Analýza interních phishingových kampaní v organizaci a návrh opatření pro zvýšení bezpečnostního povědomí zaměstnanců

In today's dynamic digital environment, where cyber-attacks are constantly growing in sophistication, the human factor represents one of the most vulnerable components of organizational security. While technical means of protection are reaching high levels, attackers are increasingly focusing on manipulating employees through social engineering, with phishing being the dominant method. This thesis aims to analyse the results of internal phishing campaigns carried out in a selected organization and based on the findings, propose specific measures to increase employee security awareness and their resilience to phishing attacks. Specifically, the thesis focuses on evaluating the success of individual phishing scenarios (click rate), analysing user behaviour depending on the type of device used, and examining the time aspects of user responses. To achieve these goals, quantitative analysis of primary pseudonymized data obtained from internal phishing campaigns was used. The data was processed using descriptive statistics methods with an emphasis on formulating data-driven recommendations. The results of the analysis make it possible to identify key risk factors and specific patterns of employee behaviour, providing a robust basis for targeted adjustments to internal security campaigns and related educational activities. The aim is to strengthen the organization's robust security culture and effectively eliminate human vulnerability in information security.