## 4 Results  
The data obtained in the research can be analyzed from different perspectives. To better address the research aim, the results are presented based on the research questions. Is the Vulnerability of Education Organization Employees Dependent on the Organization and Its Cyber Security Management Policy? To indicate the employee vulnerability to social engineering attacks, the percentage of employees that received the phishing email was analyzed. In the technological university (taking the last experiment results only), 1785 emails were sent to employees, where within  
Figure 5: The main principle of credulity point calculation for users. Calculating credulity points for users will allow us to determine whether or not the user is aware of social engineering attacks and security management. User actions can be divided into 4 steps. The first step was to read the email. No weight was applied to this action, as it only shows that the user read the email during the given time period. In the second step, the user may load the embedded image. Then the record will be added to the log journal and associated with \(rd_{i}=1\) value for the \(i\)-th record of this kind for this specific user. Image loading can be automated or blocked by the user’s email system. Due to the lack of information, it is impossible to estimate whether the action is conscious or unconscious (it is impossible to estimate it without the use of external systems). 3 days, 679 employees read the email (38%). The art university had the lowest email read rate--24% (160 out of 656 employees). The administration of the secondary school demonstrated the highest email read rate--40% (141 out of 347 employees viewed the email). The statistics do not reflect the organization's security level, but rather its response time--less than half of employees read emails at least once in a three-day period. Meanwhile, analyzing what actions were taken by the employees who read the paper-phishing emails, the specifics of the education organization can be seen (see Figure 6). It is clearly seen that the secondary school employees downloaded the image twice as often as higher education institutions. The most images were downloaded by the art university employees. And the results seem logical as the visual information in the email might seem relevant to art-related persons. Meanwhile, the low secondary school image download rate can be explained by technical social engineering mitigation solutions. A user must have additional knowledge to enable images that are automatically blocked. Therefore, despite the difference in image download ratio being visible, it is not representative in the sense of awareness of social engineering attacks. The above-mentioned insight is strengthened by further numbers--the secondary school employees led by URL visiting and data reveal actions. Of all the secondary school employees who read the email, 70% opened the provided URL link (with a 95% confidence interval, the values ranged from 57% to 85%) and 17% (with a 95% confidence interval [11%; 25%]) provided the requested personal data. Technical university employees were eager to see what data were presented on the website--61% of them visited the URL (with a 95% confidence interval [55%; 67%]). While the matching percentage between downloaded images and visited websites might lead to the idea that the images were automatically downloaded, this was not the case--only 20% of employees performed both actions. The arts university employees led in the image downloads; however, they had the lowest URL visits and data reveal ratios. Additionally, the numbers cannot be directly linked to the social engineering attack awareness level, but they decreased the likelihood of being attacked. The last two actions are directly indicative of the awareness in the cyber security area.