## 5 Discussion
### Social Engineering Threats  
Social engineering is probably one of the most challenging cyber-security threats that any student, employee or organization can face [47]. Training and regular updating of the acquired knowledge is paramount in mitigating the risks of cyber-threats resulting from social engineering tactics. Our survey results have confirmed that work experience is positively associated with recognizing social engineering-related IT policies, but this increased awareness does not translate into additional support needs.  
Prior work [53] has also substantiated that some newly hired employees tend to receive training for hypothetical social engineering threats (\"corporate espionage\") but are less likely to receive training on actual cases with the possibility of Q and A (question and answer) sessions afterward.  
Our survey provides evidence that work experience is associated with improved awareness of specific social engineering threats. Work experience students reported that they are much more likely to receive regular (every 6 months) emails to simulate attacks and case studies to describe actual cases. They are also more likely to report phishing email attacks.  
This difference only applies to those who receive training. However, the problem is that the majority of the work experience students still do not receive (or do not remember) any of these training courses. This applies to regular emails, which 77% of them did not receive, and case study emails, which 70% of them did not receive. We argue that it is not a surprise that, with such a low level of training, only 21% of work experience students report phishing email attacks.  
Somewhat unsurprisingly, compliance or fraud awareness training is another area where we have survey confirmation that work experience students report completion with much higher rates, but again, 62% of them did not receive or did not remember this kind of training. The positive effect of work experience could also be confirmed for both insider email attacks and increased spam email activity.  
We also inquired about the willingness of students to report phishing email attacks. Within the work experience stream, 97 out of the 127 students, who confirmed receiving at least one such email, have made at least one report. Surprisingly, only eight participants (of 350) in the study-only group mentioned receiving phishing emails, and only four students confirmed the reporting of such emails. We suspect that recalling such attacks is related to general awareness and concern regarding this security threat, which may explain the low numbers of the non-working students. Further, while there is a reporting gap, the observation that 97 of 127 working students at least reported one phishing attempt is encouraging. However, reporting could be further improved if support personnel were available for questions and queries relating to phishing and other attack attempts. While a modest 55% of work experience students could identify a dedicated person, only 11% of the student-only stream could do so.  
We recommend that responsible IT-security and cyber-security managers should initiate comprehensive training options for all users, for example, according to the basic principles outlined in [51, 52]. Our results also suggest that key insights from related literature [47] are confirmed in our survey, meaning that continuously raising awareness about social engineering threats is critical. Acknowledging that actual training might not cover all newly emerging risks is also important in raising general scrutiny because the skills of perpetrators might, in certain cases, be ahead of countermeasures. In the context of social engineering prevention, gamification also appears particularly suitable for addressing problems such as habituation and boredom during repeated training exercises [65, 66]. The design of such training courses can also specifically address the remote work context and can be tailored to actual social engineering threats.