DPA27BZ02-DV001: Neurosymbolic Cyber COA Planning

Part of the DoW SBIR/STTR FY27 Release 2 topic list. Browse all 83 topics by industry or service.

Topic DPA27BZ02-DV001 from the DoW SBIR 2027 BAA, Release 2. Pre-release now; proposals due January 6, 2027, 12:00 PM ET.

Quick answer

DPA27BZ02-DV001 is a DARPA SBIR topic seeking a prototype that helps cyber planners generate, compare, explain, and rapidly replan cyber courses of action (COAs) using hyperdimensional, vector-symbolic, or neurosymbolic representations. It accepts Direct-to-Phase II proposals only. Proposals are due January 6, 2027, 12:00 PM ET.

Book a Free Fit Call

Solicitation at a glance

• Topic number: DPA27BZ02-DV001
• Official title: Hyperdimensional Neurosymbolic Cyber Course-of-Action Planning and Replanning under Deception
• Agency: DARPA
• Program: SBIR (DoW SBIR 2027 BAA, Release 2)
• Award type: Direct to Phase II (no Phase I awards); up to $1.3M plus a $500K option
• CMMC level: Level 2 (Self)
• ITAR: Yes. Export-controlled (ITAR/EAR); see topic text
• Technology areas: Information Systems
• Pre-release (direct TPOC contact allowed): November 4 to December 2, 2026, 8:00 AM ET
• Opens in DSIP: December 2, 2026, 8:00 AM ET
• Proposals due: January 6, 2027, 12:00 PM ET
• Official source: DSIP Topics app (search DPA27BZ02-DV001)

BW&CO's take

What the DARPA wants

DARPA wants cyber planning tools that keep an explicit, inspectable plan state, such as a mission graph or task web, rather than alerts, static attack graphs, or chatbot recommendations. The system should generate multiple feasible COAs, rank them on explicit criteria like mission value, exposure, and reversibility, and replan quickly when evidence is incomplete, delayed, or deceptive. It should also share compact symbolic summaries among distributed agents over degraded links. The 18-month Phase II base runs from a Month 3 steel-thread demo to a Month 18 final demonstration with documented software, APIs, baseline comparisons, and a transition path, with a 6-month Option period that may be included.

Who is a good fit

• Prior work applying hyperdimensional computing, vector-symbolic architectures, or neurosymbolic reasoning to cyber or mission-planning problems
• An existing prototype for structured cyber COA generation or comparison, with performance data against rule-based, static-graph, RL, or LLM baselines
• Experience with distributed reasoning or semantic state sharing under bandwidth or communications constraints
• Operator-facing planning interfaces with interpretable rationale, ideally backed by human-user studies or cyber-range results

Watch-outs

• Direct-to-Phase II only: Phase I proposals will not be accepted, and you must document Phase I-equivalent feasibility achieved outside the SBIR program.
• Not sought: generic dashboards, static attack-graph visualizers, anomaly detectors, signature-only defenses, and chatbot-style assistants without persistent structured state. The topic is also not primarily seeking exploit-generation tools, malware development, or automated offensive cyber execution.
• You must explain why your representation is superior to rule tables, static graph models, retraining-heavy black-box approaches, or exhaustive search in your target setting. The topic says a responsive solution should not treat hyperdimensional or neurosymbolic reasoning as novelty for its own sake.
• The topic metadata marks it as ITAR-restricted, so plan for export-control handling of technical data and possible limits on foreign national participation. The metadata lists CMMC Level 2 (Self).

Think your company fits DPA27BZ02-DV001? Talk with BW&CO before the January 6 deadline.

Plan Your DPA27BZ02-DV001 Submission

Official topic text (verbatim from DSIP)

The text in this section is copied word for word from the official DSIP topic as published on November 4, 2026. DSIP is the official source and topics can be amended. Always confirm the current version at dodsbirsttr.mil before you submit. Our commentary above is BW&CO's interpretation, not Government guidance.

Title

Hyperdimensional Neurosymbolic Cyber Course-of-Action Planning and Replanning under Deception

Objective

Develop and demonstrate prototype technologies that enable human planners and distributed cyber reasoning elements to generate, compare, explain, and rapidly replan cyber courses of action (COAs) under obfuscation, partial observability, degraded communications, and changing mission constraints using hyperdimensional and neurosymbolic representations that support compact memory, compositional reasoning, analogical retrieval, and low-overhead knowledge sharing.

Description

Future cyber operations will be conducted in contested environments in which observations are incomplete, timing is compressed, adversaries actively manipulate defender beliefs, and the state of the mission cannot be fully observed from any single node or operator position. In such settings, success depends not only on detecting malicious behavior, but on understanding what actions remain feasible, what dependencies govern those actions, which alternatives best satisfy mission objectives, and how plans should be revised as assumptions fail or new opportunities emerge.

Current cyber tools do not adequately support this planning problem. Many existing capabilities focus on alerting, anomaly scoring, static attack-path enumeration, or post hoc analytics. These functions are valuable, but they do not provide operators with an integrated capability to construct, compare, and revise cyber COAs as the environment changes. Rule-based playbooks can be brittle under novelty and obfuscation. Optimization and reinforcement-learning approaches may generate recommendations but often provide limited interpretability and can be difficult to adapt when observations are sparse, manipulated, or only partially relevant. Large-model assistants may accelerate interaction, but by themselves do not provide a persistent, auditable, machine-interpretable planning state suitable for operational use.

This topic seeks a new class of cyber planning technologies built around hyperdimensional, vector-symbolic, neurosymbolic, or closely related compositional reasoning methods. Of particular interest are approaches that maintain explicit internal representations of cyber objectives, prerequisites, access dependencies, branching opportunities, constraints, anticipated adversary reactions, and uncertainty in forms that are robust, updateable, and inspectable by both machines and operators. Hyperdimensional and related high-dimensional symbolic representations are of interest when they enable compact encoding of structured cyber context; efficient binding of entities, roles, temporal order, and dependencies; similarity-based retrieval across partially matching situations; graceful degradation under incomplete or deceptive observations; and deployment in resource-constrained or communications-constrained environments where retraining-heavy or centralized approaches are poor fits.

This topic seeks prototype capabilities that support cyber COA planning and replanning as structured decision processes rather than static checklists. Desired systems should represent plans through inspectable mission graphs, task webs, tiled workspaces, or comparable compositional artifacts in which each element captures sub-objectives, preconditions, dependencies, candidate actions, supporting evidence, uncertainty, timing, cost, reversibility, and mission relevance. The system should generate multiple feasible COAs for a stated objective, compare alternatives using explicit decision criteria, identify key assumptions and information gaps, and recommend revisions when new evidence changes branch viability or reveals newly feasible options.

A responsive solution should not treat hyperdimensional or neurosymbolic reasoning as novelty for its own sake. Instead, the proposer should clearly show how the chosen representation materially improves cyber planning performance in one or more of the following ways:

• compact encoding of evolving cyber context and plan structure without exhaustive recomputation;
• compositional updates as new observations, constraints, or objectives arrive;
• retrieval of relevant prior plan fragments or analogous situations under partial mismatch;
• maintenance of competing plan branches or hypotheses under obfuscation and ambiguity;
• lightweight exchange of decision-relevant symbolic or semantic representation among distributed agents or operator cells;
• interpretable rationale linking recommended actions to plan structure, assumptions, and uncertainty.

Representative operational settings of interest may include distributed mission networks, cyber support to software-reliant tactical platforms, planning for AI-enabled mission systems whose data or control pathways may be degraded or manipulated, or collaborative cyber planning cells operating with intermittent connectivity and incomplete common operating pictures. In these settings, no single operator or software agent may possess the entire relevant state. Accordingly, solutions should support selective sharing of compact, decision-relevant abstractions rather than requiring full-state synchronization, centralized fusion, or cloud-dependent reasoning.

The topic is especially interested in technologies that support one or more of the following planning functions:

• representation of cyber objectives, constraints, prerequisites, opportunities, and dependencies in machine-reasonable structured form;
• generation of multiple feasible COAs rather than a single opaque recommendation;
• comparison and ranking of alternative COAs using explicit criteria such as mission value, exposure, time-to-effect, reversibility, resource burden, and uncertainty;
• rapid replanning when observations are incomplete, delayed, deceptive, or contradictory, or when mission priorities change;
• distributed coordination through compact semantic or symbolic representation appropriate for degraded communications;
• operator-facing explanation that identifies why a plan is recommended, what assumptions drive it, what alternatives remain available, and what additional information would most improve the decision.

This topic is not seeking generic dashboards, static attack-graph visualizers, anomaly detectors, signature-only defenses, or chatbot-style assistants that provide recommendations without persistent structured state and auditable reasoning. Likewise, the topic is not primarily seeking exploit-generation tools, malware development, or automated offensive cyber execution. Proposed efforts should remain centered on interpretable planning and replanning support for cyber decision-making in contested environments.

Proposals should clearly define the operational user, the planning loop being supported, the boundaries of autonomy, and the expected decision advantage over current practice. Proposals should also explain why the chosen hyperdimensional, neurosymbolic, or related representation is superior to conventional rule tables, static graph models, retraining-heavy black-box approaches, or exhaustive search in the proposer’s target setting.

Relevant evaluation measures may include, but are not limited to:

time to first viable COA;

• quality and diversity of top-k recommended COAs;
• calibration of predicted plan utility or mission success likelihood;
• replanning latency after injected contradictory, incomplete, or deceptive evidence;
• robustness to novel tactics, techniques, and procedures or unseen mission contexts;
• bandwidth and compute burden for distributed coordination;
• memory, latency, and power performance on representative constrained hardware;
• operator comprehension, trust, workload, and explanation usefulness;
• performance relative to appropriate baseline approaches such as rule-based playbooks, static graph methods, optimization-only planners, reinforcement learning without explicit symbolic structure, or large-language-model-based planning assistants without grounded internal state.

Phase I

This topic solicits Direct-to-Phase-II (DP2) proposals only. Phase I proposals will not be accepted. Offerors must demonstrate Phase I-equivalent feasibility established outside of the SBIR program. DP2 feasibility documentation should substantiate meaningful prior technical maturity in one or more of the following relevant areas:

•  hyperdimensional, vector-symbolic, or neurosymbolic reasoning applied to cyber or mission-planning problems;
•  structured cyber COA generation or comparison;
•  adaptive replanning under uncertainty, obfuscation, or partial observability;
•  distributed reasoning or semantic state sharing under bandwidth or communications constraints;
•  operator-facing planning interfaces with interpretable rationale or recommendation support.

Feasibility evidence may include technical reports, white papers, architecture documents, prototype screenshots or videos, publications, patents, test data, cyber-range results, performance measurements, human-user studies, or other documentation sufficient to establish scientific merit, technical feasibility, and implementation maturity.

DP2 feasibility packages should clearly describe:

• the operational problem and target user;
• the core representational and reasoning approach;
• the existing prototype components or demonstrated technical building blocks;
• performance relative to baseline or alternative methods where available;
• major technical risks and mitigation strategy;
• a credible path to an integrated Phase II prototype demonstration in an operationally relevant environment.

Phase II

Phase II efforts will focus on developing, integrating, and demonstrating an operational prototype for hyperdimensional/neurosymbolic cyber COA planning and replanning under obfuscation. The prototype should enable planners or operators to construct or inspect planning structures, generate and compare multiple candidate COAs, revise recommendations as evidence evolves, and coordinate across distributed reasoning elements under realistic constraints.

At a minimum, the Phase II prototype should demonstrate:

• machine-interpretable representation of cyber objectives, sub-objectives, prerequisites, actions, constraints, dependencies, and uncertainty;
• generation of multiple feasible COAs for at least one representative cyber mission objective;
• comparison and ranking of COAs using explicit decision criteria and interpretable rationale;
• rapid replanning after injected ambiguity, contradiction, obfuscation, or mission change;
• lightweight knowledge exchange among distributed agents or planning cells using compact symbolic or semantic representations;
• operator-facing outputs suitable for human review, modification, intervention, and after-action analysis.

Of particular interest are prototypes that expose modular interfaces, documented APIs, and data structures suitable for future integration with cyber ranges, digital twins, mission rehearsal environments, or government evaluation infrastructure.

Phase II Base (18 months) – Schedule / Milestones / Deliverables

Month 1: Kickoff briefing and Systems Requirements Review. Deliverables should include updated technical approach, operational scenarios, user roles, architecture, evaluation metrics, baseline comparison plan, key technical risks, and mitigation strategy.

Month 3: Initial architecture package and end-to-end steel-thread demonstration. Prototype should show ingestion of representative planning context, construction of an initial structured mission graph or equivalent planning artifact, and generation of at least one candidate COA with operator-viewable rationale. Deliverables should include representation strategy, initial data model, and draft user workflow.

Month 6: Prototype v1 demonstrating generation and comparison of multiple COAs using hyperdimensional/neurosymbolic internal representations. Deliverables should include documented architecture, interface specifications, initial quantitative metrics, and updated test and evaluation plan.

Month 9: Interim demonstration of rapid replanning in at least one contested scenario involving incomplete, delayed, conflicting, or deceptive observations. The system should show how plan structure, recommended alternatives, and uncertainty change in response to new evidence. Deliverables should include interim performance report and comparison against at least one relevant baseline.

Month 12: Demonstration of distributed reasoning or coordination under degraded or intermittent communications using compact decision-relevant symbolic or semantic summaries. Deliverables should quantify communications burden, update behavior, and planning performance relative to an appropriate centralized or non-symbolic baseline.

Month 15: Operationally relevant demonstration with multiple COAs, dynamic mission constraints, and operator-in-the-loop plan revision. Deliverables should include updated APIs, user guidance, architecture documentation, and interim human-factors or usability assessment.

Month 18: Final Phase II demonstration and report. Deliverables should include documented prototype software, system design documentation, scenario definitions, evaluation results, baseline comparisons, operator guidance, known limitations, and recommended transition path.

Phase II Option (6 months)

If included, the Option period may focus on prototype maturation in a more operationally realistic environment, expanded scenario diversity, stronger red-team challenge problems, or additional integration with government-relevant infrastructure.

Illustrative Option activities may include:

• scaling to larger mission graphs or larger distributed planning teams;
• expanded evaluation against state-of-the-art baseline methods;
• integration with a government-identified cyber range, digital twin, or mission-planning environment;
• demonstration of unseen-scenario generalization and robustness.

Illustrative Option deliverables may include:

Month 21: Expanded prototype demonstration with additional scenario complexity, broader coordination requirements, or stronger adversarial challenge conditions.

Month 24: Final Option-period demonstration and final report documenting performance, scalability, limitations, integration guidance, and transition recommendations.

Phase III Dual Use Applications

Military applications include cyber mission planning, decision support for software-reliant and AI-enabled systems, decision support for cyber operators in contested environments, planning support for distributed mission networks, cyber range training and rehearsal, and support to broader multi-domain operational planning where cyber actions and dependencies must be reasoned about explicitly.

Commercial applications include enterprise cyber planning, incident response decision support, critical infrastructure resilience, industrial control system operations, managed security operations, complex remediation planning, cloud-edge cyber coordination, and other settings in which organizations must compare and revise multi-step cyber response options under uncertainty, incomplete information, and time pressure.

The resulting technology is intended to provide an interpretable and operationally relevant planning capability rather than a standalone analytic. Transition opportunities may exist wherever rapid comparison and replanning of cyber action sequences are required under constrained communications, partial observability, or high operator workload.

References

1. R. Masukawa, S. Yun, S. Jeong, W. Huang, Y. Ni, I. Bryant, N. D. Bastian, and M. Imani. PACKETCLIP: Multi-Modal Embedding of Network Traffic and Language for Cybersecurity Reasoning. Frontiers in Artificial Intelligence, Vol. 8, Art. 1593944, 2025. doi: 10.3389/frai.2025.1593944. Available: https://www.frontiersin.org/journals/artificial-intelligence/articles/10.3389/frai.2025.1593944/full

2. S. B. Hakim, M. Adil, A. Velasquez, S. Xu, and H. H. Song. Neuro-Symbolic AI for Cybersecurity: State of the Art, Challenges, and Opportunities. arXiv preprint arXiv:2509.06921, 2026. Available: https://arxiv.org/pdf/2509.06921

3. B. Jalaian and N. D. Bastian. Neurosymbolic AI in Cybersecurity: Bridging Pattern Recognition and Symbolic Reasoning. In MILCOM 2023 - 2023 IEEE Military Communications Conference (MILCOM), pp. 268-273, 2023. doi: 10.1109/MILCOM58377.2023.10356283. Available: https://ieeexplore.ieee.org/document/10356283

4. A. Sheth, K. Roy, and M. Gaur. Neurosymbolic AI — Why, What, and How. IEEE Intelligent Systems, Vol. 38, No. 3, pp. 56-62, 2023. arXiv preprint arXiv:2305.00813. doi: 10.48550/arXiv.2305.00813. Available: https://arxiv.org/abs/2305.00811

Keywords

Cyber operations, course of action planning, replanning, obfuscation, partial observability, hyperdimensional computing, neurosymbolic reasoning, vector-symbolic architectures, distributed planning, human-machine teaming,

Frequently asked questions

What is DPA27BZ02-DV001?

It is a DARPA SBIR topic in the DoW SBIR 2027 BAA titled Hyperdimensional Neurosymbolic Cyber Course-of-Action Planning and Replanning under Deception. It seeks interpretable planning and replanning support for cyber decision-making in contested environments.

When is DPA27BZ02-DV001 due?

Proposals are due January 6, 2027, 12:00 PM ET. Pre-release began November 4, 2026, and direct contact with the topic authors (TPOCs) is allowed only until the topic opens on December 2, 2026, 8:00 AM ET.

Is this Phase I or Direct-to-Phase II?

Direct-to-Phase II only. Phase I proposals will not be accepted. The topic describes an 18-month Phase II base and a 6-month Option that may be included, and the feasibility package must show Phase I-equivalent feasibility established outside SBIR.

How will proposed systems be evaluated?

The topic lists measures such as time to first viable COA, quality and diversity of top-k COAs, replanning latency after injected contradictory or deceptive evidence, bandwidth and compute burden for distributed coordination, memory, latency, and power on constrained hardware, operator comprehension and trust, and performance against baselines such as rule-based playbooks or LLM planning assistants without grounded internal state.

Book a Free Fit Call