Summary: Protecting infrastructures and their users against terrorist attacks involves making both strategic and operational decisions in an organization’s hierarchy. Although usually analyzed separately, these decisions influence each other. To study the combined effect of strategic and operational decisions, we present a game-theoretic, two-stage model between a defender and an attacker involving multiple target sites. In the first stage, the defender (attacker) makes a strategic decision of allocating investment resources to target sites to improve the defense (attack) capabilities. We consider two cases for investments in the first stage: (1) unconstrained and (2) budget-constrained models. The investment allocations for each target site determine its detection probability. In the second stage, the players make operational decisions of which target site to defend or to attack. We distinguish between two games that arise in the second stage: the maximal damage game and the infiltration/harassment game. We prove that the solution to each game under budget constraints is unique. In fact, when the second-stage game is of the infiltration/harassment type, the invest-defend game has a unique closed-form solution that is very intuitive. The results reveal that an increase in defense investments at a target site decreases the probability of both defending and attacking that target. However, an increase in attack investments increases the probability of both defending and attacking that target. Similarly, an increase in the defender’s (attacker’s) investment efficiency leads to a decrease (increase) in investments of both the defender and the attacker. Finally, the model is applied to real data to obtain the equilibrium investment and defense strategies. The results from real data demonstrate that the attacker’s penalty from a failed attack is an important factor in determining the defender’s optimal distribution of investments and defense probabilities. The defender’s second-stage defense decisions complement the first-stage investment decisions; that is, among target sites that receive little or zero investment, the most important one is covered with a relatively high defense probability in the second stage. Moreover, as the attacker’s budget increases, the defense investments shift from less important sites to more important ones.