A CISO wants to measure how often employees click phishing links and demonstrate a downward trend each quarter. Which control fits this requirement?
Select an answer to reveal the explanation.
Short Explanation
You can't improve what you don't measure, and you can't measure clicks you've blocked before anyone sees them. Simulated phishing with training gives you a click rate per campaign to trend over time. The technical controls are great at stopping mail, but they don't tell you how your people behave.
Full Explanation
Security awareness training is an administrative control that reduces human susceptibility to social engineering. Recurring simulated phishing campaigns send realistic test messages, record who clicks, who submits credentials, and who reports the message, and deliver just-in-time training to those who fall for it. Comparing click and report rates across campaigns of similar difficulty produces exactly the metric the CISO wants and shows whether behavior improves. A gateway rule that quarantines messages with external links is a technical control that reduces exposure, but it prevents users from seeing the messages, so it produces no measurement of user behavior and would disrupt legitimate mail. DNS-layer security blocks connections to known malicious domains after a click, which limits harm and may log blocked requests, but it does not measure susceptibility to new lures or show improvement from training. DMARC aggregate reports describe authentication results for mail claiming to be from the company's domain; they measure spoofing attempts against outsiders, not employee clicking. Exam caveat: rising report rates are as important as falling click rates, since reporting feeds incident response. Operational check: baseline the click rate, run campaigns on a fixed schedule with comparable difficulty, and review trend data each quarter.