## Appendix D  
**Proof of Proposition 4.** (i) If \(p_{2}>\frac{1}{2}\), we have \(y_{21}>y_{22}\) and \(y_{23}>y_{24}\). Therefore, the strategy \(D_{\text{accept}}^{aut}\,D_{\text{reject}}^{cby}\) is dominated by \(D_{\text{accept}}^{aut}\,D_{\text{accept}}^{cby}\) and the reduced matrix can be written as  
\[\begin{array}{ccc}R_{\text{aut}}^{M}\,R_{\text{aut}}^{L}\\ R_{\text{cyb}}^{M}\,R_{\text{aut}}^{L}\\ \end{array}\begin{bmatrix}D_{\text{accept}}^{\text{aut}}\,D_{\text{accept}}^{ \text{cyb}}&D_{\text{reject}}^{\text{aut}}\,D_{\text{accept}}^{cby}&D_{\text{ reject}}^{\text{aut}}\,D_{\text{reject}}^{cby}\\ (x_{11},y_{11})&(x_{13},y_{13})&(x_{14},y_{14})\\ (x_{21},y_{21})&(x_{23},y_{23})&(x_{24},y_{24})\end{bmatrix}\]  
Also, it can be shown that \(y_{13}=y_{14}=0\); therefore, the strategy \(D_{\text{reject}}^{\text{aut}}\,D_{\text{reject}}^{cby}\) is dominated by the strategy \(D_{\text{reject}}^{\text{aut}}\,D_{\text{accept}}^{cby}\). Hence, we have the following payoff matrix:  
\[\begin{array}{ccc}R_{\text{aut}}^{M}\,R_{\text{aut}}^{L}\\ R_{\text{cyb}}^{M}\,R_{\text{aut}}^{L}\\ \end{array}\begin{bmatrix}D_{\text{accept}}^{\text{aut}}\,D_{\text{accept}}^{ cby}&D_{\text{reject}}^{\text{aut}}\,D_{\text{accept}}^{cbyb}\\ (x_{11},y_{11})&(x_{13},y_{13})\\ (x_{21},y_{21})&(x_{23},y_{23})\end{bmatrix}\]  
In the matrix, the relation \(y_{21}>y_{23}\) always holds. Therefore, we consider \(y_{11}\) and \(y_{13}\). It can be verified that if \(\delta<x^{*}\), then \(y_{11}>y_{13}\). This leads to the following matrix:  
\[\begin{array}{ccc}R_{\text{aut}}^{M}\,R_{\text{aut}}^{L}\\ R_{\text{cyb}}^{M}\,R_{\text{aut}}^{L}\\ \end{array}\begin{bmatrix}D_{\text{accept}}^{\text{aut}}\,D_{\text{accept}}^{ cby}\\ (x_{11},y_{11})\\ (x_{21},y_{21})\end{bmatrix}\]  
If \(C_{\text{cyb}}>2\beta(p_{1}-p_{2})\), then \(x_{11}>x_{21}\). Thus, \(\left(R_{\text{aut}}^{M}\,R_{\text{aut}}^{L}\,\right.,D_{\text{accept}}^{ \text{aut}}\,D_{\text{accept}}^{cby}\,\right)\) is a BNE, whereas, if \(C_{\text{cyb}}<2\beta(p_{1}-p_{2})\), then \(\left(R_{\text{cyb}}^{M}R_{\text{aut}}^{L}\,D_{\text{accept}}^{\text{aut}}\,D_{ \text{accept}}^{cby}\,\right)\) is a BNE of the game.  
(ii) We now consider \(\delta>x^{*}\) and \(p_{2}>\frac{1}{2}\). We know that \(\delta>x^{*}\) only when \(p_{1}<\frac{1}{2}\). Let us recall that \(p_{1}>p_{2}\). Thus, this contradicts the condition being considered, i.e., \(p_{2}>\frac{1}{2}\). Hence, there is no equilibrium in this case. \(\square\)  
\begin{table}
\begin{tabular}{c l} \hline \hline
**Notation** & **Meaning** \\ \hline \(R_{\text{aut}}\) & Request through authentication \\ \hline \(R_{\text{cyb}}\) & Request through cyberattack \\ \hline \(D_{\text{accept}}\) & Accept data access request and release data \\ \hline \(D_{\text{reject}}\) & Reject data access request and do not release data \\ \hline \(C_{\text{cyb}}\) & Cost of cyberattack \\ \hline \(\mathcal{H}_{1}\) & Action set of an insider \\ \hline \(\mathcal{H}_{d}\) & Action set of the defender \\ \hline \(\Omega\) & Type set of an insider \\ \hline \(S_{1}\) & Pure strategy set of an insider in the simultaneous move \\ \(\text{gamemodel}\) \\ \hline \(S_{D}\) & Pure strategy set of the defender in the simultaneous move \\ \(\text{gamemodel}\) \\ \hline \(S_{1}^{{}^{\prime}}\) & Pure strategy set of an insider in the sequential move game model \\ \hline \(\omega\) & Payoff due to discovery of malicious insider identity or \\ \hline \hline \end{tabular}
\end{table}
Table 10: Notations and their meanings.