A phishing kit targeting payroll is filed purely as 'IT' with no personnel-awareness angle. What interplay should the assessment capture?
Select an answer to reveal the explanation.
Short Explanation
Phishing hits both the inbox tech and the human who clicks. Keep it as technology risk, but do not pretend awareness training is optional wallpaper.
Full Explanation
Many technology risks succeed by exploiting human behavior such as credential entry on fake payroll sites. Primary classification as technology risk remains appropriate for systems and attack tooling, while personnel awareness is a necessary control dimension. Omitting the people angle underfunds training and reporting culture. Dual consideration improves treatment without forcing a false either-or category swap.