## 3 Methodology
### Simultaneous Move Game Model
#### 3.2.2 Solution of the Game: Bayesian Nash Equilibrium (BNE)  
Let \(x_{1}=\frac{1}{1+\omega(1-p_{1})}\) and \(y_{1}=\frac{1}{1+\omega}\). Then, we solve the game model and present the solution in the following proposition.  
**Proposition 1**.: _(i) If \(C_{cyb}<\beta p_{1}\), then_  
\[BNE(\Gamma)=\left\{\begin{array}{ll}\text{Unique pure strategy}\,\left(R_{cyb}^{M}R_{\text{aut}}^{L}\,,D_{\text{accept}}\,\right)&\text{ if }0<\delta<y_{1}\\ \text{Mixed strategy}\,\left(\lambda^{*},1-\lambda^{*}\right)\text{ and }\left(\eta^{*},1-\eta^{*}\right)&\text{ if }y_{1}<\delta<x_{1}\\ \text{Unique pure strategy}\,\left(R_{\text{aut}}^{M}\,R_{\text{aut}}^{L}\,,D_{ \text{reject}}\,\right)&\text{ if }x_{1}<\delta<1\end{array}\right. \tag{1}\]  
_Here, \(\eta^{*}\) and \(\lambda^{*}\) are given by Equation (A1) and Equation (A2), respectively, in Appendix A. (ii) If \(C_{cyb}>\beta p_{1}\), then_  
\[BNE(\Gamma)=\left\{\begin{array}{ll}\text{Unique pure strategy}\,\left(R_{ \text{aut}}^{M}\,R_{\text{aut}}^{L}\,,D_{\text{accept}}\,\right)&\text{ if }0<\delta<x_{1}\\ \text{Unique pure strategy}\,\left(R_{\text{aut}}^{M}\,R_{\text{aut}}^{L}\,,D_{ \text{reject}}\,\right)&\text{ if }x_{1}<\delta<1\end{array}\right. \tag{2}\]  
Proof.: See Appendix A. \(\square\)  
The results of Proposition 1 provide insights into the optimal strategies of insiders (malicious or legitimate) and defenders based on the probability \(\delta\) of an insider being malicious. The solutions are categorized based on the relationship between the cost of a cyberattack \(C_{cyb}\) and the benefit of the attack \(\beta p_{1}\).  
When \(C_{cyb}<\beta p_{1}\),  
* If \(0<\delta<y_{1}\), the unique pure strategy equilibrium suggests that malicious insiders opt for cyberattacks \(\left(R_{cyb}^{M}\right)\), while legitimate insiders choose authentication \(\left(R_{\text{aut}}^{L}\right)\). The defender, in response, accepts the data access request \(\big{(}D_{\text{accept}}\,\big{)}\).  
* If \(y_{1}<\delta<x_{1}\), a mixed strategy equilibrium emerges, with malicious insiders alternating between cyberattacks and authentication (\(\lambda^{*}\) and \(1-\lambda^{*}\)) and legitimate insiders also using authentication with probability \(\lambda^{*}\). The defender adapts probabilistically.
* If \(x_{1}<\delta<1\), both malicious and legitimate insiders choose authentication \(\left(R_{\text{aut}}^{M}\ R_{\text{aut}}^{L}\ \right)\) but the defender rejects the access request \(\left(D_{\text{reject}}\right)\).  
This scenario illustrates the increasing cautiousness of the defender as the probability of an insider being malicious (\(\delta\)) rises. For lower values of \(\delta\), the defender prefers to grant access, balancing potential risks. For intermediate values, the strategies diversify, reflecting uncertainty. For high \(\delta\), a strict rejection policy dominates, protecting sensitive data.  
When \(C_{cyb}>\beta p_{1}\),  
* If \(0<\delta<x_{1}\), the unique pure strategy equilibrium involves all insiders choosing authentication \(\left(R_{aut}^{M},R_{aut}^{L}\right)\), and the defender grants access \(\left(D_{\text{accept}}\right)\).
* If \(x_{1}<\delta<1\), the strategy shifts, with all insiders continuing to authenticate, but the defender now rejects access (\(D_{\text{reject}}\) ).  
Higher costs of launching a cyberattack discourage malicious insiders from pursuing such strategies. The defender's responses align with the increasing probability of malicious intent, transitioning from acceptance to rejection as \(\delta\) grows.  
The results demonstrate how the interplay between attack cost, benefit, and malicious probability (\(\delta\)) governs the strategic behavior of both insiders and the defender.