A security administrator wants to implement a program that tests a user's ability to recognize attacks over the
organization's email system. Which of the following would be best suited for this task?


A. Social media analysis
B. Annual information security training
C. Gamification
D. Phishing campaign