A company wants to cultivate a strong security awareness culture among its employees. They're debating the best approach.

Which of the following actions is MOST effective in promoting a lasting culture of security awareness?

Providing phishing simulations without follow$-$up education

Focusing solely on technical security controls and policies.

Implementing mandatory, one$-$time security training sessions.

Creating an environment where employees feel comfortable reporting suspicious activity