Three threads, all asking what changes when the adversary is a bounded decision maker rather than a perfect optimizer.
Quantal Stackelberg deception
What a defender should commit to when the attacker responds noisily and the noise model may itself be wrong.
Security games usually let the defender commit to a strategy and assume the attacker answers with a best response. I replace that step with a quantal response and ask what the defender should do when even the noise model may be misspecified. This style of planning works like insurance. It gives up a little value when the attacker model is right and protects a lot of it when the model is wrong, and the main theorem holds for any finite Stackelberg game with logit response. The testbed is a cyber-physical network of sixteen nodes built from real CVE entries with CVSS derived exploit probabilities.
Behavioral experiments on how people actually pick targets, and process models fit to those choices.
People choosing from big menus with lots of information often make slower and worse decisions, and cyber attackers are no exception. In behavioral experiments on tasks like file exfiltration, more options and denser information degraded the quality of targeting. The sharper result is that attribute detail rather than option count is what breaks the link between a person's stated preferences and their observed choice, and that the collapse is invisible to the measures practitioners usually trust, since outcome quality and self reported difficulty both fail to track it. That points toward defenses that work by making the attacker's decision harder rather than only making the system stronger.
Detectors evaluated only on threats they were never trained on.
Alongside the game theoretic work I build detectors for adversary infrastructure, and the organizing constraint is that they are scored on what they have never seen. One line fine tunes language models for domain generation algorithms and DNS exfiltration across 59 real world families, with families withheld from training rather than shuffled into it. Another models each malware family as a class conditional spherical decision boundary and separates in distribution from out of distribution samples with no out of distribution data at training time.