  Normative decision theory proves inadequate for modeling human responses to
the social-engineering campaigns of Advanced Persistent Threat (APT) attacks.
Behavioral decision theory fares better, but still falls short of capturing
social-engineering attack vectors, which operate through emotions and
peripheral-route persuasion. We introduce a generalized decision theory, under
which any decision will be made according to one of multiple coexisting choice
criteria. We denote the set of possible choice criteria by $\mathcal{C}$. Thus
the proposed model reduces to conventional Expected Utility theory when
$|\,\mathcal{C}_{\text{EU}}|=1$, whilst Dual-Process (thinking fast vs.
thinking slow) decision making corresponds to a model with
$|\,\mathcal{C}_{\text{DP}}|=2$. We consider a more general case with
$|\,\mathcal{C}|\geq 2$, which necessitates careful consideration of _how_, for
a particular choice-task instance, one criterion comes to prevail over others.
We operationalize this with a probability distribution that is conditional upon
traits of the decision maker as well as upon the context and the framing of
choice options. Whereas existing Signal Detection Theory (SDT) models of
phishing detection commingle the different peripheral-route persuasion
pathways, in the present descriptive generalization the different pathways are
explicitly identified and represented. A number of implications follow
immediately from this formulation, ranging from the conditional nature of
security-breach risk to delineation of the prerequisites for valid tests of
security training. Moreover, the model explains the `stepping-stone'
penetration pattern of APT attacks, which has confounded modeling approaches
based on normative rationality.
