Translating and Validating Loss Aversion for Cyber Security

Loss aversion refers to the tendency for decision-makers to weigh losses more heavily than equivalent gains. While it has been studied extensively in many domains and has a strong basis in the experimental literature, it has not been studied specifically in cybersecurity. This paper lays the groundwork for translating and measuring loss aversion in decisions relevant to cyber attackers. We conducted two experiments; the first adapts established tasks into a survey with a cybersecurity framing to assess construct validity and sensitivity to potential moderators. The second considers decisions embedded in richer cyber attack scenarios to examine loss aversions across decision stages and goal framings. Our results show that the proportion of risky action selections reliably reflects aggregate-level loss aversion, and is robust across varying payoff and probability magnitudes (including near zero and one). The stake effect significantly influences loss aversion, with greater impact at higher magnitudes. Stage effects and goal framing further modulate attacker behavior, providing insights for psychologically informed cyber defense strategies.