The paper presents methods for organizing decision-making and the functioning of deceptive multi-computer systems based on prior operational experience and multiple task execution options. A formal representation of system components and their interconnections is developed, distinguishing between the system center and the decision-making controller. The system center prepares possible task execution options, while the decision-making controller evaluates these options considering past performance and selects one. Analytical expressions are proposed to describe processes within multi-computer systems, enabling autonomous decision-making in task execution. A method is developed for organizing the decision-making controller’s operation to ensure the selection of a task option based on prior experience, component security levels, and system topology. This approach allows for the formation of polymorphic responses to external and internal actions in corporate networks. Additionally, a method for organizing system functioning enables systems to adapt their properties, structure, and interconnections in response to functional and cybersecurity conditions. This can be used especially in cybersecurity of critical infrastructure systems like electrical power grids, smart grid infrastructure, energy plants and industrial control systems. A prototype was developed and tested under two scenarios: choosing among five task options and having only one option. Results showed greater operational stability in the first case, confirming that incorporating prior experience enhances resilience and creates polymorphic responses that hinder attackers’ attempts to study and exploit corporate networks.

Modern corporate networks operate in increasingly complex and heterogeneous environments, which complicates the objective assessment of their current security state. This study proposes a dual-channel multi-level model for quantitative assessment of data security in corporate networks using a predefined list of indicators aligned with international cybersecurity standards. The model combines two analytical channels: compliance with security requirements and policies and absence of signs of compromise. Indicator values are normalized and successively aggregated to the levels of confidentiality, integrity and availability aspects; then to node-level scores; and finally to integrated network-level assessments, taking into account node criticality weights. The model was evaluated in a simulation environment using a 14-day scenario with four phases, including normal operation, controlled degradation of security-related indicators, partial recovery and active compromise of a critical node. The results showed that the proposed approach can distinguish between different types of security degradation, localize problematic nodes, identify the most affected security aspects and reveal the indicators responsible for the decline in integrated scores. A comparison with a simplified direct averaging approach was used as an analytical baseline to illustrate the difference between compensatory and non-compensatory channel integration under identical input data and scenario conditions. The results should therefore be interpreted as a controlled numerical demonstration of the model’s aggregation behavior rather than as a complete empirical validation against external cybersecurity assessment frameworks. The proposed model can serve as a basis for analytical security assessment and decision support in corporate networks.