A small group of employees repeatedly fails phishing simulations despite completing the standard awareness training. What is the BEST response for the information security manager?
Select an answer to reveal the explanation.
Short Explanation
When a few players keep missing the same shot, a good coach takes them aside for extra practice; they don't bench them or shame them in front of the team. Targeted help fixes the behavior. The trap is punishment, which mostly teaches people to hide mistakes from you.
Full Explanation
Repeated failure by a small group indicates that the standard training is not working for those individuals, perhaps because of their role, the volume of external email they handle or how they learn. Targeted coaching, such as short one-to-one or small group sessions, just-in-time guidance after a failure and follow-up simulations, addresses the specific behavior and lets the program measure improvement. It maintains a positive security culture in which people are willing to report mistakes. Publicly naming employees creates embarrassment and fear, damages trust in the security function and discourages people from reporting real incidents they may have caused. Starting disciplinary proceedings for failing simulations is disproportionate as a first response and has a similar chilling effect; discipline may become relevant only for persistent, willful disregard after support has been given and within HR policy. Stopping simulations for the group removes the measurement and practice exactly where risk is highest, leaving the weakness unaddressed and hidden. Exam caveat: CISM emphasizes building a security-aware culture, so responses that rely on fear or exemption are generally inferior to supportive, measurable improvement. Operational check: track the group's simulation results after coaching, compare them with the wider population and escalate through management only if improvement does not follow.