days at Machine Speed: systemic cyber-risk simulation (model card)
A Monte Carlo model of a stylised Thai-like banking system, calibrated to CISA KEV exploitation rates, used in
Zero-Days at Machine Speed (Thanatchon Chongmankhong, 2026). This repository holds no weights: the model
is a parametric simulation, fully specified by model_specs.json, the sim_*.csv tables and s07_simulation.py (fixed seed).
- 📖 Paper online: https://thanatchon36.github.io/ai-zeroday-banking/paper/
- 💻 Code: https://github.com/thanatchon36/ai-zeroday-banking
- 🤗 Dataset: https://huggingface.co/datasets/thanatchon36/ai-zeroday-banking
What it simulates
One year of vulnerabilities in six shared commercial product layers (edge/VPN, managed file transfer, email/collaboration, IT management/RMM, virtualisation, enterprise apps). Each zero-day or n-day can compromise banks and service providers by mass campaigns, targeted attacks or exposure before patching; compromised providers propagate to clients. An event is systemic when it disrupts at least 10% of payment value, including via the RTGS or retail switch.
Scenarios: pre-2022 baseline, AI offence (×3 offensive capacity), AI offence + AI-enabled defence, and vendor
concentration variants (sim_params.csv).
Headline outputs
- Tripling AI offensive capacity raises the annual probability of a systemic payment disruption about 5× (4.0–6.8×).
- AI-enabled defence removes 50–75% of the increase; vendor concentration adds 36–64%.
Files
| File | Content |
|---|---|
model_specs.json |
Scalar constants: seed, systemic threshold, layers, FMI pass-through, clients per provider, propagation, deployment, hit rates, n-day hazard, patch dispersion (scenarios and groups are in the CSVs below) |
s07_simulation.py |
The simulation code |
sim_params.csv, sim_groups.csv, sim_layer_calibration.csv |
Scenario parameters, institution groups, layer calibration to KEV |
sim_scenarios.csv, sim_grid.csv, sim_robustness.csv |
Results, sensitivity grid and robustness checks |
Intended use and limits
For research and policy discussion of systemic cyber risk. The system is stylised, not Thailand; parameters are stated assumptions; results are relative (scenario vs baseline), not forecasts. It contains no exploit code and assesses no named institution.