Resources

Criterion for building the program, not a padded download center

Podcast, blog, cases, glossary, reports and webinars. Context for CISOs, IT, People and compliance: before a demo, or after, to brief a committee.

Capa8 is the human-factor podcast. The blog is research, guides and threats. Cases are customer stories. The glossary defines the vocabulary. Compliance orders the frameworks. Reports and webinars, when one is published, live in their section.

It is not an academy and not a media kit with audience figures. If you want a number from a report, go to reports. If you want a session, webinars. If you want how a program was measured, cases. Each resource has its place.

The glossary covers risk score, QRishing, PCI DSS 12.6, agent. Compliance does not replace the evidence module: it is the frameworks conversation. Use this index to arrive at the meeting with better questions. Use the demo when the index is not enough.

Human Risk Management resources

Podcast, blog, case studies and compliance to manage the human factor.

See episodes

Blog

Articles, guides and analysis on human risk management,
awareness and security culture

Guides and analysis for CISOs, IT and compliance teams in LATAM who need to explain the human factor — and decide what to do about it.

Fortinet awareness metrics go beyond completion

HRM

Oct 7, 2026By Federico Hombre

Fortinet awareness metrics go beyond completion

NIST, Fortinet, and the 2025 survey show a gap: behavior and event-based remediation can be measured, but many companies still track activity.

ISO 27001:2022 requires continuous awareness

Compliance

Oct 6, 2026By Federico Hombre

ISO 27001:2022 requires continuous awareness

Clause 7.3 and control 6.3 call for a formal, role-based program. The evidence challenges annual training and points to behavior metrics.

LATAM human risk management company metrics

HRM

Oct 5, 2026By Federico Hombre

LATAM human risk management company metrics

For CISOs, IT, and compliance teams in LATAM, HRM means tracking continuous behavior, turning it into risk, and keeping evidence for ISO 27001 and PCI DSS.

See all articles

SUCCESS STORY

From training to managing
risk

With more than 3,000 employees, NaranjaX replaced generic campaigns with a program that measures each area's exposure, runs realistic simulations and sets a clear rule for when to step in. Its security team now reports real risk, not completed courses.

See more success stories

Questions about the resources hub

Where is the latest report or the next webinar?

On reports and webinars, when one is published. If you do not see a PDF or a date right now, there is none yet. You can ask for a notice via contact or book a demo. We do not send a preview with loose figures.

Can I republish or translate a piece?

Cite with a link. If you need a full republication or a formal translation, write to contact. Cases have a narrative agreed with the customer: do not crop them to invent a metric. The glossary can be cited as a definition, not as a legal opinion.

Does the hub replace a demo?

No. It orders criterion. The demo walks your roster and your IdP. A Capa8 episode does not configure SCIM. A case is not your rollout. Use the hub to arrive at the meeting with better questions. Use the meeting for the product.

Is there a newsletter with every resource?

We do not announce a cadence we do not hold. Notice of a report or a webinar is requested via contact or in the demo. If a formal signup exists later, it will be published. Until then there is no ghost form to “subscribe to the 12 reports of the year.”

Compliance

Behavior and evidence for Compliance

Whalemate organizes evidence, reports, and traceable controls to demonstrate program progress to internal audits and regulatory frameworks.

See use case

Want to appear on Capa8?

If you're a cybersecurity leader in LATAM with a story worth telling, we'd love to hear from you.