Human risk and cybersecurity blog
Guides and analysis for CISOs, IT and compliance teams in LATAM who need to explain the human factor — and decide what to do about it.
CISA, NIST and CIS on phishing training
The frameworks agree on training, but differ on frequency and scope. Measuring clicks alone leaves reporting out.
Read more
Cybersecurity Awareness Month and Human Risk
October can kick off communication, but ISO, NIST, and CIS call for a continuous, measurable, role-based program.
Read more
NIST, CIS, and PCI on measurable social engineering
NIST, CIS, and PCI call for ongoing or periodic awareness, but evidence alone does not prove fewer clicks. Measure behavior by role.
Read more
NIST, PCI and Brazil on social engineering
For CISO, IT and compliance teams, social engineering must be measured with clicks, reports
Read more
NIST and CIS on measuring social engineering
NIST, CIS, ISO, PCI, and CISA show that social engineering is measured by recognition, reporting, and response, not just training completion.
Read more
NIST and CISA on social engineering
For CISOs, IT, and compliance teams, the issue is measuring recognition, reporting, and coverage by role and channel, not just annual training.
Read more
Fortinet awareness metrics go beyond completion
NIST, Fortinet, and the 2025 survey show a gap: behavior and event-based remediation can be measured, but many companies still track activity.
Read more
ISO 27001:2022 requires continuous awareness
Clause 7.3 and control 6.3 call for a formal, role-based program. The evidence challenges annual training and points to behavior metrics.
Read more
LATAM human risk management company metrics
For CISOs, IT, and compliance teams in LATAM, HRM means tracking continuous behavior, turning it into risk, and keeping evidence for ISO 27001 and PCI DSS.
Read more
ISO 27001 and human risk management platforms
ISO 27001 requires continuous, effective programs. HRM turns them into behavior metrics, risk prioritization, and evidence for leadership.
Read more
Smishing and vishing under PCI DSS 12.6
SMS and voice are not the same for CISOs and compliance. PCI DSS 12.6 requires formal awareness and separate measurement of both channels.
Read more
Human Risk Management: What It Measures
HRM combines continuous awareness standards with behavior metrics to prioritize interventions, reallocate resources, and report human risk.
Read more
PCI DSS 12.6: Vishing and Smishing Scope
Vishing and smishing are no longer just phishing variants. Under PCI DSS 12.6, they require a formal program, channel metrics, and steady improvement.
Read more
PCI DSS 12.6 Requires Vishing Coverage
Vishing and smishing are voice and SMS phishing. Under PCI DSS 12.6, measuring only email or course completion leaves a compliance gap.
Read more
APWG and PCI DSS: Smishing Is Rising
Smishing is growing on mobile channels while PCI DSS v4.0 requires annual awareness training and explicit phishing and social engineering content.
Read more
Security awareness training: measure clicks, not courses
NIST, UC San Diego, Frontiers, Verizon and SANS agree that annual training alone is not enough. The useful metric is sustained behavior.
Read more
ISO, NIST, SANS, Verizon on phishing training
ISO calls for a continuous program for all employees, NIST and SANS make it measurable, and Verizon shows the risk happens in seconds.
Read more
Whalemate: Human Risk Management platform
Whalemate frames security awareness as Human Risk Management, not a standalone course. CIS, NIST, SANS, and recent studies show mixed results.
Read more