Why Hackers Might Not Attack: New Security Test Assumes They're Rational

For years, security experts tested digital systems by imagining the worst possible attacker: someone who could try every hack, every trick, and every exploit imaginable. That's like worrying about a burglar who would drill through walls, hire a helicopter, and bring a bomb just to steal your TV. A new research paper argues this is too paranoid. Real attackers are rational. They weigh the effort, the risk, and the reward before making a move. So the authors created a new model: the rational Dolev-Yao attacker. In plain terms, it's a hacker with all the standard capabilities, but one who only attacks when it's worth their while.

The payoff is huge. Under the old test, many protocols get flagged as insecure even though no sensible criminal would ever bother attacking them. The researchers show that some systems labeled vulnerable are actually safe from rational attackers. For example, in one online payment scenario, an attacker faces many identical-looking sessions and can't tell which one will pay off. The uncertainty raises the cost of attacking so much that the attack becomes pointless. In a separate voting scheme, they even calculate the exact bribe-to-benefit ratio that makes a coercer give up.

The best part? The new method is automatic. The researchers prove their test always finishes with a clear yes or no answer. They use something called WATL logic, but you can think of it as a smart spreadsheet that calculates every possible attack, adds up its cost and reward, and tells you whether any attack is worth it. They also draw a clear line: a computable threshold that shows exactly when a system flips from safe to unsafe.

There is a catch. This model assumes attackers are perfectly rational and have accurate information about costs and rewards. Real humans sometimes act stupidly, spitefully, or just make mistakes. So this isn't a replacement for traditional security checks, but a powerful extra tool. It helps businesses stop overspending on protections against attacks no criminal would ever attempt, while focusing resources on the threats that actually pay.