Question

A large enterprise has run mandatory annual security awareness training for three years, yet the incident response team reports that credential-harvesting phishing remains the leading cause of account compromise. Executive leadership asks the CISO to demonstrate whether the awareness program is actually reducing risk and to justify continued investment. Which approach BEST enables the CISO to measure and improve the program's effectiveness?

Accepted Answer

Conduct recurring simulated phishing campaigns, track click and reporting rates over time by department, and deliver targeted role-based training to high-risk groups

Answer

Increase the frequency of the annual computer-based training module to quarterly and require a passing quiz score for all employees

Answer

Replace the internal program with an attestation that each employee has read the acceptable use policy and signed an annual acknowledgment

Answer

Deploy an email security gateway with advanced link rewriting so that user behavior no longer affects phishing outcomes