Senior executives are exempt from security training because of their schedules. Attackers recently impersonated the CEO in an attempted payment fraud targeting the finance team. What should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
Executives are the big fish attackers love to impersonate or hook, so leaving them out of training is like leaving the vault door open because the manager's busy. Keep it short and about their world. The trap is assuming technology alone will catch what you don't teach.
Full Explanation
Senior executives have broad authority, access to sensitive information and public profiles, which makes them prime targets for impersonation, spear phishing and fraud. Exempting them from training leaves a high-risk group unprepared and sends a message that security is optional. Short, tailored briefings that respect their time and focus on threats aimed at them, such as executive impersonation, payment fraud, travel risks and approval verification, address the risk while securing leadership engagement and visible support for the program. Keeping the exemption and relying on email filtering ignores that impersonation attacks often use legitimate-looking messages, phone calls or compromised accounts that filters cannot reliably stop. Having assistants complete training on the executives' behalf produces a false completion record and leaves the executives themselves untrained. Removing executives' email access is disproportionate, would disrupt the business and is not a decision the security manager could impose on senior leadership. Exam caveat: executive sponsorship and participation are recognized drivers of security culture, so tailored executive training also strengthens governance. Operational check: schedule briefings with each executive's office, record attendance, include executive scenarios in simulations with sponsor agreement and confirm payment approval processes require independent verification.