The trend of phishing campaigns continued into the last year, with phishing and fraudulent emails representing almost two-thirds of the most frequent cyberattack attempts in the education sector. However, respondents further reported that approximately two-thirds of these attempts did not result in a cyber incident, which is comparable to other sectors. Since phishing attacks primarily target individual users, their training or resilience testing is generally considered the best prevention. The steady growth of the number of educational institutions that provide these trainings is a positive trend (see Graph 26). 100% Yes 80% 60% No 79 71 50 50 40% 29 21 20% 0% 2020 2021 2022 Graph 26: Education Sector Organisations Providing Cybersecurity Training (%) Academic research represents a valuable target for state-sponsored groups and phishing can be one of the ways for these actors to gain access to a victim’s systems. User resilience testing using simulated phishing campaigns may, among other things, help reduce this risk. Despite the growing share of organizations in the education sector that train their employees, this sector lags slightly behind others in resilience testing (see Graph 27). It cannot be ruled out (25-50 %) that one of the factors contributing to this situation is the state of funds allocated to cybersecurity, which 84% of respondents in the education sector rate as insufficient, which is about one fifth more than in other sectors. Educational sector 50% 40% Other subjects 47 40 42 37 30% 26 22 20% 16 11 10% 13 5 0% No tests Simulated phishing campaigns Penetration tests Technical or non-technical exercises Other subjects Graph 27: Do you Test the Resilience of your Employees Against Cyber Threats? (% of Respondents) 28