ISO 27001 Certified badge by A-LIGNNewsWhalemate is ISO/IEC 27001:2022 certifiedSee Trust Center
Platform

Human risk
management platform

Training everyone the same way doesn't reduce risk. A human risk management platform manages who is exposed, not who completed a course.
Whalemate identifies who concentrates exposure, intervenes with precision and measures real behavioral change.

Book a demoSee the modules
8%
of people
80%
of incidents
Modules

Four integrated modules.
Un one program.

Advanced simulations

They're not awareness campaigns. They're diagnostic tools that map each person's real exposure and how their risk profile evolves over time.

See advanced simulations

Adaptive training

The platform determines what content to send, when, and to whom based on observed behavior. High risk receives immediate intervention. Low risk is not overwhelmed with irrelevant content.

See adaptive training

Human risk analytics

To identify the 8% that concentrates 80% of risk, you first have to measure it. The platform builds a continuous risk score by user, team, and organization from real behavioral signals.

See human risk analytics

Awareness agent

The intelligence that coordinates the program.

  • Analyzes each user's behavior in real time
  • Adjusts channel, difficulty and frequency of each simulation by profile
  • Adapts training based on observed risk
  • Anticipates vulnerabilities before they escalate
  • Generates actionable recommendations for the security team
Meet the Agent
Agent
LATAM

Local depth. Global reach.

Whalemate was born in LATAM and operates in the region with local depth: content, simulations, and scenarios adapted to the region's attack vectors, digital habits, and regulatory frameworks.

  • Argentina
  • Bolivia
  • Brasil
  • Chile
  • Colombia
  • Paraguay
  • Perú
  • Panamá
  • Costa Rica
  • México
  • Uruguay
  • EEUU
Mapa LATAM

A Human Risk Management program, not four loose products

Simulations, training, analytics and the agent share the roster, data governance and the evidence an auditor asks for. Module detail lives on each product page.

Whalemate does not sell an annual course with a PDF certificate or a standalone phishing simulator. It runs Human Risk Management: simulate the gesture, train when behaviour asks for it, measure who concentrates risk, and leave exportable evidence. Treasury does not get the same lure as a branch. The Agent uses the program’s rules; it does not blast to inflate a cover click rate. What leadership or audit wants to see lives in analytics and the Trust Center, not on an invented “industry average” slide.

The four modules — advanced simulations, adaptive training, human-risk analytics and the awareness agent — are not independent SKUs. They share the roster, the person’s language and the data-use limit. ISO/IEC 27001:2022 is in place. SOC 2 is not. No agent on the endpoint. Residency and subprocessors are agreed in the DPA. Published stories live under cases; if a story is not there, we do not tell it here under a pseudonym.

The demo is thirty minutes on your IdP and your context. This page does not quote and does not publish a price list: Pricing describes Smart, Growth and Enterprise and the service layers. If an RFP asks for “platform + operations + unlimited deepfake,” it is taken apart into product, managed layer and professional services. Smishing, vishing, USB, 2FA and deepfake when they are not native to the plan live under services, not in the campaign builder.

If you are comparing global catalogs such as KnowBe4, the awareness platform alternatives index ranks the contrast by object of management, not by brochure.

In this module

Program capabilities

Groups

Smart groups

Segmentation from behaviour, not a static org chart. The team that gets the most lures is not always the one with the most risk. Intervene without building lists by hand.

Roster

Manual groups and risk by group

When the directory is not enough — a project, a batch that must not be simulated — the group is built by hand and risk is read on that cut.

Brand

Brand setup and custom URL

Visual identity and account URL so the program looks in-house: portal, mail, and assets in the organization’s tone.

Frequently asked questions about the platform

What does the human risk management platform include?
The platform integrates four modules that work as a system: advanced simulations that adapt to individual risk profiles, GenAI-powered adaptive training, human risk analytics with actionable risk scores, and the Awareness Agent as the cross-cutting intelligence layer that continuously connects and adjusts everything.
How do advanced simulations work?
Simulations are not generic campaigns: they adapt to each user's risk profile. Difficulty and frequency follow behavioural history. If the person falls, contextual training fires. On the platform the native channel is email and QRishing, in three modalities: click-only, credential capture and ransomware. Smishing, vishing, USB drop, 2FA attacks and deepfake run as professional services.
What is adaptive training?
It's a GenAI-powered module that analyzes each user's behavior — their simulation responses, completed courses, and risk patterns — and automatically determines what content to send, when, and in what format. High-risk users receive immediate reinforcement; low-risk profiles are not overwhelmed with irrelevant content.
What is the risk score and how is it used?
The risk score is an actionable metric that reflects the exposure level of each user, team, and organization in real time.
What does the Awareness Agent do?
The Agent is the intelligence layer that makes the system work as a whole. It observes each user's behavior in real time, decides which intervention is most relevant, and acts on simulations, training, and analytics continuously. It's not a chatbot: it's the engine that adjusts the program without manual intervention from the security team.
Does the platform generate reports for compliance and auditing?
Yes. The platform consolidates participation evidence, simulation results, human risk evolution, and executive reports ready for internal audits, compliance reviews, and leadership presentations. All data is tracked and available when needed.
How does it integrate with the existing stack?
The roster comes in through Entra ID, Google Workspace or Okta (SSO and SCIM). Courses can be exported as SCORM to your LMS. Webhooks notify the tools you already use. There is no agent to install on endpoints. Content in Spanish, Portuguese and English.

See the platform in action

Discover how Whalemate identifies the highest-exposure profiles and intervenes
with precision to produce real behavioral change.

Book a demo