## 4 Results
### Social Engineering Threats  
Social engineering is probably one of the most challenging cyber-security threats that any student, employee or organization can face [47]. Offering trainings and regular updating of the acquired knowledge are paramount in mitigating the risks of cyber-threats through social engineering tactics. We have explored the existence of training options and other dedicated support in our survey and compared the differences across the two student groups; see Table 8 for a summary of key results. Awareness of formal cyber-security requirements relating to social engineering differs significantly between the two student groups. Work experience students confirmed with a much higher rate (42%) that they are aware of policies relating to social engineering attacks, while students without work experience only confirmed the same with a very low rate (5%). The difference in these figures is highly significant (\(p<0.001\)). Only 25-30% of both student groups would require additional support when facing this threat (\(p=0.35\)). The majority of respondents in both student groups confirmed that they do not need support or that the current level of support is sufficient. However, students without work experience might be less likely to be targets because such attacks more often aim for corporate credentials, assets or other valuables, such as data. The actual details of practical training differ significantly. Work experience survey participants have confirmed that they are much more likely (4 or 5 times more likely) to receive simulated emails or social engineering attack case studies in comparison to the study-only participants; the difference is statistically significant (\(p<0.001\)). The level of self-reported participation of the work experience students in simulated email training (23%) and case study training (30%) is modest, while the same values for study-only students are even lower (5% and 8%). None of these figures appear sufficient to sustain the required awareness [63]. A better scenario would be regular training for all users every 4-6 months. Higher training participation might strongly influence the reported number of attempted phishing email attacks, as phishing is the most commonly identified social engineering attack vector. Only 1% of the study-only participants reported phishing attacks, while 22% reported the same in the work experience student stream (\(p<0.001\)). Phishing email reporting is also correlated with the ability to timely report an actual suspicious email when the given institution is running a simulation campaign [64]. The time elapsed since the arrival of the phishing email in the mailbox is crucial; once more than 24 h have elapsed, the probability that the user has become a victim is much higher. The practice of fraud awareness or compliance training is another tool for addressing social engineering attack vectors. While only 5% of the study-only stream confirmed such training, the work experience stream reported a much higher figure (38%), resulting in significant differences (\(p<0.001\)). Risks related to insider attack emails, as well as other security risks related to spam emails, are two additional factors that are covered by such trainings. In both cases, the increased awareness effect of work-related training could be confirmed, with (\(p<0.05\)) for insider attack emails and (\(p<0.01\)) for spam emails. Phishing emails are a similar story; while only 8 study-only stream students identifiedactual phishing emails in their correspondence, 127 work experience students confirmed receiving such emails (_p_ < 0.001). Organizations typically describe more than one variation of phishing emails in training materials and regularly probe users with simulated phishing email attacks; thus, the success rate of user identification is higher. Another key practice, which is important to any user in case of questions or doubts is to have a dedicated person or group of people who they can contact.