Setting Priorities in Behavioral Interventions: An Application to Reducing Phishing Risk

Phishing risk is a growing area of concern for corporations, governments, and individuals. Given the evidence that users vary widely in their vulnerability to phishing attacks, we demonstrate an approach for assessing the benefits and costs of interventions that target the most vulnerable users. Our approach uses Monte Carlo simulation to (1) identify which users were most vulnerable, in signal detection theory terms; (2) assess the proportion of system‐level risk attributable to the most vulnerable users; (3) estimate the monetary benefit and cost of behavioral interventions targeting different vulnerability levels; and (4) evaluate the sensitivity of these results to whether the attacks involve random or spear phishing. Using parameter estimates from previous research, we find that the most vulnerable users were less cautious and less able to distinguish between phishing and legitimate emails (positive response bias and low sensitivity, in signal detection theory terms). They also accounted for a large share of phishing risk for both random and spear phishing attacks. Under these conditions, our analysis estimates much greater net benefit for behavioral interventions that target these vulnerable users. Within the range of the model's assumptions, there was generally net benefit even for the least vulnerable users. However, the differences in the return on investment for interventions with users with different degrees of vulnerability indicate the importance of measuring that performance, and letting it guide interventions. This study suggests that interventions to reduce response bias, rather than to increase sensitivity, have greater net benefit.     

Experimental Evidence Against the Paradigm of Mortality Risk Aversion

This article deals with the question of how societal impacts of fatal accidents can be integrated into the management of natural or man‐made hazards. Today, many governmental agencies give additional weight to the number of potential fatalities in their risk assessments to reflect society's aversion to large accidents. Although mortality risk aversion has been proposed in numerous risk management guidelines, there has been no evidence that lay people want public decisionmakers to overweight infrequent accidents of large societal consequences against more frequent ones of smaller societal consequences. Furthermore, it is not known whether public decisionmakers actually do such overweighting when they decide upon the mitigation of natural or technical hazards. In this article, we report on two experimental tasks that required participants to evaluate negative prospects involving 1–100 potential fatalities. Our results show that neither lay people nor hazard experts exhibit risk‐averse behavior in decisions on mortality risks.     

Implied Preference for Seismic Design Level and Earthquake Insurance

Seismic risk can be reduced by implementing newly developed seismic provisions in design codes. Furthermore, financial protection or enhanced utility and happiness for stakeholders could be gained through the purchase of earthquake insurance. If this is not so, there would be no market for such insurance. However, perceived benefit associated with insurance is not universally shared by stakeholders partly due to their diverse risk attitudes. This study investigates the implied seismic design preference with insurance options for decisionmakers of bounded rationality whose preferences could be adequately represented by the cumulative prospect theory (CPT). The investigation is focused on assessing the sensitivity of the implied seismic design preference with insurance options to model parameters of the CPT and to fair and unfair insurance arrangements. Numerical results suggest that human cognitive limitation and risk perception can affect the implied seismic design preference by the CPT significantly. The mandatory purchase of fair insurance will lead the implied seismic design preference to the optimum design level that is dictated by the minimum expected lifecycle cost rule. Unfair insurance decreases the expected gain as well as its associated variability, which is preferred by risk-averse decisionmakers. The obtained results of the implied preference for the combination of the seismic design level and insurance option suggest that property owners, financial institutions, and municipalities can take advantage of affordable insurance to establish successful seismic risk management strategies.     

Deterrence and Risk Preferences in Sequential Attacker–Defender Games with Continuous Efforts

Most attacker–defender games consider players as risk neutral, whereas in reality attackers and defenders may be risk seeking or risk averse. This article studies the impact of players' risk preferences on their equilibrium behavior and its effect on the notion of deterrence. In particular, we study the effects of risk preferences in a single‐period, sequential game where a defender has a continuous range of investment levels that could be strategically chosen to potentially deter an attack. This article presents analytic results related to the effect of attacker and defender risk preferences on the optimal defense effort level and their impact on the deterrence level. Numerical illustrations and some discussion of the effect of risk preferences on deterrence and the utility of using such a model are provided, as well as sensitivity analysis of continuous attack investment levels and uncertainty in the defender's beliefs about the attacker's risk preference. A key contribution of this article is the identification of specific scenarios in which the defender using a model that takes into account risk preferences would be better off than a defender using a traditional risk‐neutral model. This study provides insights that could be used by policy analysts and decisionmakers involved in investment decisions in security and safety.     

Communicating Conservation Status: How Different Statistical Assessment Criteria Affect Perceptions of Extinction Risk

Although alternative forms of statistical and verbal information are routinely used to convey species’ extinction risk to policymakers and the public, little is known about their effects on audience information processing and risk perceptions. To address this gap in literature, we report on an experiment that was designed to explore how perceptions of extinction risk differ as a function of five different assessment benchmarks (Criteria A–E) used by scientists to classify species within IUCN Red List risk levels (e.g., Critically Endangered, Vulnerable), as well as the role of key individual differences in these effects (e.g., rational and experiential thinking styles, environmental concern). Despite their normative equivalence within the IUCN classification system, results revealed divergent effects of specific assessment criteria: on average, describing extinction risk in terms of proportional population decline over time (Criterion A) and number of remaining individuals (Criterion D) evoked the highest level of perceived risk, whereas the single‐event probability of a species becoming extinct (Criterion E) engendered the least perceived risk. Furthermore, participants scoring high in rationality (analytic thinking) were less prone to exhibit these biases compared to those low in rationality. Our findings suggest that despite their equivalence in the eyes of scientific experts, IUCN criteria are indeed capable of engendering different levels of risk perception among lay audiences, effects that carry direct and important implications for those tasked with communicating about conservation status to diverse publics.     

Marginal Trust in Risk Managers: Building and Losing Trust Following Decisions Under Uncertainty

Although a considerable amount of research has examined correlates of baseline public trust in risk managers, much less research has looked at marginal changes in public trust following specific events. Such research is important for identifying what kinds of events will lead to increases and decreases in public trust and thus for understanding how trust is built and lost. Using a taxonomy based upon signal detection theory (SDT), the current article presents two experimental studies examining marginal trust change following eight different types of events. Supporting predictions, cautious decisionmakers who accepted signs of danger (Hits and False Alarms) were more likely to be trusted than those who rejected them (All Clears and Misses). Moreover, transparency about an event was associated with higher levels of marginal trust than a lack of transparency in line with earlier findings. Contrary to predictions, however, trust was less affected by whether the decisions were correct (i.e., Hits and All Clears) or incorrect (i.e., False Alarms and Misses). This finding was primarily due to a "False Alarm Effect" whereby Open False Alarms led to positive increases in trust despite being incorrect assessments of risk. Results are explained in terms of a cue diagnosticity account of impression formation and suggest that a taxonomy of event types based on SDT may be useful in furthering our understanding of how public trust in risk managers is gained and lost.     

Adversarial Risk Analysis with Incomplete Information: A Level‐k Approach

This article proposes, develops, and illustrates the application of level‐k game theory to adversarial risk analysis. Level‐k reasoning, which assumes that players play strategically but have bounded rationality, is useful for operationalizing a Bayesian approach to adversarial risk analysis. It can be applied in a broad class of settings, including settings with asynchronous play and partial but incomplete revelation of early moves. Its computational and elicitation requirements are modest. We illustrate the approach with an application to a simple defend‐attack model in which the defender's countermeasures are revealed with a probability less than one to the attacker before he decides on how or whether to attack.     

Adaptive Flood Risk Management Under Climate Change Uncertainty Using Real Options and Optimization

It is well recognized that adaptive and flexible flood risk strategies are required to account for future uncertainties. Development of such strategies is, however, a challenge. Climate change alone is a significant complication, but, in addition, complexities exist trying to identify the most appropriate set of mitigation measures, or interventions. There are a range of economic and environmental performance measures that require consideration, and the spatial and temporal aspects of evaluating the performance of these is complex. All these elements pose severe difficulties to decisionmakers. This article describes a decision support methodology that has the capability to assess the most appropriate set of interventions to make in a flood system and the opportune time to make these interventions, given the future uncertainties. The flood risk strategies have been explicitly designed to allow for flexible adaptive measures by capturing the concepts of real options and multiobjective optimization to evaluate potential flood risk management opportunities. A state‐of‐the‐art flood risk analysis tool is employed to evaluate the risk associated to each strategy over future points in time and a multiobjective genetic algorithm is utilized to search for the optimal adaptive strategies. The modeling system has been applied to a reach on the Thames Estuary (London, England), and initial results show the inclusion of flexibility is advantageous, while the outputs provide decisionmakers with supplementary knowledge that previously has not been considered.     

Price Incentives and Coordination in a Two‐Product Decentralized Supply Chain

We investigate pricing incentives for competing retailers who distribute two variants of a manufacturer's product in a decentralized supply chain. Under a two‐dimensional Hotelling model, we derive decentralized retailers' prices for the products, and distortions in pricing when compared to centrally optimal prices. We show that price distortions decrease as consumers' travel cost between retailers increases, due to less intense competition. However, price distortions do not change monotonically in consumers' switching cost between products within stores. To fix decentralized retailers' price distortions, we construct a two‐part pricing contract that coordinates the supply chain. We show that the coordinating contract is Pareto‐improving and analyze increase in the supply chain profit under coordination.     

Insurance,Public Assistance,and Household Flood Risk Reduction: A Comparative Study of Austria,England, and Romania

In light of increasing losses from floods, many researchers and policymakers are looking for ways to encourage flood risk reduction among communities, business, and households. In this study, we investigate risk‐reduction behavior at the household level in three European Union Member States with fundamentally different insurance and compensation schemes. We try to understand if and how insurance and public assistance influence private risk‐reduction behavior. Data were collected using a telephone survey (n = 1,849) of household decisionmakers in flood‐prone areas. We show that insurance overall is positively associated with private risk‐reduction behavior. Warranties, premium discounts, and information provision with respect to risk reduction may be an explanation for this positive relationship in the case of structural measures. Public incentives for risk‐reduction measures by means of financial and in‐kind support, and particularly through the provision of information, are also associated with enhancing risk reduction. In this study, public compensation is not negatively associated with private risk‐reduction behavior. This does not disprove such a relationship, but the negative effect may be mitigated by factors related to respondents' capacity to implement measures or social norms that were not included in the analysis. The data suggest that large‐scale flood protection infrastructure creates a sense of security that is associated with a lower level of preparedness. Across the board there is ample room to improve both public and private policies to provide effective incentives for household‐level risk reduction.     

Risk Matrix Integrating Risk Attitudes Based on Utility Theory

Recent studies indicate that absence of the consideration of risk attitudes of decisionmakers in the risk matrix establishment process has become a major limitation. In order to evaluate risk in a more comprehensive manner, an approach to establish risk matrices that integrates risk attitudes based on utility theory is proposed. There are three main steps within this approach: (1) describing risk attitudes of decisionmakers by utility functions, (2) bridging the gap between utility functions and the risk matrix by utility indifference curves, and (3) discretizing utility indifference curves. A complete risk matrix establishment process based on practical investigations is introduced. This process utilizes decisionmakers’ answers to questionnaires to formulate required boundary values for risk matrix establishment and utility functions that effectively quantify their respective risk attitudes.     

The Use of Narrative Evidence and Explicit Likelihood by Decisionmakers Varying in Numeracy

Decisionmakers are often presented with explicit likelihood assessments (e.g., there is a 10% chance that an attack will occur over the next three months) and supporting narrative evidence in forecasting and risk communication domains. Decisionmakers are thought to rely on both numerical and narrative information to the extent that they perceive the information to be diagnostic, accurate, and trustworthy. In two studies, we explored how lay decisionmakers varying in numeracy evaluated and used likelihood assessments and narrative evidence in forecasts. Overall, the less numerate reported higher risk and likelihood perceptions. In simple probabilistic forecasts without narrative evidence, decisionmakers at all levels of numeracy were able to use the stated likelihood information, although risk perceptions of the less numerate were more affected by likelihood format. When a forecast includes narrative evidence, decisionmakers were better able to use stated likelihood in a percentage as compared to frequency or verbal formats. The more numerate used stated likelihood more in their evaluations whereas the less numerate focused more on the narrative evidence. These results have important implications for risk analysts and forecasters who need to report the results of their analyses to decisionmakers. Decisionmakers varying in numerical ability may evaluate forecasts in different ways depending on the types of information they find easiest to evaluate.     

Confluence and Contours: Reflexive Management of Environmental Risk

Government institutions have responsibilities to distribute risk management funds meaningfully and to be accountable for their choices. We took a macro‐level sociological approach to understanding the role of government in managing environmental risks, and insights from micro‐level psychology to examine individual‐level risk‐related perceptions and beliefs. Survey data from 2,068 U.K. citizens showed that lay people's funding preferences were associated positively with beliefs about responsibility and trust, yet associations with perception varied depending on risk type. Moreover, there were risk‐specific differences in the funding preferences of the lay sample and 29 policymakers. A laboratory‐based study of 109 participants examined funding allocation in more detail through iterative presentation of expert information. Quantitative and qualitative data revealed a meso‐level framework comprising three types of decisionmakers who varied in their willingness to change funding allocation preferences following expert information: adaptors, responders, and resistors. This research highlights the relevance of integrated theoretical approaches to understanding the policy process, and the benefits of reflexive dialogue to managing environmental risks.     

Should the Model for Risk‐Informed Regulation be Game Theory Rather than Decision Theory?

Risk analysts frequently view the regulation of risks as being largely a matter of decision theory. According to this view, risk analysis methods provide information on the likelihood and severity of various possible outcomes; this information should then be assessed using a decision‐theoretic approach (such as cost/benefit analysis) to determine whether the risks are acceptable, and whether additional regulation is warranted. However, this view ignores the fact that in many industries (particularly industries that are technologically sophisticated and employ specialized risk and safety experts), risk analyses may be done by regulated firms, not by the regulator. Moreover, those firms may have more knowledge about the levels of safety at their own facilities than the regulator does. This creates a situation in which the regulated firm has both the opportunity—and often also the motive—to provide inaccurate (in particular, favorably biased) risk information to the regulator, and hence the regulator has reason to doubt the accuracy of the risk information provided by regulated parties. Researchers have argued that decision theory is capable of dealing with many such strategic interactions as well as game theory can. This is especially true in two‐player, two‐stage games in which the follower has a unique best strategy in response to the leader's strategy, as appears to be the case in the situation analyzed in this article. However, even in such cases, we agree with Cox that game‐theoretic methods and concepts can still be useful. In particular, the tools of mechanism design, and especially the revelation principle, can simplify the analysis of such games because the revelation principle provides rigorous assurance that it is sufficient to analyze only games in which licensees truthfully report their risk levels, making the problem more manageable. Without that, it would generally be necessary to consider much more complicated forms of strategic behavior (including deception), to identify optimal regulatory strategies. Therefore, we believe that the types of regulatory interactions analyzed in this article are better modeled using game theory rather than decision theory. In particular, the goals of this article are to review the relevant literature in game theory and regulatory economics (to stimulate interest in this area among risk analysts), and to present illustrative results showing how the application of game theory can provide useful insights into the theory and practice of risk‐informed regulation.     

Institutionalized Ignorance as a Precondition for Rational Risk Expertise

The present case study seeks to explain the conditions for experts’ rational risk perception by analyzing the institutional contexts that constitute a field of food safety expertise in Denmark. The study highlights the role of risk reporting and how contextual factors affect risk reporting from the lowest organizational level, where concrete risks occur, to the highest organizational level, where the body of professional risk expertise is situated. The article emphasizes the role of knowledge, responsibility, loyalty, and trust as risk‐attenuation factors and concludes by suggesting that the preconditions for the expert's rationality may rather be a lack of risk‐specific knowledge due to poor risk reporting than a superior level of risk knowledge.     

Stochastic Optimal Control for Staffing and Backlog Policies in a Two‐Stage Customized Service Supply Chain

Motivated by an oilfield services industry case study, we investigate the dynamic behavior of customized service supply chains by developing a two‐stage serial staffing model. Each stage holds no finished goods inventory, but rather only backlogs that can be managed by adjusting staffing levels. We develop optimal control policies to balance backlog costs against hiring and firing personnel costs'assuming shared backlog information—under both centralized and decentralized control. We examine when there is sufficient economic incentive for two completely decentralized stages to begin: (1) to share backlog information without centralizing control, or (2) to completely centralize control. These switching points are determined by the relative service and personnel costs of the two stages. From these results, we show that decentralizing control in many cases does not materially worsen performance, so long as information is shared. Moreover, in some cases, even sharing information is of only marginal benefit.     

A Model for Partial Product Complementarity and Strategic Production Decisions under Demand Uncertainty

This paper considers a general industrial setting where multiple manufacturers each produce a different product and sell it to the markets. These products are partially complementary in the sense that there is a common demand stream that requests all these products as complementary sets and there are streams of individual demands each requesting only one of the products. All demands are uncertain and may follow any general, joint distributions. Facing demand uncertainties, the manufacturers each choose a production quantity for its product with an objective to maximize its own expected profit. We formulate the problem as a non‐cooperative game to study the strategic interactions of such firms and their implications to supply chain performance. We show that such a game may have numerous equilibria. Among all the possible equilibria, however, we prove that there always exists a unique one that maximizes each and every manufacturer's profit, and we derive an explicit solution for this Pareto‐optimal equilibrium point. We further study the optimal solution for a centralized system and compare it with the decentralized solution. Managerial insights are drawn as to how system parameters and control mechanisms affect firms' decisions and performance.     

考虑延时效应的供应链动态合作广告策略研究

广告的延时效应是供应链广告过程中的普遍现象,对供应链合作广告策略的制定具有重要影响.文章研究当产品品牌信誉受广告延时效应影响时供应链的合作广告策略问题,建立了含有时间延迟的品牌信誉动态模型和考虑品牌信誉的产品销售量模型.运用极大值原理,得到了制造商和零售商在分散式决策和集中式决策下的最优广告投入、品牌信誉和利润,以及分散式决策下制造商的最优合作广告参与率.研究发现:在集中式决策下制造商和零售商的最优广告投入和产品销售量均高于分散式决策下的相应值;延迟时间存在一个阈值,当延迟时间低于该阈值时,集中式决策下的供应链利润较高,反之则分散式决策下的供应链利润较高.研究结果为供应链合作广告策略的制定及供应链决策机制的选择提供了一定的参考.最后,通过数值算例分析了广告延迟时间对供应链最优广告策略及决策机制的影响.