2 added 282 characters in body
source | link

Going out on a limb here, I believe in testing by regular drills and Red Team simulated attacks. If the Red Team succeeds in social engineering or other kinds of compromise, the awareness is nil.

Reasoning: KPIs and surveys and whatnot measure and report averages. The attacker is not interested in averages, he's going to attack (citing from a recent comment by one of the Sec.SE denizens) the laptop belonging to the CFO's secretary, or whatever weakest spot he finds.

You are also looking for anti-complacency measures. I cannot find a better way to keep users on their toes than regular drills, spot checks and the very real threat of an actual attack.

enter image description here

Going out on a limb here, I believe in testing by drills and Red Team simulated attacks. If the Red Team succeeds in social engineering or other kinds of compromise, the awareness is nil.

Reasoning: KPIs and surveys and whatnot measure and report averages. The attacker is not interested in averages, he's going to attack (citing from a recent comment by one of the Sec.SE denizens) the laptop belonging to the CFO's secretary, or whatever weakest spot he finds.

Going out on a limb here, I believe in testing by regular drills and Red Team simulated attacks. If the Red Team succeeds in social engineering or other kinds of compromise, the awareness is nil.

Reasoning: KPIs and surveys and whatnot measure and report averages. The attacker is not interested in averages, he's going to attack (citing from a recent comment by one of the Sec.SE denizens) the laptop belonging to the CFO's secretary, or whatever weakest spot he finds.

You are also looking for anti-complacency measures. I cannot find a better way to keep users on their toes than regular drills, spot checks and the very real threat of an actual attack.

enter image description here

1
source | link

Going out on a limb here, I believe in testing by drills and Red Team simulated attacks. If the Red Team succeeds in social engineering or other kinds of compromise, the awareness is nil.

Reasoning: KPIs and surveys and whatnot measure and report averages. The attacker is not interested in averages, he's going to attack (citing from a recent comment by one of the Sec.SE denizens) the laptop belonging to the CFO's secretary, or whatever weakest spot he finds.