CCISO (712-50) Executive Decision Simulation

The enterprise is trying to solve a human psychology problem using technical band-aids. Attackers are shifting their focus from exploiting infrastructure to exploiting people, rendering traditional perimeter defenses ineffective against tactics like pretexting over a phone call or SMS.

From a business standpoint, investing heavily in redundant technical tools yields diminishing returns if a single employee can be tricked into handing over the keys to the kingdom. Executive leadership must align security spending with the actual threat vector: the human layer.

The risk of social engineering is high-likelihood and critical-impact. Because it frequently results in legitimate (but stolen) credentials being used, it avoids triggering standard anomalous behavior alerts, extending the attacker's dwell time and maximizing business damage.

Option C (Effective Security awareness program) is the BEST answer. It transforms the workforce from an organization's greatest vulnerability into its primary, most adaptable line of defense (the "Human Firewall"). A strong security culture allows employees to identify and report novel attacks that automated tools inevitably miss.

Options B (Anti-malware) and D (Anti-phishing) are technical controls. While critical for defense-in-depth, they are point-in-time technical fixes that attackers constantly innovate around. They cannot stop a malicious phone call or physical tailgating. Option A (Vulnerability Management) addresses software flaws, which is entirely irrelevant to human manipulation.

Effective security governance relies on balancing People, Process, and Technology. When the threat vector specifically targets People, the corresponding control must prioritize People. Security awareness is not just compliance training; it is an active, measurable risk reduction strategy.