Choosing What to Protect: Strategic Defensive Allocation against an Unknown Attacker

We study a strategic model in which a defender must allocate defensive resources to a collection of locations and an attacker must choose a location to attack. In equilibrium, the defender sometimes optimally leaves a location undefended and sometimes prefers a higher vulnerability at a particular location even if a lower risk could be achieved at zero cost. The defender prefers to allocate resources in a centralized (rather than decentralized) manner, the optimal allocation of resources can be non‐monotonic in the value of the attacker's outside option, and the defender prefers her defensive allocation to be public rather than secret.