An organization has been experiencing an increasing number of spear phishing attacks Which of the following would be the MOST effective way to mitigate the risk associated with these attacks?

Updating firewall configuration primarily protects against network-based attacks and does not prevent users from being tricked by emails that have already bypassed perimeter defenses.

Requiring strong password complexity helps protect accounts once credentials are stolen but does not prevent the initial compromise where users might click malicious links or provide information through social engineering.

Spear phishing attacks specifically target individuals through personalized social engineering tactics. A robust security awareness program educates employees on how to identify suspicious emails, recognize social engineering cues, and properly report potential phishing attempts, making them the primary defense against these highly personalized threats.

Implementing two-factor authentication adds a layer of security to account access, but it doesn't prevent the initial compromise via a malicious link or file, nor does it prevent other forms of social engineering that don't immediately require password entry.