Motivation-based Attacker Modelling for Cyber Risk Management: A Quantitative Content Analysis and a Natural Experiment

Cyber-attacks have a tremendous impact on worldwide economic performance. Hence, it is vitally important
to implement effective risk management for different cyber-attacks, which calls for profound attacker models.
However, cyber risk modelling based on attacker models seems to be restricted to overly simplified models. This
hinders the understanding of cyber risks and represents a heavy burden for efficient cyber risk management.
This work aims to forward scientific research in this field by employing a multi-method approach based on a
quantitative content analysis of scientific literature and a natural experiment. Our work gives evidence for the
oversimplified modelling of attacker motivational patterns. The quantitative content analysis gives evidence for
a broad and established misunderstanding of attackers as being illicitly malicious. The results of the natural ex-
periment substantiate the findings of the content analysis. We thereby contribute to the improvement of attacker
modelling, which can be considered a necessary prerequisite for effective cyber risk management.