## 6 Conclusions and Future Work  
CDEs have emerged as critical platforms for enhancing collaboration and data management in the AEC industry, particularly with the increasing adoption of BIM. While CDEs have the potential to secure sensitive project information, insider threats--where authorized users misuse their access privileges--remain a significant concern. These threats, which may involve data theft, modification, or leakage, can result in substantial financial losses, intellectual property theft, and strategic disadvantages for construction companies. In this study, we developed game-theoretic models based on Bayesian games, that is a game of incomplete information, to better understand and predict malicious insider behavior within CDEs. These models account for both static and dynamic interactions between insiders, who may act as either malicious or legitimate, and the data defender. Through the application of these models to two real project scenarios (a high-rise building and a theme park), we demonstrated how different project types and sensitivity levels of information (e.g., structural design files and resource management files) affected the interaction between the insiders and the defender. Our models provided insights into how malicious insiders, driven by various motivations such as financial gain or espionage, might behave in these settings and highlighted the corresponding strategies the defender can adopt to mitigate these threats. The findings of this research offer valuable practical guidance for improving CDE security, especially in high-risk construction projects involving sensitive data. By considering various insider threat scenarios, we provide actionable recommendations for enhancing existing cybersecurity protocols in the AEC industry, particularly in response to insider threats, which are often more difficult to detect than external attacks. As the industry continues to digitize, these insights are crucial for securing sensitive construction data and ensuring the success of collaborative, data-driven projects. The proposed models offer a strategic approach for both mitigating insider threats and supporting the ongoing efforts to bolster cybersecurity in the construction sector. The growing adoption of large language models (LLMs) in cybersecurity is transforming the field by leveraging their abilities, such as in-context learning, instruction following, and step-by-step reasoning, to address complex challenges [49]. These capabilities enable LLMs to solve downstream tasks, such as cryptographic operations and data protection, without extensive retraining, presenting a novel approach to enhancing cybersecurity systems. Moreover, advancements in prompt engineering have further optimized LLM performance, making them effective tools for mitigating evolving cyber threats [49]. Integrating LLMs with game-theoretic models could unlock new opportunities for designing robust, adaptive cybersecurity solutions that address both external and insider threats within the AEC industry. Therefore, the use of LLMs and generative AI will be investigated in future work. Conceptualization, K.L., S.G., B.G.d.S., D.Y. and M.S.S. ; methodology, K.L., S.G., B.G.d.S., D.Y. and M.S.S. ; software, K.L., D.Y. and M.S.S. ; validation, K.L., S.G., B.G.d.S., D.Y. and M.S.S. ; formal analysis, K.L., S.G., B.G.d.S., D.Y. and M.S.S. ; investigation, K.L., S.G., B.G.d.S., D.Y. and M.S.S. ; resources, K.L., S.G., B.G.d.S., D.Y. and M.S.S. ; data curation, K.L., B.G.d.S., D.Y. and M.S.S. ; writing--original draft preparation, K.L., S.G., B.G.d.S., D.Y. and M.S.S. ; writing--review and editing, K.L., S.G., B.G.d.S., D.Y. and M.S.S. ; visualization, K.L., S.G., B.G.d.S., D.Y. and M.S.S. ; supervision, S.G. and B.G.d.S. ; project administration, S.G. and B.G.d.S. ; funding acquisition, S.G. and B.G.d.S. All authors have read and agreed to the published version of the manuscript.