## 3 Materials and Methods
### Analyzed Research Data  
To obtain data for the situation analysis, the following time-related data were logged on the server:  
1. Time when the email was sent to the user. The email contained unique identifiers dedicated to user action traceability. The time was logged on the email-sending server. 2. Time when the user read the email. This was logged every time the user opened the email. Email opening was implemented by integrating an additional external resource, which was automatically loaded. The loading request initiated the creation of an email-opening journal record. 3. Time when the user loaded the image embedded in the email. Time logging was implemented based on the same principle, as in the email-opening case. 4. Time when the user opened the website, mentioned in the email. The journal record was created on the website. 5. Time when the user opened the data entry form. Analog to URL visiting was implemented. 6. Time when the user filled in the data. The journal record was saved in the form submission action. All these data were used for timing analysis and the logging of user actions. The experiment duration was 3 days. The limit was added to ensure natural reactions. A longer period would cause employees to share their experiences and could reflect false positive results. The user IP address was logged while gathering timing data. Later analysis was conducted to see where the employee opened the emails, i.e., inside or outside the office. Based on the user identifier, employees were identified and personal data were mapped to actions. We used employee age, gender, working position, workload and participation to analyze whether there was any relation to the credulity level of phishing attacks. We also included the employees' data while preparing the training for the target group in the security training. In this research, personal data were not analyzed because the positions in different institutions vary considerably and could not be accurately matched. Age and gender factors have been analyzed in other research papers [20; 30; 40]. In this research, we added an additional parameter--the score of credulity level in relation to the user. The credulity score CS was calculated based on the principal schema presented in Figure 5 and Equation (1). \[CS=\bigvee_{i=0}^{n_{in}}im_{i}+2\cdot\bigvee_{i=0}^{n_{val}}w_{i}+3\cdot \bigvee_{i=0}^{n_{ff}}ff_{i}-2\cdot\bigvee_{i=0}^{n_{hd}}hd_{i} \tag{1}\]  
there \(CS\) is the credulity level in relation to an employee, \(im_{i}\) is the \(i\)-th image loading in the email action (there \(i=0\) for the default value and \(i>0\) for all remaining \(n_{in}\) email-reading log entries), \(wl_{i}\) is the \(i\)-th web-loading action (there \(i=0\) for the default value and \(i>0\) for all remaining \(n_{val}\) web-loading log entries), \(ff_{i}\) is the \(i\)-th form-filling action (there \(i=0\) for the default value and \(i>0\) for all remaining \(n_{ff}\) form-filling log entries), \(hd_{i}\) is the \(i\)-th email reporting to HelpDesk action (there \(i=0\) for the default value and \(i>0\) for all remaining \(n_{hd}\) email-reading log entries). Each email contained a link to a website. If the user clicked on the link and opened the website, he or she received a new \(wl_{i}=1\) record, there \(i\) is the \(i\)-th web-loading action for this specific user. The same principle applies to web form filling data--if the user filled the data field with the correct data (this was estimated by comparing users' personal data with the requested name and surname or email address data in the web form), he or she had \(\mathit{ff}_{i}=1\) for the \(i\)-th form-filling action, or \(\mathit{ff}_{i}=0\) if the data were falsely submitted. Some users were conscious and took some actions. If the user reported the phishing attack to the HelpDesk (in any step of the research and using any means--reporting system, email, phone call, etc. ), \(hd_{i}=1\) for the \(i\)-th reporting-to-HelpDesk action.