We developed a simulation game to study the effectiveness of decision-makers in overcoming two complexities in building cybersecurity capabilities: potential delays in capability development; and uncertainties in predicting cyber incidents. Analyzing 1,479 simulation runs, we compared the performances of a group of experienced professionals with those of an inexperienced control group. Experienced subjects did not understand the mechanisms of delays any better than inexperienced subjects; however, experienced subjects were better able to learn the need for proactive decision-making through an iterative process. Both groups exhibited similar errors when dealing with the uncertainty of cyber incidents. Our findings highlight the importance of training for decision-makers with a focus on systems thinking skills, and lay the groundwork for future research on uncovering mental biases about the complexities of cybersecurity.

中文翻译：

---

网络安全能力开发中的决策和偏见：来自模拟游戏实验的证据

我们开发了一个模拟游戏来研究决策者在克服网络安全能力建设的两个复杂性方面的有效性：能力开发的潜在延迟；以及预测网络事件的不确定性。通过分析1,479次模拟运行，我们将一组经验丰富的专业人员的绩效与一个经验不足的对照组的绩效进行了比较。有经验的受试者比没有经验的受试者更不了解延迟的机制。但是，有经验的受试者可以通过迭代过程更好地了解主动决策的需求。在处理网络事件的不确定性时，两组都表现出相似的错误。我们的发现突出了对决策者进行培训的重要性，这些决策者应侧重于系统思考技能，