Which of the following is the BEST recommendation to address recent IT risk trends that indicate social engineering attempts are increasing in the organization?

Simulated phishing attacks directly test user susceptibility to social engineering techniques and provide immediate, practical training opportunities to improve employee awareness and response. This hands-on approach is highly effective in reducing human vulnerability, which is the primary target of social engineering attacks.

Updating spam filters is a technical control that might help reduce email-based social engineering but does not address other forms (e.g., vishing, smishing) or the crucial human element of awareness.

Revising the acceptable use policy provides guidelines but does not actively train or test users' ability to identify and resist social engineering attempts in real-time.

Strengthening disciplinary procedures might deter non-compliance but does not educate employees on how to recognize and avoid social engineering attacks in the first place, which is a proactive measure.