Cybersecurity Awareness Month and Human Risk

Cybersecurity Awareness Month can serve as a communication trigger in October, but by itself it does not meet what ISO/IEC 27001:2022, NIST CSF 2.0, and CIS Control 14 expect. The overlap between those frameworks and empirical evidence points to something else: a continuous, measurable program differentiated by role, because neither an annual course nor a themed campaign automatically reduces human risk, according to the studies cited.

What the overlap between campaign, frameworks, and measurement shows

Placed side by side, the sources show something none of them presents on its own. CISA and NIST describe a public October campaign, while ISO, NIST CSF 2.0, and CIS describe expectations for ongoing management, role differentiation, and, in CIS's case, minimum frequency and compliance metrics.

If October exists, why it is not enough as a program

CISA defines Cybersecurity Awareness Month as a public awareness initiative and offers tools so organizations can build campaigns, according to the Cybersecurity Awareness Program and CISA's official toolkit. NIST places the campaign in October and notes that since 2004 the U.S. government and industry have collaborated during that month, according to NIST's official page.

Whalemate's reading is that this describes a communications vehicle, not a compliance standard. The material itself shows that ISO/IEC 27001:2022 does not define Cybersecurity Awareness Month as a requirement, according to ISO's public page, so using October as a substitute for the program leaves a gap between campaign and management system.

What ISO/IEC 27001:2022 requires beyond a campaign

Clause 7.3 of ISO/IEC 27001:2022 requires people under the organization's control to be aware of the information security policy, their contribution to the effectiveness of the ISMS, and the implications of not conforming to ISMS requirements, according to DataGuard's reproduction of the clause. ISO/IEC 27001:2022 is also presented as a standard for adopting a risk-based perspective, according to ISO.

Whalemate's reading is that awareness, in ISO terms, is not the same as sending October assets or completing a course. If the ISMS requires evidence of how awareness is sustained, how it aligns with risk, and how it integrates with controls identified in the risk assessment, then a standalone campaign functions as support, not sufficient compliance.

NIST CSF 2.0 calls for general awareness or role-based training

NIST CSF 2.0 distinguishes two specific outcomes. PR.AT-01 says personnel should receive awareness and training to perform general tasks with cybersecurity risks in mind, and PR.AT-02 says people in specialized roles should receive awareness and training to perform relevant tasks with those risks in mind, according to NIST CSF 2.0.

The practical tension is clear. An October campaign works for general messages, but on its own it does not address the need for training specialized roles that PR.AT-02 describes, according to NIST. Whalemate's reading is that a CISO needs to separate general staff from higher-exposure groups, such as administrators, developers, or personnel with greater social engineering risk, before deciding on content and frequency.

What CIS Control 14 adds that ISO and NIST do not spell out

CIS Control 14 is called Security Awareness and Skills Training and is meant to shape workforce behavior to reduce cyber risk, according to CIS. Safeguard 14.1 requires establishing and maintaining a program, training at onboarding and at least annually, and reviewing or updating the content at least yearly or when there are significant changes, according to CIS Controls v8.

CIS also requires training to recognize social engineering attacks, including phishing, pretexting, and tailgating, and it includes role-specific training, with examples such as secure system administration, OWASP Top 10 for developers, and advanced social engineering for high-profile roles, according to CIS. Whalemate's reading is that CIS turns what appears in other frameworks as a principle into a maintained program, updated content, and segmentation.

What is actually measured, and why completion rate is not enough

NIST reports that government programs use a mix of measures: incidents tied to training topics, user-initiated reports, clicks on phishing simulations, viewing or interaction with materials, and survey or interview feedback, according to NIST's report on measurement. The same work says 84% of the organizations studied used training completion and 72% used click rate, according to NIST.

But NIST also shows that mature measurement does not stop there. According to NIST, 62% measured simulated phishing reports, 53% real phishing reports, and 64% of participants used at least five effectiveness measures. Whalemate's reading is that completion rate and click rate are activity or partial outcome metrics, useful but insufficient to claim a reduction in human risk.

What measuring reports adds, beyond clicks

NIST defines click rate as the share of people who clicked out of the total who received the simulated phishing, and report rate as the share of people who reported the suspicious email out of the total recipients, according to NIST TN.2276. NIST Phish Scale adds context about the human difficulty of detecting the email and the context of its recipients, also according to NIST TN.2276.

Whalemate's reading is that the reporting channel deserves as much attention as click rate. In NIST's pilot with three embedded exercises, click rates ranged from about 9% to 20% and report rates from 26% to nearly 35%, according to NIST, showing that two campaigns with the same click rate can mean different things if lure difficulty and reporting capacity are not considered together.

Does an annual course reduce risk, or only organize the calendar?

The controlled study from UC San Diego, with more than 19,500 employees and ten simulated phishing campaigns over eight months, did not find a significant relationship between recently completing mandatory annual training and the likelihood of falling for simulated phishing emails, according to the University of California San Diego. In that same study, embedded training after a click reduced the likelihood of clicking again by about 2%, and interactive training, when completed, was associated with a reduction of about 19% in the likelihood of failing future simulations, according to UC San Diego.

Against that, KnowBe4 reported across more than 60,000 organizations, 32,604,108 users, and 493,871,295 phishing tests that groups with weekly tests were 2.74 times more effective at reducing risk than groups with a frequency lower than quarterly, and that groups with monthly or more frequent training and weekly or more frequent tests improved their Phish-prone Percentage by 96%, according to KnowBe4. Whalemate's reading is that the disagreement cannot be brushed aside, because UC San Diego provides controlled evidence on annual training and KnowBe4 provides observational evidence from customers using its own service for frequent simulations. The reasonable decision is not to believe one source blindly, but to distinguish between calendar evidence, embedded intervention evidence, and performance evidence in simulations.

If the studies are null, why does Verizon see improvement in reporting?

The study of 12,511 employees at a fintech company found no statistically significant main effects of training on clicks, with p=0.450, or on reports, with p=0.417, according to arXiv. The same study showed an overall click rate of 10.4%, versus 9.8% in the control group and 10.5% among trained employees, and an overall report rate of 9.6%, versus 8.9% in control and 9.7% among trained employees, according to arXiv.

At the same time, an analysis cited about the Verizon 2025 DBIR says that among users with more recent training, about 21% reported simulated phishing versus a baseline rate of 5%, a relative difference of about four times, while the effect of recent training on click rate was much smaller, with a relative impact of 5% per training, according to DomainTools citing the Verizon 2025 DBIR. Whalemate's reading is that the evidence is more consistent for improved reporting than for reduced clicks. For an October program, that changes the decision: it makes more sense to invest in making reporting easy and visible than to assume the course alone will sharply lower susceptibility.

What happens when the standard requires a minimum frequency but the evidence does not promise sustained effect

The narrative review published in Computers & Security concluded that short-term impact is well documented, but evidence on sustained behavioral change is limited, and it also reported that existing training methods left about 23% of users susceptible to phishing emails, according to Computers & Security. That creates tension with CIS Controls v8, which requires training at onboarding and at least annually, plus annual content review or updates when significant changes occur, according to CIS.

Whalemate's reading is that there is no normative contradiction, but there is an operational warning. Meeting the minimum frequency is necessary for the control, but it does not justify assuming sustained effectiveness. If the organization limits itself to the annual minimum, it may satisfy a baseline control while still falling short on real reduction of human risk.

Phishing and pretexting are the minimum content, not the full content

The Verizon 2025 DBIR analyzed more than 22,000 incidents and 12,195 confirmed breaches, according to Verizon, and found that about 60% of breaches involved a human element, according to Verizon. A summary reproduced by the New York State technology office said that phishing and pretexting are among the leading social actions, and that phishing appeared in 14% of incidents and prompt bombing also in 14%, according to that reproduction of the Verizon 2025 DBIR.

CIS requires training to recognize phishing and pretexting, according to CIS Controls v8, and CISA's toolkit recommends teaching people to avoid phishing and recognize and report suspicious activity, according to CISA. Whalemate's reading is that October is useful for updating content on these tactics, but the point is not to publish generic materials. The point is to adjust messages and simulations to the social engineering patterns that actually create exposure today.

What decision October enables for a CISO, IT, or compliance team in LATAM

The useful decision is not whether to run a campaign in October. The useful decision is to use October as a checkpoint to review whether the program demonstrates continuity, role segmentation, sufficient measurement, and traceable evidence for audit, according to the overlap among ISO/IEC 27001:2022, NIST CSF 2.0, CIS, and NIST.

For a LATAM team, that enables at least six concrete moves. Prioritize roles and groups with higher exposure, based on the logic of NIST CSF 2.0 PR.AT-02 and CIS's role-specific training. Update content around phishing and pretexting, according to CIS, CISA, and Verizon. Increase the frequency of reinforcement when internal evidence shows lag, without confusing simulations with real incidents, according to the disagreement among UC San Diego, arXiv, and KnowBe4. Improve the reporting channel, because the evidence shows more consistent gains in reporting than in clicks, according to NIST and Verizon. Separate activity metrics, such as completion or viewing, from behavior metrics, such as reports, clicks, incident-linked outcomes, and performance by difficulty, according to NIST. And document everything as evidence of a continuous program for audit and compliance, because PCI DSS 12.6 requires a security awareness program, not a standalone course, according to the material provided.

What to read next?

• Awareness on the platform
• ISO, NIST, SANS, Verizon on phishing training
• NIST and CISA on social engineering