Cybersecurity is typically characterised as being between defenders and attackers. The economic analysis of such situations is made using either simple normal form games or Stackelberg game or dynamic games. We draw upon experiences in the telecommunications operator and standardisation domain in this study. While this model suffices for the understanding of the basic concepts, it does not and can not capture many of the subtle realities of the cybersecurity environment. Indeed it can result in a misunderstanding of the nature of threats when the defender is not under active attack.
We construct a model consisting of more roles and introduce the notion of an explicit security concept with a value to each of the participants or roles. Using this model we can explore the individual sub-games between participants and roles through dynamic games with imperfect information. In the former, we can understand the internal dynamics for any given security control, while in the latter we obtain a larger overall understanding of the players and their actions. Two results that are of particular interest in the studied domain are where the distinction between ‘foes’ and ‘allies’ is lost and where the absence of an attack cannot be understood as the absence of an attack.

Keywords: Cybersecurity, Game Theory, Economics of cyber security, Attackers, Cyber insurance.