## 4 Results
### How Effective Is Cyber Security Training for Lithuanian Education Organization Employees?  
The application of a system that mimics social engineering attacks allows the evaluation of the organization's mitigation mechanisms. In 2018, the first imitated attack was conducted at the technical university. The organization's employee social engineering attack resistance score (1), based on the received data was 0.49 (1648 emails were emailed, 708 employees viewed them). Then a dedicated cyber security training program was implemented. As a result of the program, a second imitation of a phishing attack was conducted. Based on its results, the social engineering attack resistance score increased to 0.74 (1618 emails were sent, 931 employees read them). The same training material was used for the second training session. In the third imitation session, the resistance score to social engineering attacks decreased to 0.64 (1785 emails were emailed, 679 employees read them). The numbers affecting the score are presented in Figure 9.  
If we take the organization's employee social engineering attack resistance scores as proportions of the security, where the sample size is the number of employees who read the email, we would see a significant resistance score increase in comparison to the first imitation attack (\(p<0.0001\) comparing the first and second imitation and the first and third imitation). This indicates that training and repetition of imitation can be effective. However, the difference between the second and third imitations is significant as well (\(p<0.0001\)).  
Figure 8: Distribution of employees’ action timings for reading the email (boxplot on the (**left**)), clicking the link after the email is open (boxplot in the (**center**)) and for filling in the form with the data after the web page is opened (boxplot on the (**right**)).  
As employee training was repeated, this could potentially be affected because the training material was not renewed.  
The lack of training material updates is visible in all areas: image download and website visits jumped to an even higher ratio than it was in the initial experiments in 2018; reveals of the data are more than three times smaller in comparison to the first imitation, but increased in comparison to the second imitation experimental data when employees first underwent the dedicated training program; reporting of the incident dropped twice in comparison to the second imitation, but was ten times higher than in the initial stage. All this can be summarized as facts, that the applied training program is effective as it is oriented to the two metrics, mostly affecting the social engineering attack resistance score (prevention of data reveal via form filling and reporting of the suspicious emails); however, it is not effective any more to address the importance of image downloading and website visiting.  
Hypothesis (H03) is that security training affects the credulity level of spear phishing attacks for educational institution employees. At the same time, an increase in the organization's resistance score is visible compared to the situation when no training was performed. Meanwhile, if the training material is not updated to reflect the constantly changing nature of phishing attacks, repetitive training will not increase the resistance score and even lead to its decrease, because of false positive confidence, caused by a lack of knowledge of the most advanced spear-phishing methods.