## 2 Related Work  
### Cyber-Security Risk Landscape and Information Security Awareness  
Information security awareness (ISA) and cyber-security awareness and the associated risks are interrelated in any given institution, both in educational and corporate settings. There are a number of theories describing employee behavior relating to ISA, but prior work has shown that four theories, in particular, have been researched and tested in individual studies [13]: the Theory of Planned Behavior, General Deterrence Theory, Protection Motivation Theory, and the Technology Acceptance Model. Employee behavior, driven by IS knowledge and other factors such as culture and personality, is such a crucial factor in adapting to and enhancing ISA that systematic research has attempted to identify the key drivers for ISA enhancement in private and public entities [14]. Among other approaches, regular training (including gamification models) and regular employee awareness campaigns were highlighted as highly effective and common in both private and public organizations, including universities. The actual ISA behavior of university students and the individual drivers behind that behavior were analyzed in a survey study [15]. The overall assessment indicated that certain individual factors, including higher age, area of study (e.g., IT studies), contribute to increased ISA, whereas there was no statistically significant correlation identified between work experience and ISA. The one factor also highlighted in the same survey study as a statistically significant contribution to both calculated and perceived ISA was the availability of training and awareness programs. Some universities already offer comprehensive ISA training programs, but they lack a strategy for persuading students to participate in these programs [16]. ISA training is such an important factor that even public institutions have to plan by job category in order to determine existing awareness gaps and risk levels in each job category [17]. In each institution, whether private or public, the success of the ISA-related training framework will depend on how much the actual program is tailored to the individual employee's or user's needs and perceptions. One research article [18] clearly highlights that the success of security education, training, and awareness (SETA) programs depends on numerous factors that directly (30 factors) or indirectly (19 factors) influence individual behavior. Typical examples of directly influencing factors include culture, security policies or perceived social norms, while typical examples of indirectly influencing factors include control and sanctions, general attitude to social norms and law or self-control. These individual factors can differ significantly, and any given institution must tailor the design, implementation and follow-up of their own SETA programs accordingly. There are also a number of cyber-security risk factors affecting employees in organizational settings such as spam emails, malware, ransomware, fake social accounts, mobile device threats and many more. Prior work has attempted to list and analyze the most important factors [11, 19] and partially also focused on sorting or clustering them in broad categories to support mitigation strategies in the constantly evolving risk landscape. However, we could not identify a cyber-risk categorization methodology in the literature that would be universally accepted for _remote and work-from-home_ environments. For example, there is an incident information clustering methodology proposal at a national level [20], but the focus is on incidents and not risk, while corporate specifics are not evaluated. Other approaches define cyber-risk with operational risk categories relating to IT assets and IT systems [21] while not emphasizing electronic communication networks.