City help desks now face deepfake voice calls and AI-assisted phishing, but security training content has not been updated in years. What should the awareness program do?
Select an answer to reveal the explanation.
Short Explanation
If help desks are getting AI-flavored scams and the training still lectures about floppy disks, the program is stale. Refresh the stories when the attackers refresh their toolkit. Periodic content review is the habit.
Full Explanation
Awareness programs must periodically review and refresh content to cover emerging technologies and tactics, including deepfake voice calls and AI-assisted phishing now hitting city help desks. Legacy modules that never mention synthetic voice or AI-crafted lures leave staff unprepared for current attack techniques. Banning all telephone contact with the public is operationally unrealistic for municipal service desks and is avoidance theater rather than training improvement. Declaring AI threats out of scope misreads modern security practice and Domains that expect programs to address evolving risk. Preserving outdated modules only to protect historical completion metrics prioritizes vanity statistics over actual readiness. Exam caveat: CISSP expects awareness content to remain current with the threat landscape and technology changes. Operational check: schedule content reviews at least annually and after material tactic shifts; add deepfake and AI-phishing recognition, verification callbacks, and escalation paths for help-desk staff; and retire obsolete modules. Pilot new scenarios with the service desk, measure report rates and successful verifications, and brief leadership on residual social-engineering risk after refresh.