## 4 Results
The percentage of employees who filled in the form with the requested data reached 17% in the secondary school (with a 95% confidence interval [11%; 25%]), 8% in the technical university (with a 95% confidence interval [6%; 11%]) and 4% in the arts university (with a 95% confidence interval [1%; 10%]). Similar trends were seen with the reports of phishing  
Figure 6: Distribution of employees’ actions in relation to spear-phishing emails. attacks. The secondary school employees led. Of those who read the email, 20% reported it as an incident (with a 95% confidence interval [13%; 29%]). In the technical university, the ratio was 11% (with a 95% confidence interval [8%; 13%]), and in the arts university, the ratio was 4% (with a 95% confidence interval [1%; 6%]). Despite the similarity between these two actions, several cases were noticed where the employee filled in the form and then reported it. These two actions were rarely carried out by the same person. To estimate the significance of the differences, a two-sample \(t\)-test was used [43]. All the numbers and the \(p\)-value comparison between each type of institution for certain actions indicate significant differences (see Table 1). Statistically no difference can be seen between the technical university and the secondary school, but just in the email read and URL-visiting actions. The arts university acted differently to the other institutions. Taking into account the fact that the most important factor for credulity and organization resistance to phishing attacks was form filling with the requested data, we cannot confirm the first of our hypotheses (H01) that Lithuanian education system employees display similar behavior when responding to spear-phishing emails, and the organization type has no effect on the credulity of this kind of attack for employees. This means one framework for spear-phishing attack mitigation or that employee training on this topic should be individualized, as one management strategy is not necessary for all types of educational institution. Considering the differences in employee behavior of the analyzed education institutions, it is difficult to determine the organization's resistance to social engineering attacks. To express it, we asked two security experts to discuss and express a joint opinion on how important each ratio is to the final organization vulnerability level. The image download rate importance is 5%, while the URL visit rate importance is 10%. Incident reporting data rate had a 25% importance and data reveal rate of 60%. Assuming that the high incident reporting ratio is a positive score and the other ratios are better when lower, the final organization social engineering attack resistance \(S\) can be determined by using Formula (2). \[S=0.05\cdot(1-r_{int})+0.10\cdot(1-r_{int})+0.60\cdot\left(1-r_{ff}\right)+0. 25\cdot r_{hd} \tag{2}\]  
there \(S\) is the social engineering attack resistance score, \(r_{int}\) is the image download ratio (image download cases divided by the number of opened emails), \(r_{int}\) is the website viewed ratio (URL visited cases divided by the number of opened emails), \(r_{ff}\) is the data reveal ratio for form-filling cases divided by the number of opened emails), and \(r_{hd}\) is the incident reporting ratio (incident reported cases divided by the number of opened emails). Based on the formula and imitated spear-phishing attack logging data, the social engineering attack resistance scores suggest that the most resistant is the arts university (the score is 0.68), the technical university is second (score is 0.64), while the secondary school is third (score is 0.61). Hence, the difference in social engineering attack resistance scores is not significant. Despite the fact that the social engineering attack resistance score