An enterprise security analyst reviews metrics from the company's annual security awareness program. Over the past two quarters, employee click-through rates on simulated phishing emails dropped from 22% to 4%. However, the percentage of employees actively reporting suspicious emails to the security operations team remained unchanged at 3%. Which of the following human risk management strategies best addresses this gap to improve overall threat detection capabilities?
- Deploy a simplified one-click phishing report button in the email client combined with immediate automated positive feedback for reporting simulations.Answer
- BImplement automated inline firewall blocking rules for all external domains flagged during simulated phishing assessments.
- CRequire employees who fail to report simulated emails to attend mandatory technical training on network intrusion prevention system log analysis.
- DReplace all email phishing simulations immediately with unannounced voice phishing (vishing) campaigns to test mobile phone vectors instead.
Answer
Deploying a simplified one-click phishing report mechanism paired with positive feedback directly addresses friction in human reporting workflows, turning passive non-clicking users into active threat detectors.
Low reporting rates despite reduced click rates indicate that users understand risk enough to avoid links, but encounter friction or lack motivation when attempting to notify security teams. Integrating a one-click report button into the user's workflow directly removes technical friction, while positive reinforcement encourages active participation in enterprise defense.
Step-by-Step Solution
Key Concept
Security Awareness Reporting Mechanisms and Behavioral Incentives