Table 1 The five least important and five most important factors rated across participants (Study 1, n = 38)

The perceived organizational allegiance (purchases predominantly domestic brands of hardware/software versus purchases foreign brands)

Different methods of paying the contractor (e.g., fixed price versus cost plus) to your perception of risk? Fixed price: Payment is a flat fee that must meet predetermined list of requirements. Cost plus: Payment is not flat fee, but it scales over time to cover unforeseen costs of meeting predetermined requirements.

The presence or absence of an organization’s fear-driven responsiveness to threat

The open- or closed-source protection technology used by your organization

The recertification cycle (e.g., short versus long) as a constraint effecting the ability to secure the organization’s network before an attack

The complexity of the organization’s systems and/or networks that makes it easy or difficult to secure

The organization’s response to threats (proactively planned for an attack versus reactively responded to an attack)

The level of skill the adversary has (e.g., professional or amateur)

The maturity of the organization’s system capabilities for network defense

The adversary’s knowledge (e.g., high versus low knowledge) about the organization’s deployed network and security technology