Security practitioners have two defenses at their disposal: the human and the technical. The technology for combating spyware is improving, but antivirus vendors have only recently started adding functionality to target it. Training should be a condition of employment with mandatory attendance noted as part of annual performance reviews. The most effective policy is to prohibit employee access to the Internet altogether, but this may be unrealistic since many employees need Internet access for their work. The best defense is the human one employees and end users.”]