## 2 Related Work  
Research has been conducted to deal with cybersecurity issues in critical infrastructures [10]. Various approaches have also been used to mitigate insider threats [11]. [PERSON] et al. [12] addressed the joint threat from an advanced persistent threat (APT) attacker and insiders targeting a resource defender employing a differential game approach. The scenario in [12] considered a malicious insider who collaborates with the APT attacker by exchanging sensitive information, such as passwords, to help them achieve their malicious goals. Meanwhile, the defender employs countermeasures to regain control of the compromised resources. In the attack process, however, the defender does not consider any prior beliefs about an insider as to whether he/she would act as a regular or malicious one, which is necessary to respond to the possible threats caused by the insider. In addition, how the data/information is obtained by the malicious insider is not specified [12]. [PERSON] et al. [13] discussed malicious insider attacks in a nuclear power plant based on an evolutionary game model. In this model, a malicious insider has two options, i.e., to perform or not perform the adversarial attacks. At the same time, the plant's defender can implement either a severe punishment scheme or a less strict penalty for malicious insiders. Their proposed game solutions show how insiders would behave concerning their emotions. [PERSON] et al. [14, 15] also proposed a Stackelberg game model of defender-adversary interactions along with the possibility of various insiders being involved in a nuclear facility attack. Their analyses identified which insider threat was more critical concerning the facility's security. In the models proposed by [PERSON] et al. [13] and [PERSON] et al. [15], the defender/security department has no preconceived idea about how its employees will behave towards sensitive resources. Furthermore, the authors in [13, 15] did not specify how the malicious goal is achieved; in other words, whether authentication or cyberattack is to be launched against the resources to obtain access/steal the resources or sabotage the facilities. [PERSON] al. [16] presented a model to detect malicious insider threats using a zero-sum stochastic game assuming partially observable states. [PERSON] et al. [17] also proposed a repeated game model in which insiders interact with the system defender, an intrusion detection system (IDS). Their model predicts future interactions between insiders and the system defender. In addition, [PERSON] et al. [18] developed a model based on a Bayesian network to predict insider threats prior to a data breach, taking into account various aspects such as technological, organizational, and human factors. The model draws on various components to predict the probability of insider threat risk. However, in these works [16; 17; 18], no penalty for malicious insiders is imposed, which is a crucial demotivating factor as to whether or not an insider would commit malicious acts to optimize his/her gain or benefits. [PERSON] et al. [19] introduced a secure team selection framework where the team manager has a secret to share with her team, whereas an insider attacker wants to learn the secret by bribing one of the potential team members. The scenario is analyzed using a stochastic game. [PERSON] et al. [20] and [PERSON] [21] discussed a game model in which an insider can take part in the game between an attacker and the system defender. The insider can help achieve the attacker's goal while sharing the revenue. In addition, an incentive-based model was introduced by [PERSON] et al. [22] to mitigate malicious insider threats. The concept of synergy has been explored in game theory to understand how collaboration among players can enhance outcomes through mutual assistance and interdependence.