## 3 Methodology
### Simultaneous Move Game Model
#### 3.2.4 Solution of the Extended Simultaneous Move Game Model  
Let \(x^{*}=\frac{1}{1+\omega(1-2p_{1})}\) and \(y^{*}=\frac{1}{1+\omega(1-2p_{2})}\). We have the following proposition:  
**Proposition 2**. : _(i) If \(C_{cyb}<2\beta(p_{1}-p_{2})\), then_  
\[BNE(\Gamma_{1})=\left\{ \begin{array}{ll}\text{Unique pure strategy}\ \Big{(}R_{cyb}^{M}R_{aut}^{L}\,D_{accept}\ \Big{)}&\text{ if }0<\delta<y^{*}\\ \text{Mixed strategy}\ \big{(}\lambda_{1}^{*},1-\lambda_{1}^{*}\big{)} \ \text{and}\ \big{(}\eta_{1}^{*},1-\eta_{1}^{*}\big{)}&\text{ if }y^{*}<\delta<x^{*}\\ \text{Unique pure strategy}\ \big{(}R_{aut}^{M}R_{aut}^{L}\,D_{reject}\ \big{)}&\text{ if }x^{*}<\delta<1\end{array} \right. \tag{3}\]  
_The mixed strategies \(\eta_{1}^{*}\) and \(\lambda_{1}^{*}\) are given by Equation (A13) and Equation (A16), respectively, in Appendix B._  
_(ii) If \(C_{cyb}>2\beta(p_{1}-p_{2})\), then_  
\[BNE(\Gamma_{1})=\left\{ \begin{array}{ll}\text{Unique pure strategy}\ \big{(}R_{aut}^{M}\ R_{aut}^{L}\,D_{accept}\ \big{)}&\text{ if }0<\delta<x^{*}\\ \text{Unique pure strategy}\ \big{(}R_{aut}^{M}\ R_{aut}^{L}\,D_{reject}\ \big{)}&\text{ if }x^{*}<\delta<1\end{array} \right. \tag{4}\]  
Proof. : See Appendix B. \(\square\)  
The results of Proposition 2 extend the analysis by considering two probability parameters, \(p_{1}\) and \(p_{2}\), representing the likelihoods of malicious behavior by insiders under different conditions. The equilibrium strategies are influenced by the relationship between the cost of a cyberattack \(\Big{(}C_{cyb}\Big{)}\) and the threshold value \(2\beta(p_{1}-p_{2})\). When \(C_{cyb}<2\beta(p_{1}-p_{2})\),  
* If \(0<\delta<y^{*}\), the unique pure strategy equilibrium indicates that malicious insiders launch cyberattacks \(\Big{(}R_{cyb}^{M}\Big{)}\), legitimate insiders authenticate \(\big{(}R_{aut}^{L}\ \big{)}\), and the defender accepts the access request \(\big{(}D_{\text{accept}}\big{)}\). * If \(y^{*}<\delta<x^{*}\), t mixed strategy equilibrium arises, with malicious insiders mixing between cyberattacks and authentication strategies \(\big{(}\lambda_{1}^{*}\ \text{and}\ 1-\lambda_{1}^{*}\big{)}\) and legitimate insiders also adopting a probabilistic authentication strategy \(\big{(}\eta_{1}^{*}\ \text{and}\ 1-\eta_{1}^{*}\big{)}\). The defender adjusts probabilistically. * If \(x^{*}<\delta<1\), both malicious and legitimate insiders select authentication \(\big{(}R_{aut}^{M},R_{aut}^{L}\big{)}\) but the defender rejects the access request \(\big{(}D_{\text{reject}}\big{)}\). For \(C_{cgly}<2\beta(p_{1}-p_{2})\), the defender's strategies shift dynamically as \(\delta\) (the probability of a malicious insider) increases:  
* At low \(\delta\), the defender is inclined to accept requests, reflecting a trust-oriented strategy when the malicious probability is low. * For intermediate \(\delta\), mixed strategies dominate, reflecting the defender's uncertainty and the malicious insider's strategic adaptation. * At high \(\delta\), rejection becomes the optimal strategy to mitigate the risk posed by potentially malicious insiders. When \(C_{cgly}>2\beta(p_{1}-p_{2})\),
* If \(0<\delta<x^{*}\), the unique pure strategy equilibrium involves all insiders selecting authentication \(\left(R_{aut}^{M},R_{aut}^{L}\right)\) and the defender accepts the request \(\left(D_{\text{accept}}\right)\). * If \(x^{*}<\delta<1\), the strategy shifts, with all insiders continuing to authenticate, but the defender rejects the access request (\(D_{\text{reject}}\)). Higher costs of launching a cyberattack (\(C_{cgly}\)) discourage malicious insiders from attacking, leading to more consistent behavior. The defender's response aligns with the increasing probability of malicious insiders, transitioning from acceptance to rejection as \(\delta\) grows. The results illustrate how the interplay between attack cost, insider probabilities, and the likelihood parameters \(p_{1}\) and \(p_{2}\) governs the strategic behavior of insiders and defenders.