Reinforcement Learning for Adaptive and Safe Cyber Defence: A Systematic Literature Review

Abstract

Reinforcement learning (RL) has attracted interest as a means of adapting cybersecurity decisions to changing attacks and network conditions. However, learned defensive actions may also disrupt legitimate services, raising questions about operational safety and practical deployment. This review examines RL algorithms, cyber defence applications, safety mechanisms, evaluation practices, and research gaps through a structured thematic synthesis of 20 publications from 2021–2026. The literature includes empirical evaluations, surveys, conceptual frameworks, and contextual studies; the 20-publication set should not be interpreted as the verified result of an exhaustive PRISMA search. The evidence covers Q-learning and deep Q-networks, policy and actor–critic methods, and multi-agent RL for intrusion detection, threat mitigation, and resource-aware orchestration. Safety-oriented approaches use risk-sensitive rewards, constrained Markov decision processes, and runtime action shielding to manage potentially harmful decisions. Reported results indicate promise in specific simulated and benchmark settings, but heterogeneous evaluation protocols prevent direct cross-study rankings. Key limitations include limited real-world testing, inconsistent safety and service-availability measures, computational overhead, and insufficient validation under unseen attacks or distribution shifts. The study concludes that future cyber defence systems should jointly evaluate detection, mitigation, and operational safety using reproducible protocols, realistic deployment constraints, and explicit safety enforcement. Completing verifiable search and screening records remains necessary before presenting the manuscript as a fully PRISMA-compliant systematic review.