As many as 38% of the respondents claimed that they had sufficient legal expertise in cyber security. Most often, the companies try to compensate for workforce shortages by outsourcing and by offering benefits in the form of further training or participation in interesting projects to attract new people (Chart 9). Chart 8: How much relevant work experience do employ­ees providing cyber security in the respondents’ organisations have on average? (%) 45% 40 people – users: improving employee cyber resilience but poor social network security 86% of the organisations sought to prevent cyberattacks by training their users. Although half the respondents do not specifically allocate funds to training, training took place once a year or more often in more than 50% of the companies (Chart 10). Three-quarters of such training took the form of e-learning or internal training using the company’s own staff. Half the organisations also focused on other ways to improve their staff’s resilience against cyberattacks. Nearly a quarter of them tested their users through simulated phishing campaigns or penetration testing (Chart 11 ). Chart 10: Frequency of user cyber security training in organisations in 2020 (% of respondents) 27% 19% 20 54% 8% 1% 40 0 0–1 YEAR 1–5 YEARS 5–15 YEARS 15 YEARS OR MORE DO NOT KNOW 20 17% Chart 9: How did the organisations endeavour to cope with the lack of cyber security experts in 2020? (%) 11% 10% ONCE IN TWO YEARS ONCE DURING THEIR EMPLOYMENT 8% 0 OUTSOURCING ONCE A YEAR OR MORE 28% FURTHER TRAINING OPPORTUNITIES 19% NEVER OTHER (E.G. AS PART OF OSH TRAINING) Chart 11: How employee resilience against cyber threats is tested in organisations in 2020 (%) INTERESTING PROJECTS AND OPPORTUNITIES TO BE CREATIVE 46% 15% 40 COMPANY CULTURE 11% GRADUATE RECRUITEMENT 22% 10% 18% 20 APPROPRIATE REMUNERATION 10% 8% 4% SPECIAL EMPLOYEE BENEFITS 7% 0 NO TESTING OTHER 0 3% SIMULATED PHISHING CAMPAIGNS PENETRATION SOCIAL OTHER TESTING ENGINEERING TECHNIQUES (USB NEAR THE BUILDING ETC.) 20 Cyber Security in 2020 from the Perspective of Czech Institutions, Organisations, and Companies 11