Human risk and cybersecurity blog
Guides and analysis for CISOs, IT and compliance teams in LATAM who need to explain the human factor — and decide what to do about it.
NIST and CISA on social engineering
For CISOs, IT, and compliance teams, the issue is measuring recognition, reporting, and coverage by role and channel, not just annual training.
Read more
Fortinet awareness metrics go beyond completion
NIST, Fortinet, and the 2025 survey show a gap: behavior and event-based remediation can be measured, but many companies still track activity.
Read more
ISO 27001:2022 requires continuous awareness
Clause 7.3 and control 6.3 call for a formal, role-based program. The evidence challenges annual training and points to behavior metrics.
Read more
LATAM human risk management company metrics
For CISOs, IT, and compliance teams in LATAM, HRM means tracking continuous behavior, turning it into risk, and keeping evidence for ISO 27001 and PCI DSS.
Read more
ISO 27001 and human risk management platforms
ISO 27001 requires continuous, effective programs. HRM turns them into behavior metrics, risk prioritization, and evidence for leadership.
Read more
Smishing and vishing under PCI DSS 12.6
SMS and voice are not the same for CISOs and compliance. PCI DSS 12.6 requires formal awareness and separate measurement of both channels.
Read more
Human Risk Management: What It Measures
HRM combines continuous awareness standards with behavior metrics to prioritize interventions, reallocate resources, and report human risk.
Read more
PCI DSS 12.6: Vishing and Smishing Scope
Vishing and smishing are no longer just phishing variants. Under PCI DSS 12.6, they require a formal program, channel metrics, and steady improvement.
Read more
PCI DSS 12.6 Requires Vishing Coverage
Vishing and smishing are voice and SMS phishing. Under PCI DSS 12.6, measuring only email or course completion leaves a compliance gap.
Read more
APWG and PCI DSS: Smishing Is Rising
Smishing is growing on mobile channels while PCI DSS v4.0 requires annual awareness training and explicit phishing and social engineering content.
Read more
Security awareness training: measure clicks, not courses
NIST, UC San Diego, Frontiers, Verizon and SANS agree that annual training alone is not enough. The useful metric is sustained behavior.
Read more
ISO, NIST, SANS, Verizon on phishing training
ISO calls for a continuous program for all employees, NIST and SANS make it measurable, and Verizon shows the risk happens in seconds.
Read more
Whalemate: Human Risk Management platform
Whalemate frames security awareness as Human Risk Management, not a standalone course. CIS, NIST, SANS, and recent studies show mixed results.
Read more