A risk practitioner has been notified of a social engineering attack using artificial intelligence (AI) technology to impersonate senior management personnel. Which of the following would BEST…

Subscription to data breach monitoring sites helps detect if data has been compromised, but it does not prevent or mitigate the impact of an active social engineering attack.

Suspension and takedown of malicious domains or accounts is a reactive measure that addresses the attack infrastructure after it has been identified, but it doesn't prevent the initial compromise or mitigate the impact on an already targeted employee.

Increased monitoring of executive accounts might help detect suspicious activity post-compromise but does not prevent the initial social engineering attempt or educate employees to avoid being victimized.

Social engineering attacks, particularly those using advanced AI impersonation, prey on human vulnerabilities rather than technical ones. Comprehensive training and awareness programs educate employees on recognizing the tactics, techniques, and red flags of such attacks, empowering them to question suspicious requests and follow proper verification protocols, thereby significantly mitigating the impact.