Choosing what to protect: Strategic defensive allocation against an unknown attacker

We study a strategic model in which a defender must allocate defensive resources to a collection of locations and an attacker must choose a location to attack. In equilibrium, the defender sometimes optimally leaves a location undefended and sometimes prefers a higher vulnerability at a particular location even if a lower risk could be achieved at zero cost. The defender prefers to allocate resources in a centralized (rather than decentralized) manner, the optimal allocation of resources can be non-monotonic in the value of the attacker's outside option, and the defender prefers her defensive allocation to be public rather than secret.