We aim to advance the understanding of individual security decision-making  by combining formal and behavioral analysis We sketch a game-theoretic model of security decision-making that generalizes the ``weakest link'' game  and describe a controlled laboratory experiment to reveal differences between predicted and observed user behavior