For AutoRisk, employees might know how to recognise phishing but still click suspicious links when they are busy. I think short exercises would be more useful than only giving them a presentation once a year.

Would the number of reported phishing emails be a better way to measure awareness than quiz results? Employees could pass a quiz but still fail to report a real attack.

If AutoRisk uses a cloud provider, how can it check that customer data is protected properly? Would reviewing the provider's security reports be enough, or should AutoRisk also test its own access settings regularly?

AutoRisk depends on external services like FINN.no and Statens vegvesen. If one of these services has problems, customers may not receive correct reports. Even though AutoRisk does not control those services, it still needs a plan for handling the situation.

How often should a small company review its security procedures? Would once a year be enough, or should they update them whenever a system or supplier changes?

This could be a problem for AutoRisk if only one developer knows how an important system works. If that person leaves, the company might struggle to fix problems. Writing down the process would make it easier for someone else to take over.