--- title: "Human risk and cybersecurity blog | Whalemate" description: "Articles, analysis and resources on human risk management, awareness and cybersecurity for LATAM teams. The Whalemate blog." url: https://www.whalemate.com/en/resources/blog/ lang: en alternates: es: https://www.whalemate.com/recursos/blog/ pt-BR: https://www.whalemate.com/br/recursos/blog/ index: https://www.whalemate.com/llms.txt --- Blog # Human risk and cybersecurity blog Guides and analysis for CISOs, IT and compliance teams in LATAM who need to explain the human factor — and decide what to do about it. [All](https://www.whalemate.com/en/resources/blog/) [Awareness](https://www.whalemate.com/en/resources/blog/topic/awareness/) [HRM](https://www.whalemate.com/en/resources/blog/topic/hrm/) ![Awareness campaigns: what they require](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/awareness-campaigns-what-they-require.webp) Awareness Oct 30, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [Awareness campaigns: what they require](https://www.whalemate.com/en/resources/blog/awareness-campaigns-what-they-require/) ISO, PCI DSS, CIS, NIST, ENISA, and California do not ask for the same thing. The comparison shows what to measure Read more ![LATAM Awareness Platforms: What to Evaluate](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/latam-awareness-platforms-what-evaluate.webp) Awareness Oct 29, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [LATAM Awareness Platforms: What to Evaluate](https://www.whalemate.com/en/resources/blog/latam-awareness-platforms-what-evaluate/) For CISOs, IT, and compliance teams, an awareness platform should measure, segment, and audit behavior, not just deliver courses. Read more ![PCI, CISA and NIST on phishing](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/pci-cisa-nist-phishing.webp) Awareness Oct 28, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [PCI, CISA and NIST on phishing](https://www.whalemate.com/en/resources/blog/pci-cisa-nist-phishing/) PCI DSS, NIST, CISA and CTIR show phishing and vishing are not managed the same way. Metrics, controls and compliance decisions change. Read more ![Phishing vs spear phishing: what CISOs need](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/phishing-vs-spear-phishing-what.webp) Awareness Oct 27, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [Phishing vs spear phishing: what CISOs need](https://www.whalemate.com/en/resources/blog/phishing-vs-spear-phishing-what/) The distinction changes metrics and controls. Clicks alone and a yearly course are not enough to judge risk or training effectiveness. Read more ![BEC examples and what to measure in LATAM](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/bec-examples-what-measure-latam.webp) Awareness Oct 23, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [BEC examples and what to measure in LATAM](https://www.whalemate.com/en/resources/blog/bec-examples-what-measure-latam/) BEC examples help test controls. The decision changes depending on whether the fraud seeks funds, credentials, or information, and clicks are not enough. Read more ![PCI DSS: Phishing vs. Spam in LATAM](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/pci-dss-phishing-vs-spam.webp) Awareness Oct 22, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [PCI DSS: Phishing vs. Spam in LATAM](https://www.whalemate.com/en/resources/blog/pci-dss-phishing-vs-spam/) Phishing and spam require different controls, metrics, and compliance evidence. What to measure to reduce real risk. Read more ![CISA, NIST and CIS on phishing training](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/cisa-nist-cis-phishing-training.webp) Awareness Oct 16, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [CISA, NIST and CIS on phishing training](https://www.whalemate.com/en/resources/blog/cisa-nist-cis-phishing-training/) The frameworks agree on training, but differ on frequency and scope. Measuring clicks alone leaves reporting out. Read more ![Cybersecurity Awareness Month and Human Risk](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/cybersecurity-awareness-month-human-risk.webp) Awareness Oct 15, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [Cybersecurity Awareness Month and Human Risk](https://www.whalemate.com/en/resources/blog/cybersecurity-awareness-month-human-risk/) October can kick off communication, but ISO, NIST, and CIS call for a continuous, measurable, role-based program. Read more ![NIST, CIS, and PCI on measurable social engineering](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/nist-cis-pci-measurable-social.webp) Awareness Oct 14, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [NIST, CIS, and PCI on measurable social engineering](https://www.whalemate.com/en/resources/blog/nist-cis-pci-measurable-social/) NIST, CIS, and PCI call for ongoing or periodic awareness, but evidence alone does not prove fewer clicks. Measure behavior by role. Read more ![NIST, PCI and Brazil on social engineering](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/nist-pci-brazil-social-engineering.webp) Awareness Oct 13, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [NIST, PCI and Brazil on social engineering](https://www.whalemate.com/en/resources/blog/nist-pci-brazil-social-engineering/) For CISO, IT and compliance teams, social engineering must be measured with clicks, reports Read more ![NIST and CIS on measuring social engineering](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/nist-cis-measuring-social-engineering.webp) Awareness Oct 12, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [NIST and CIS on measuring social engineering](https://www.whalemate.com/en/resources/blog/nist-cis-measuring-social-engineering/) NIST, CIS, ISO, PCI, and CISA show that social engineering is measured by recognition, reporting, and response, not just training completion. Read more ![NIST and CISA on social engineering](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/nist-cisa-social-engineering.webp) Awareness Oct 8, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [NIST and CISA on social engineering](https://www.whalemate.com/en/resources/blog/nist-cisa-social-engineering/) For CISOs, IT, and compliance teams, the issue is measuring recognition, reporting, and coverage by role and channel, not just annual training. Read more ![Fortinet awareness metrics go beyond completion](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/fortinet-awareness-metrics-go-beyond.webp) HRM Oct 7, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [Fortinet awareness metrics go beyond completion](https://www.whalemate.com/en/resources/blog/fortinet-awareness-metrics-go-beyond/) NIST, Fortinet, and the 2025 survey show a gap: behavior and event-based remediation can be measured, but many companies still track activity. Read more ![ISO 27001:2022 requires continuous awareness](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/iso-27001-2022-requires-continuous.webp) Compliance Oct 6, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [ISO 27001:2022 requires continuous awareness](https://www.whalemate.com/en/resources/blog/iso-27001-2022-requires-continuous/) Clause 7.3 and control 6.3 call for a formal, role-based program. The evidence challenges annual training and points to behavior metrics. Read more ![LATAM human risk management company metrics](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/latam-human-risk-management-company.webp) HRM Oct 5, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [LATAM human risk management company metrics](https://www.whalemate.com/en/resources/blog/latam-human-risk-management-company/) For CISOs, IT, and compliance teams in LATAM, HRM means tracking continuous behavior, turning it into risk, and keeping evidence for ISO 27001 and PCI DSS. Read more ![ISO 27001 and human risk management platforms](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/iso-27001-human-risk-management.webp) HRM Oct 2, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [ISO 27001 and human risk management platforms](https://www.whalemate.com/en/resources/blog/iso-27001-human-risk-management/) ISO 27001 requires continuous, effective programs. HRM turns them into behavior metrics, risk prioritization, and evidence for leadership. Read more ![Smishing and vishing under PCI DSS 12.6](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/smishing-vishing-under-pci-dss.webp) HRM Sep 30, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [Smishing and vishing under PCI DSS 12.6](https://www.whalemate.com/en/resources/blog/smishing-vishing-under-pci-dss/) SMS and voice are not the same for CISOs and compliance. PCI DSS 12.6 requires formal awareness and separate measurement of both channels. Read more ![Human Risk Management: What It Measures](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/human-risk-management-what-measures.webp) HRM Sep 23, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [Human Risk Management: What It Measures](https://www.whalemate.com/en/resources/blog/human-risk-management-what-measures/) HRM combines continuous awareness standards with behavior metrics to prioritize interventions, reallocate resources, and report human risk. Read more ![PCI DSS 12.6: Vishing and Smishing Scope](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/pci-dss-12-6-vishing.webp) HRM Sep 18, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [PCI DSS 12.6: Vishing and Smishing Scope](https://www.whalemate.com/en/resources/blog/pci-dss-12-6-vishing/) Vishing and smishing are no longer just phishing variants. Under PCI DSS 12.6, they require a formal program, channel metrics, and steady improvement. Read more ![PCI DSS 12.6 Requires Vishing Coverage](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/pci-dss-12-6-requires.webp) HRM Sep 16, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [PCI DSS 12.6 Requires Vishing Coverage](https://www.whalemate.com/en/resources/blog/pci-dss-12-6-requires/) Vishing and smishing are voice and SMS phishing. Under PCI DSS 12.6, measuring only email or course completion leaves a compliance gap. Read more ![APWG and PCI DSS: Smishing Is Rising](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/apwg-pci-dss-smishing-rising.webp) HRM Sep 11, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [APWG and PCI DSS: Smishing Is Rising](https://www.whalemate.com/en/resources/blog/apwg-pci-dss-smishing-rising/) Smishing is growing on mobile channels while PCI DSS v4.0 requires annual awareness training and explicit phishing and social engineering content. Read more ![Security awareness training: measure clicks, not courses](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/security-awareness-training-measure-clicks.webp) HRM Sep 7, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [Security awareness training: measure clicks, not courses](https://www.whalemate.com/en/resources/blog/security-awareness-training-measure-clicks/) NIST, UC San Diego, Frontiers, Verizon and SANS agree that annual training alone is not enough. The useful metric is sustained behavior. Read more ![ISO, NIST, SANS, Verizon on phishing training](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/iso-nist-sans-verizon-phishing.webp) Awareness Sep 7, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [ISO, NIST, SANS, Verizon on phishing training](https://www.whalemate.com/en/resources/blog/iso-nist-sans-verizon-phishing/) ISO calls for a continuous program for all employees, NIST and SANS make it measurable, and Verizon shows the risk happens in seconds. Read more ![Whalemate: Human Risk Management platform](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/whalemate-hrm-security-awareness.webp) HRM Sep 3, 2026 [By Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) ## [Whalemate: Human Risk Management platform](https://www.whalemate.com/en/resources/blog/whalemate-hrm-security-awareness/) Whalemate frames security awareness as Human Risk Management, not a standalone course. CIS, NIST, SANS, and recent studies show mixed results. Read more