How should security awareness training be structured to mitigate phishing and insider threats?

• A. Phishing simulations, role-based training, clear policies, encourage reporting, periodic refreshers
• B. One-time lecture with no follow-up
• C. Avoid policy communication
• D. Infrequent updates

Answer: (C)

Structured security awareness training should be ongoing and comprehensive, combining practical exercises with clear guidance and support so employees stay vigilant against phishing and insider risks. Phishing simulations give people real-world practice in spotting suspicious emails and links in a safe environment, turning cautious recognition into automated habits. Role-based training targets the specific duties and threat scenarios relevant to different teams, so staff understand exactly what to look for and how their actions affect security. Clear policies lay out expectations, acceptable use, and the steps to take when something looks suspicious, providing a consistent framework for behavior. Encouraging reporting creates a safe channel to escalate potential incidents, allowing rapid containment and learning from near misses. Periodic refreshers keep awareness current, addressing newer phishing techniques and evolving insider threat indicators while counteracting memory decay.

Avoiding policy communication leaves employees unclear about rules and reporting paths, which weakens the training’s impact. A one-time lecture with no follow-up fails to reinforce lessons or adapt to changing threats, and infrequent updates miss new attack methods and insider tactics.