A security officer is implementing a security awareness program and is placing security-themed posters around the building and is assigning online user training. Which of the following would the security officer most likely implement?

A phishing campaign is a simulated attack designed to test and improve user awareness of social engineering tactics. By sending fake phishing emails, the security officer can assess how users respond to suspicious communications and identify areas where further training is needed. This directly aligns with the goal of a security awareness program that includes posters and online training. Password policies define rules for creating strong passwords but don't directly test user awareness of social engineering. Access badges control physical entry and are not a component of a security awareness program focused on digital threats. A risk assessment identifies and evaluates potential threats and vulnerabilities but is a broader process, not a specific awareness-building activity like a phishing campaign.