Abstract

Cybersecurity remains reactive, engaging adversaries post -target selection. This work -in-progress introduces EVADE (Evasion via Adversarial Decision Engineering), a proactive framework to influence pre-attack adversary decision -making by reducing perceived target attractiveness. Grounded in demarketing theory and the AIDA model from consumer behavior, EVADE maps passive (visibility reduction, obfuscation) and active (decoys, honeypots) deception tactics onto attacker decision stages. Our explorative qualitative inquiry (eight expert interviews, one focus group, 1150 threat observation archives ) confirms the relevance of treating cybercriminals as ration al-but-biased actors operating under bounded rationality. EVADE aligns with the behavioral stream of Information Systems by addressing the underexplored ‘intent’ phase in threat mode lling. Findings show high applicability to financially motivated actors, where low -cost passive measures offer deterrence with minimal ethical concerns. Active strategies provide intelligence value but raise deployment constraints. EVADE contributes to attacker -centric, socio -technical cybersecurity design, advancing pre -emptive deterrence beyond traditional reactive models

Download

Share

COinS