Which of the following is the BEST indication that an organization's phishing awareness training is a success?

Question

Options

• AA significant increase in reporting by users following training
• BA decrease in the number of phishing attempts over time
• CAn external audit team confirmed all staff completed the training
• DEnd-of-training quiz scores are higher than in the past

• A
  71% (22)
• B
  10% (3)
• C
  3% (1)
• D
  16% (5)

Explanation

Increased user reporting of phishing attempts is the strongest behavioral indicator that training has changed how employees think and act - they're now recognizing and responding to threats rather than ignoring or falling for them. B is wrong because phishing attempt volume is controlled by attackers, not the organization, so a decrease has no relationship to internal training effectiveness. C is wrong because completion of training is a process metric, not an outcome metric - attending a class doesn't prove anyone learned anything. D is wrong for the same reason: quiz scores measure knowledge retention immediately after training, not whether employees apply that knowledge in real situations.

Memory tip: Think "behavior over box-checking." The only answer that reflects a real-world behavioral change is A - users actually doing something differently (reporting) rather than just sitting through training or scoring well on a test.

No community discussion yet for this question.