Domain 2 · Objective reference 2.3 · Chapter 8 of 19
Build security awareness that changes behavior
About 5 minutes · ISC2 CC outline effective 1 September 2026
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Make the safe action easy to perform.
Explore the anchors
Spot suspicious requests.
Concept matching activity
Match this task or description to its concept:
Use the approved reporting path.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Recognize the mechanism of social engineering
- Make the organization support the desired action
Recognize the mechanism of social engineering
Social engineering manipulates people into actions or disclosures. Phishing commonly uses messages or websites; voice calls, text messages, impersonation and physical pretexts can serve similar goals. Urgency, authority, fear and familiarity can reduce scrutiny. A familiar voice or realistic video is not sufficient identity proof because it can be reproduced or fabricated.
Teach a concrete behavior for each scenario: verify a payment change through a known independent channel, use an approved password manager, avoid sharing authenticators and report suspicious requests through the designated route. Verification must not rely only on contact details supplied by the suspicious request itself.
Make the organization support the desired action
Leadership behavior, workload, incentives and reporting experience shape culture. Staff who are punished for reporting mistakes may hide incidents. A reporting channel that nobody monitors defeats good user behavior. Training should fit the role, be refreshed as processes change and include contractors or privileged staff where relevant.
Controlled simulations can reveal weaknesses, but require authorization, safety limits and an appropriate approach to privacy. Evaluate both user action and the handoff to response. Prefer aggregated improvement measures over unnecessary public naming. Completion records show participation; observed verification, prompt reporting and correctly handled reports provide different evidence of effectiveness.
Worked example
A worker receives a convincing voice request to change a supplier bank account. They call the supplier using the number already held in the approved supplier record and route the requested change through the normal approval process.
Check your understanding
A simulation produces many staff reports, but the reports never reach analysts. Which parts succeeded and failed?
Show explanation
Users demonstrated reporting behavior. The routing or response handoff failed. Report both findings and test the complete path after correcting it.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.