Which of the following would be MOST helpful in assessing the risk associated with data loss due to human vulnerabilities?

Reviewing password change history focuses on password hygiene but doesn't assess broader human vulnerabilities like susceptibility to social engineering.

Performing periodic access recertification addresses excessive privileges but not the human element of being tricked into causing data loss.

Social engineering exercises, such as phishing simulations or pretexting calls, directly test an organization's human defenses by attempting to exploit employees' susceptibility to manipulation, which is a primary vector for data loss due to human vulnerabilities like clicking malicious links or revealing sensitive information. This provides a realistic measure of how individuals might react to real-world threats.

Security awareness surveys measure understanding and perception, but they don't directly test behavior or susceptibility to actual human-centric attacks that lead to data loss.