A company would like to prevent commonly known social engineering risks. Which of the following would help mitigate these risks?

Security awareness training educates employees on common social engineering techniques such as phishing, pretexting, and tailgating, enabling them to identify and report attacks before damage occurs. Regular training keeps staff current with evolving threat tactics and reinforces a security-conscious culture, which is the primary defense against human-targeted attacks.

Installing new switches improves network infrastructure but does nothing to address the human vulnerabilities that social engineering exploits.

Reviewing security policies updates documentation but does not directly change employee behavior or awareness of social engineering tactics.

A 180-day password expiration policy addresses credential security but does not help employees recognize or resist social engineering attempts.