Question

A large enterprise has run annual security awareness training for three years, with completion rates consistently above 98%. Despite this, the number of employees clicking on simulated phishing links has remained essentially unchanged year over year. The risk practitioner has been asked to advise leadership on improving the program. Which recommendation should the practitioner make FIRST?

Accepted Answer

Measure behavioral outcomes and tailor training content to the specific weaknesses the metrics reveal

Answer

Increase the frequency of the mandatory annual training to quarterly for all staff

Answer

Impose disciplinary action on employees who fail simulated phishing tests

Answer

Replace the internal training with a vendor-provided certified curriculum