Welcome to this special issue of the Journal of Defense Modeling and Simulation on ‘Cyber Defense: Methodologies and Techniques for Evaluation’. The cyber domain has emerged as a strategic national asset of interest to both military and civilian sectors. The overlap between military and commercial networking resources and infrastructure complicates issues of protection, defense, and offense. The defense community is tasked not only with protecting our military information systems commercially procured, but also in protecting our nation’s strategically vital enterprises. Homeland defense rests squarely on our ability to guard critical infrastructure control systems that have a wide range of exploitable vulnerabilities. In this issue we look at several publications that make contributions related to securing the cyber domain: (1) a formal model to capture human behavior in the cyber realm; (2) modeling results that capture efficacy of Global Information Grid awareness through Network Tasking Orders (NTOs); (3) performance modeling for virtual environments that aid in defensive training scenarios; (4) a model for attack analysis on underlying network control protocols; and (5) simulation results comparing centralization methods used in log-based security systems. Robinson and Cybenko tackle the issue of capturing and analyzing human behavior related to observable actions conducted by users in the cyber domain. Little work has been done in modeling cyber-specific human behavior and their paper presents a novel extension to traditional topic modeling. Using their methodology, more precise data analysis activities may be conducted to extract quantitative information related to cyber security. By translating normal topic models related to document handling, they derive more cyber-appropriate characteristics such as users, sessions, activities, and behaviors. Using weighted probabilities and sampling distributions, appropriate matrices may be derived that are useful for classifying patterns of behavior and probabilistic models for predictive analysis. By analyzing user behaviors in such a way, a key layer of cyber situational awareness is created: changes in historical user behaviors may indicate telltale signs of insider activity or malicious corruption. Cyber planners and operators, particularly in the Department of Defense (DoD), face the problem of how to manage cyber assets to ensure synchronization of efforts and economy of force. Although air planners have longed benefited from the Air Tasking Order (ATO: a daily allocation of air assets to support current mission requirements), the cyber domain has no correlation. Compton et al. propose the use of a NTO to help allocate resources in the DoD’s Global Information Grid, particularly for mobile assets that are part of highly dynamic network topologies. Although NTOs are not a new concept, Compton and colleagues use the concept to specifically optimize network resources as opposed to using them for supporting air missions themselves (the traditional use to date). By building upon the traditional structure of an ATO, this paper providers a clear translation to cyberspecific tasking and shows how a prior knowledge of network resources may be used in simulations during the NTO planning phase to support Quality of Service goals during execution. A major area of research within DoD currently revolves around how to defend host machines and network resources themselves. Grimaila et al. compare methods for collecting, logging, and correlating events used for defensive analysis. Centralized logging, the traditional method for event correlation, comes with shortfalls because it does