An awareness program still focuses on threats from several years ago, while recent incidents involved voice phishing calls and malicious QR codes. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
Teaching people to spot last decade's scams is like training a goalkeeper on penalties nobody takes anymore. Your content has to follow the attacks you're actually seeing. The trap is running the old material more often; you just practice the wrong thing twice.
Full Explanation
Awareness content should reflect the threats the organization actually faces, and incidents are one of the best indicators of those threats. Voice phishing and malicious QR codes use different cues from traditional email phishing, so staff trained only on older patterns may not recognize them. The manager should update the content using incident data and threat intelligence, and establish a periodic review so the material stays current. Keeping content unchanged to avoid confusion prioritizes familiarity over relevance; a stable program that addresses yesterday's attacks leaves people unprepared for today's. Replacing training with technical controls that block every phishing attempt rests on an unrealistic premise: no control blocks all social engineering, and voice calls in particular bypass email filters entirely. Technical controls and training work together. Running the existing module twice a year increases exposure to outdated content without closing the gap between what staff are taught and what attackers are doing. Exam caveat: CISM links awareness to the risk assessment and threat landscape, so content changes should be driven by risk rather than by a fixed calendar alone. Operational check: compare the topics in the current curriculum with the categories of social engineering incidents recorded over the past year, and record a content owner and review date for each module.