The purpose of this work is to demonstrate different opportunities to counter spear phishing in an organization. Data has been collected through 15 interview situations through semi-structured interviews and then analyzed using a thematic analysis method linked to the study's theory regarding social psychological factors. The result shows that education and awareness regarding IT-security is generally low among respondents. The result also shows that it is of great importance for users and organizations to understand and be able to protect themselves against Social engineering and specifically spearphishing. Furthermore, it was found that everyone in an organization needs to know about threats and risks so that the organization will not suffer badly in the event of attack attempts.