Which practice supports a proactive stance against insider threats through culture?

• A. Security alarms only.
• B. Security culture and ongoing awareness training.
• C. Anonymous tips line only.
• D. Frequent external audits without training.

Answer: (B)

A security-minded culture paired with ongoing awareness training builds a proactive defense against insider threats by shaping everyday behavior. When the organization emphasizes norms of accountability, psychological safety to report concerns, and clear expectations for how information is handled, employees become vigilant about risky actions and more willing to flag suspicious behavior before it leads to harm. Ongoing training reinforces how threats can arise—such as social engineering, data mishandling, or careless access—so the guidance stays fresh and relevant as systems and risks evolve. This combination turns security into part of daily work, not a separate, occasional task, making it easier to prevent incidents and catch problems early.

Relying only on security alarms addresses physical controls after something happens, and can be bypassed or ignored by someone with insider access. An anonymous tips line is valuable for reporting but doesn’t by itself establish the knowledge, norms, or daily practices that deter risky behavior. Frequent external audits can uncover gaps, but without a culture that prioritizes security and continuous training, employees won’t consistently apply secure practices or recognize and report issues.

So, cultivating security culture plus ongoing awareness training harmonizes people, processes, and policies to prevent insider threats before they arise.