## 1 Introduction  
Social engineering attacks aim to fool the user and extract some benefit from them--obtain the needed data or motivate the user to take actions [1]. Since 2019, the number of phishing attacks has increased by 150% yearly [2]. Especially effective are spear-phishing attacks, which are aimed specifically at a dedicated target (usually a person or company employee) [3]. The inclusion of some already gathered data, selection of a suitable time and personalized spear-phishing messages lead to a higher attack success. The automation of spear-phishing attacks [4] results in high-impact and effective attacks that affect not only the employee but also the company. To fight against phishing attacks, both technical and human-oriented mitigation solutions are used [5, 6]. The idea of eliminating or mitigating human vulnerability, rather than preventing attacks from reaching the user, is highly critical [7]. As a result, user training and credulity estimation are a crucial part of organizations' security management [8]. However, human-related attacks and their mitigation are very sensitive to many different factors, which are challenging to control. What works for one target group might have a different effect on another. Therefore, this research investigates the credulity of spear-phishing attacks for Lithuanian education institutions' employees. It is important to understand the area of the credulity of spear-phishing attacks for Lithuanian education institutions seeking to develop a set of best practices and tools to fight this threat and increase the resistance. Narrowing the area to a specific country, organization type and spear-phishing attacks should help gather more accurate data. This will eliminate the effect of different work specifics, national regulations and other possible factors. At the same time we cannot be sure that these conditions define the lower variance of the results; therefore, the first research question (RQ1) is oriented to estimate whether the vulnerability of education organization employees is dependent on the organization and its cyber security management policy. Experiments with different Lithuanian education institutions should lead to the answer to whether the same tendencies can be applied to all organizations of the same education sector. We raise a hypothesis (H01) that Lithuanian education system employees display similar behavior when responding to spear-phishing emails, and the organization type has no effect on the credulity of this kind of attack for employees. If this null hypothesis is confirmed, all Lithuanian educational system organizations could use the same security management policy. It is important to consider the time period during which the organization needs to react to a spear-phishing attack when designing the strategy for preventing and mitigating its effects. In this regard, we raise the second question (RQ2): when will employees respond to spear-phishing emails sent to them? Our null hypothesis (H02) is that no data will be revealed at least within the first 5 min after the spear-phishing emails are sent. At least 5 min to react could ensure at least a partial information technology support center response to such emails. If employees respond faster than 5 min to reveal the data requested in the spear-phishing email, the information technology support center will not be able to respond. Other types of direction are needed to mitigate spear-phishing attacks in such cases. One of the solutions is employee training. Accordingly, the third research question (RQ3) is to determine how effective cyber security training is for Lithuanian education organizations' employees. The following hypothesis (H03) is that security training affects the credulity level of spear-phishing attacks for educational institution employees. If it is confirmed, training should be incorporated into the organization's security management policy as a must.