The introduction of a security awareness program has resulted in a quick decrease in security...

Security awareness programs require ongoing engagement to remain effective. If security incidents decrease initially but increase after eight months, the most likely cause is thatmessage materials are few and static, and renewal is not taking place(C). Static content becomes outdated or ignored over time, reducing its impact. Regular updates, new campaigns, and varied delivery methods (e.g., videos, quizzes) are essential to maintain employee awareness and adapt to evolving threats, as perISO/IEC 27001orNISTsecurity awareness guidelines.

Insufficient budget (A):While budget constraints could limit program scope, there’s no evidence in the scenario to suggest this is the primary issue.

Scope too narrow (B):A narrow scope might limit effectiveness initially, but the initial success suggests the scope was adequate; the issue is sustaining engagement.

Lack of resources for instructor-led sessions (D):Instructor-led sessions are one delivery method, but the core issue is likely outdated content rather than delivery format.