## 4 Discussion
### Limitations  
Within the scope of this study, we acknowledge several limitations that need to be considered. First, the small number of included studies and the limited sample sizes in the phishing campaigns analyzed may question the applicability of the findings making the results unsuitable for generalization to a broader sample/population. For example, the study [39] utilized a sample of 65 participants, while [37] was based on a sample of 32 participants. Smaller sample sizes result in wider confidence intervals, indicating greater uncertainty in the findings. To mitigate these limitations, future research should aim to ensure that the sampling frame includes all relevant segments of the target population, thereby reducing coverage bias. This can be achieved by selecting a broader sample size and employing multiple data collection methods. The application of rigorous random sampling techniques and the determination of an appropriate sample size may help reduce sampling error by achieving the desired confidence levels and margins of error. Non-response bias could be addressed through follow-up procedures, incentives, and user-friendly survey designs to encourage higher response rates. The potential for publication bias, where only successful or significant studies are published related to the topic, further narrows the scope of this review. Additionally, the exclusion of non-English studies limits the generalization of the findings, as valuable insights from diverse linguistic and cultural contexts may have been overlooked.  
A significant limitation is the variety in the demographic, technical, and psychological characteristics of users across the included studies. This inconsistency makes it difficult to draw firm conclusions about which factors consistently influence phishing susceptibility. Moreover, many studies rely on artificial or simulated phishing environments, which may not accurately replicate real-world scenarios. This creates challenges in understanding how users behave under genuine phishing threats.  
Another limitation lies in the lack of diversity in phishing campaigns analyzed. Many studies focus on a narrow range of phishing tactics, neglecting the evolving sophistication and variety of phishing strategies used in real-world phishing attacks. Additionally, most studies fail to account for long-term behavioral changes, making it unclear whether interventions or awareness programs have a lasting impact on reducing susceptibility.  
The methodologies that have been used in the selected studies have some more limitations that need to be studied further. For example, phishing simulations, may not fully capture real-world user behavior due to their lower external validity resulting from the artificial nature of controlled experiments. Additionally, potential biases in questionnaire-based studies, such as reliance on self-reported data, can introduce recall bias or social desirability effects. Furthermore, examining how these methodological differences influence the generalizability of findings and whether direct comparisons across studies using different approaches are valid would enhance the field's understanding. By incorporating these considerations, future studies can provide a more nuanced evaluation of the strengths and weaknesses of various research methodologies, ultimately improving the rigor and depth of phishing emails.  
Finally, the studies included often lacked comprehensive data on contextual factors, such as organizational culture, technical infrastructure, and training programs, which play a critical role in phishing susceptibility. The absence of such data restricts the ability to offer more holistic recommendations for mitigating phishing risks.  
By addressing these limitations in future research, a more robust understanding of phishing susceptibility and the factors influencing it can be developed, leading to more effective strategies for prevention and education.