Do Default Effects Shape Cyber Attack Decisions? Lessons From an Empirical Study

Understanding cognitive biases in cyber attacker behavior can help develop countermeasures that leverage predictable mental shortcuts. This paper analyzes the impact of one such bias, the default effect, on cyber attack decisions. Three forms of this effect are examined: explicit default, association effect, and position effect. The experiment included 85 participants who displayed cybersecurity knowledge based on a screening assessment. The participants performed established behavioral tasks and cyber-adapted scenarios involving host selection, port selection, and password spraying. Our findings confirmed that explicit defaults behave as expected from prior research: people preferred the default option more often under opt-out than opt-in framing. For cyber tasks, the association effect was always present and influential as participants preferred options semantically related to the contextual cues provided. In contrast, position effects failed to emerge when semantically meaningful cues were available. Results offer actionable insights for designing cyber defense systems that leverage predictable attacker heuristics.