Question

An organization has delivered mandatory annual security awareness training to all employees for three years, achieving a 100% completion rate each year. Despite this, the number of employees clicking on simulated and real phishing links has remained unchanged. The information security manager is asked to improve the program. What should be the FIRST action?

Accepted Answer

Evaluate whether the training content and delivery are changing employee behavior and address identified gaps

Answer

Increase the frequency of the mandatory training from annual to quarterly

Answer

Implement disciplinary action for employees who fail simulated phishing tests

Answer

Deploy an advanced email filtering solution to block phishing messages before delivery