Instructure recognizes that people are our first line of defense. This begins by creating foundational awareness wherein all Instructure personnel are required to complete Instructure's Compliance, Privacy, and Security Awareness Training upon hire, as per our employment terms and conditions, and annually thereafter. The content of this training includes all relevant areas of security (online, mobile, physical, 2FA, etc.), privacy, and compliance requirements for each employee - including our policies. Furthermore, Instructure conducts continuous awareness campaigns to ensure employees are informed of our constantly changing threat landscape and that they are equipped and empowered to identify and report security risks. In addition, employees are subjected to simulated phishing campaigns on a regular basis.