  Cybersecurity planning supports the selection of and implementation of
security controls in resource-constrained settings to manage risk. Doing so
requires considering adaptive adversaries with different levels of strategic
sophistication in modeling efforts to support risk management. However, most
models in the literature only consider rational or non-strategic adversaries.
Therefore, we study how to inform defensive decision-making to mitigate the
risk from boundedly rational players, with a particular focus on making
integrated, interdependent planning decisions. To achieve this goal, we
introduce a modeling framework for selecting a portfolio of security
mitigations that interdict adversarial attack plans that uses a structured
approach for risk analysis. Our approach adapts adversarial risk analysis and
cognitive hierarchy theory to consider a maximum reliability path interdiction
problem with a single defender and multiple attackers who have different goals
and levels of strategic sophistication. Instead of enumerating all possible
attacks and defenses, we introduce a solution technique based on integer
programming and approximation algorithms to iteratively solve the defender's
and attackers' problems. A case study illustrates the proposed models and
provides insights into defensive planning.
