## 2 Related Works  
Phishing remains a prevalent cybersecurity threat, exploiting deception and human fallibility to circumvent technical safeguards and infiltrate organizational systems. Although technological countermeasures are crucial, a growing body of research highlights the importance of addressing the human element through targeted education and behavioral interventions. This review consolidates findings from recent studies examining the efficacy of simulated phishing attacks, cybersecurity training, and behavioral insights into phishing vulnerability, offering context for the current research conducted at a Croatian university. Simulation-based phishing interventions have emerged as a prevalent method for evaluating and enhancing employee awareness and security. [PERSON] et al. [1] created a simulation-based training platform integrated with interactive learning tools, which markedly enhanced users' proficiency in identifying and responding to phishing emails. Their methodology also prioritized real-time feedback and user engagement, two crucial components identified as essential for improving training retention. [PERSON] et al. [2] conducted a comprehensive enterprise study, demonstrating that contextual and personalized phishing simulations were more effective in provoking authentic user behavior; however, they observed that training administered immediately before simulations did not necessarily reduce click-through rates. This suggests that the timing of simulations and the realism of scenarios may be more essential than the closeness of training. Alternative educational paradigms, including serious games and microlearning methodologies, have been thoroughly investigated. [PERSON] et al. [3] evaluated two methodologies--game-based learning and context-based micro-training (CBMT)--and found that both were effective in teaching users how to recognize phishing emails. CBMT demonstrated marginally greater efficacy, presumably attributable to its provision of pertinent information at the time of decision-making. In a similar vein, [PERSON] et al. [4] presented \"PickMail,\" a serious game designed to simulate email evaluation tasks, achieving a 92.6% accuracy rate in phishing detection among trained participants. [PERSON] et al. [5] developed a role-playing game that simulated phishing attacks, demonstrating that users not only retained greater knowledge but also exhibited higher engagement compared to those trained with conventional materials. Extensive data analysis has also guided training methodologies. [PERSON] et al. [6] employed machine learning models to forecast user vulnerability to phishing by examining over 144 simulation campaigns involving 31,000 participants. Their model effectively evaluated the \"difficulty\" of phishing emails and predicted potential compromise rates, providing a proactive approach for tailoring training. They underscored that group-level training is inferior to user-specific targeting, indicating a necessity for personalized interventions. Demographic and psychological factors significantly influence phishing behavior. [PERSON] et al. [7] examined variables including employee tenure, satisfaction, and self-efficacy, discovering that newer and less satisfied employees exhibited a markedly higher propensity to interact with phishing content. [PERSON] and [PERSON] [8] similarly indicated that although cybersecurity training enhances general awareness, its enduring impact is significantly influenced by its ability to cater to user diversity in technical proficiency and personal motivation. [PERSON] et al. [9] corroborated these findings within an operant conditioning framework, observing that reinforcement and behavioral feedback loops significantly improved the learning outcomes of phishing simulations. Numerous case studies suggest that environmental factors, including seasonal timing, occupational position, and organizational framework, can influence phishing outcomes.