In the modern society where digitization accelerates, firms have to deal with a huge amount of cyber-threats. One way to increase their defence is by enrolling in ISACs. Such centers increase information sharing and help firms to decrease cyber security risks, prevent attacks, and increase their overall resilience. However privacy risk and information disclosure concerns are still major challenges. That is why several firms still does not exploit this opportunity. To prevent cyber-threats is key to understand how an attacker would play. Therefore in this paper we construct a bayesian game in which an attacker choose between three choices(no attack, small attack, big attack), not knowing if the target is in ISAC or not. Analyzing the cases in which a firm is or is not probable to be in ISAC, we show that the number of small attack decrease in the first scenario, assessing even more the needs of a firm to enroll in such organization.

We consider a two-player Bayesian game represented by G =< (N), (A), (Θ), p, (U) >. Since is a Bayesian game, the game consists of two 'stages'. In the first stage, the “Nature” takes action, and it determines the probability vector p(θ11,θ12) . The second stage is the actual game. The two Players know the type that “Nature” had chosen for themselves (in this particular game only player F has types), but they did not know the type that “Nature” had chosen for the other player. However, the type space of each person and its probability distribution are common knowledge. So, according to the “Nature” action, this static game of incomplete information is converted into a complete but imperfect information game.