While updating the security awareness training, a security analyst wants to address issues created if vendors' email accounts are compromised. Which of the following recommendations should the security analyst include in the training?

The correct answer is to be alert to unexpected requests from familiar email addresses. When a vendor's email account is compromised, attackers often send phishing emails or fraudulent requests (like changes to payment details) from the legitimate, but now controlled, email address. Employees are more likely to trust emails from familiar addresses, making this a critical vulnerability. Training should emphasize verifying unusual requests, even from known contacts, through an alternative communication channel (e.g., a phone call to a known number). Refraining from clicking on images from new vendors is a good general security practice but doesn't specifically address the compromise of an existing vendor's account. Deleting emails from unknown service provider partners is also a good general practice but doesn't tackle the specific threat of a compromised known vendor. Requiring invoices as attachments is a poor recommendation as attachments are a common vector for malware and could increase risk if the sender's account is compromised.