How GDL Logística turned human risk into a measurable indicator
A logistics company with more than 1,000 employees needed visibility into real user behavior — not just who finished a course. With Whalemate they measured human risk, trained against that exposure, and started backing security investment decisions with data, from operations to the board.
No data, no visibility into human risk
Before Whalemate, there was no way to measure human risk. Awareness was limited to monthly emails with no visibility into who read them.
Cyber risk kept growing even with security tools properly configured. The missing piece was action on the human factor.
Awareness that can be measured
The security team identified human behavior as the main risk factor and went looking for a tool to measure and address it.
Whalemate stood out by turning awareness into something measurable: every campaign generates behavioral indicators to classify risk and track each user’s progress.
Monthly simulations as a team habit
GDL uses Whalemate for monthly phishing tests and to train users against real-world risk situations.
Recurring simulations made security a habit: every test is a concrete learning opportunity for the employee.
Growing maturity, decisions backed by data
Since implementing Whalemate, user maturity has grown month over month with clear indicators of progress.
Those indicators changed the conversation with leadership: today the security team can justify to the Board, with data, the need to invest in Information Security.
Whalemate is helping us make our corporate environment much safer through its awareness platform, and because of that I can justify to the Board, through indicators, the need to invest in Information Security.
Want a program like this for your organization?
We'll show you how Whalemate adapts to your industry, user population and awareness maturity: simulations, adaptive training and human-risk analytics, with a concrete plan for your organization in LATAM.
Measure human risk so you can talk to the board
GDL Logística went from monthly emails with no visibility to recurring simulations and an indicator that justifies investment. That shift can be replicated in any sector.
The reusable lesson is treating awareness as something you measure, not as a send. They had no way to see who was reading. They moved to recurring tests and to training against real situations. The habit — a simulation understood as learning, not a trap — is copyable in any operation with a large roster and little room time. What matters is the indicator that lets you talk to leadership.
What you do not replicate is the size or the logistics sector as magic. Your operation may not have a thousand people and still need visibility. Their testimonial talks about justifying information-security investment with indicators. Another organization can copy that table: bring behavior, not attendance. It cannot copy “maturity grows month by month” as its own KPI until it has its own runs.