## 3 Methodology
### Sample Selection, Criteria, Methodology Description  
This section outlines a detailed methodological framework for systematically assessing and comparing the efficacy of two strategies designed to reduce employee vulnerability to phishing attacks. To maintain confidentiality and safeguard participant privacy, everyone was assigned a pseudonym in the format \"User xxx,\" where \"xxx\" represents a unique numerical identifier. The true identities associated with these pseudonyms are known exclusively to the author.  
The primary objectives of this study were threefold: first, to determine which method--simulated phishing exercises or structured online educational interventions--is more effective in diminishing employee susceptibility to phishing threats; second, to assess the long-term effects of each intervention on employee resilience against phishing attacks; and third, to identify and analyze factors that influence the efficacy or limitations of each method.  
A systematic, phased research design consisted of three sequential stages: initial assessment, intervention, and final evaluation. In the preliminary phase, a baseline evaluation was performed via simulated phishing attacks on 220 employees, establishing an initial standard for phishing vulnerability within the organization.  
In the intervention phase, the sample was increased to 237 employees, randomly divided into two equally representative groups to guarantee diversity across different departmental functions, hierarchical levels, and access to sensitive information. Randomized assignment was employed to reduce selection bias and preserve representational integrity. Group A (\(n\) = 117) participated in supplementary controlled phishing simulations to assess susceptibility without an educational intervention. In contrast, Group B (\(n\) = 120) participated in an online academic program designed to enhance awareness and defensive skills against phishing threats. This e-learning program included modules on recognizing phishing emails, optimal information security practices, and procedures for reporting suspicious digital communications.  
The efficacy of the two interventions was quantitatively evaluated during the final assessment phase via subsequent simulated phishing attacks. Outcomes from follow-up phishing simulations for Group A were meticulously documented, enabling comparative analyses with baseline susceptibility metrics. In Group B, the completion rates of the educational modules were recorded, along with performance metrics that indicated the participants' understanding and practical implementation of the instructed cybersecurity practices.  
The data gathered during these phases were analyzed to measure variations in employee vulnerability to phishing threats resulting from each intervention method. The results offered empirically based insights, facilitating informed conclusions about the relative effectiveness of simulated phishing exercises compared to structured cybersecurity education. This research offers practical recommendations for organizations to enhance their cybersecurity and protect vital data against phishing attacks.  
This study notably lacked a third group functioning as a neutral control without intervention. The division of participants into simulation-based and education-based interventions, along with the absence of a non-intervention control group, limits the capacity to attribute the observed behavioral changes exclusively to the interventions. Subsequent research should include a genuine control group to distinguish the impacts of environmental variables or temporal fluctuations in phishing vulnerability.