ISO, NIST, SANS, Verizon on phishing training

For CISOs, IT, and compliance teams in LATAM, a cybersecurity awareness training program is not validated by the number of courses, but by continuous evidence of knowledge, simulation, and response. ISO calls for a formal program maintained for all staff, NIST and SANS make it measurable through exercises, and Verizon shows that human risk materializes in seconds and no longer comes only by email, but also by voice and mobile.

Taken together, the regulatory frameworks and operational measurements say something that no single source makes as clear on its own. The comparison shows that the question is not whether training is worthwhile, but which specific control can prove effectiveness, prioritize risk, and withstand audit.

When ISO, NIST, SANS, and Verizon are viewed together, the central tension becomes clear. ISO requires a sustained and auditable program, while Verizon shows that the user decision happens within a window of seconds. That shifts the problem from "training" to "measuring behavior under pressure."

Does ISO call for a program or a one-off course?

ISO/IEC 27001:2022 does not describe a one-time action. Control Annex A 6.3 requires that the information security awareness, education and training program be "planned, established, implemented and maintained" and updated regularly. The same logic is reinforced by Clause 7.3 Awareness, which applies to "all persons doing work under the organization's control" and, in practical guidance, to "everyone in scope".

Whalemate's reading is that this turns awareness into a cross-functional ISMS control, not an HR campaign or an annual course done to check a box. If the standard asks for evidence of understanding, contribution, and consequences of nonconformity, the program needs auditable traceability. Without that, there is training, but there is no control.

What does NIST measure when it talks about phishing awareness?

NIST SP 800-50r1 recommends a "phishing exercise to promote awareness of social engineering attacks" and places phishing, spear phishing, vishing, and smishing among the core topics of an enterprise-wide program. The focus is not the lecture, but the practical exercise and whether the user detects the attempt or clicks.

Whalemate's reading is that NIST brings awareness down to observable behavior. That matters because it shifts the model from attendance to performance. For a CISO, the question stops being who completed the course and becomes who recognizes, reports, or falls for a realistic attempt.

Why does SANS not stop at click rate?

SANS proposes two core metrics for phishing simulations, "undesired action rate (click rate)" and "report rate." With that, the program measures not only exposure to deception, but also the user's reporting ability and defensive response.

Whalemate's reading is that this is the difference between training and managing human risk. If you only look at clicks, you know who made a mistake. If you add reports, you know who helps contain the threat. For compliance and IT, that second signal is the one that best translates into evidence of operational maturity.

What changes when the risk happens in seconds?

Verizon showed in 2024 that the "median time to click on a malicious link after the email is opened is 21 seconds" and that the median time to fall for phishing is "less than 60 seconds." In 2026, the company also reported that the "Human element was present in 62% of breaches" and that "Social Engineering" accounted for 16% of breaches, with a growing focus on "mobile-centric social engineering."

Whalemate's reading is that the program cannot rely on broad awareness or a single annual campaign. If the decision window is seconds, measurement has to include reaction time, not just click rate. And if the vector moves to text and voice, the control has to be multichannel.

Is email still the main focus, or has the channel changed?

Verizon's official DBIR 2026 note says success in voice and text attacks is "40% higher than traditional email phishing." Supplemental analysis from voice and text phishing simulations show median click rates of 2% and 1.4% for email agrees that voice and text phishing simulations show median click rates of 2% versus 1.4% for email.

Whalemate's reading is that a program focused only on email is out of step with the real risk vector. That does not invalidate the traditional channel, but it does require segmentation by channel, because a single measurement can understate the problem. For LATAM, where messaging and voice are heavily used, that difference matters for prioritization.

What decision does this comparison enable for a CISO in LATAM?

It enables a move from an annual course to continuous human-risk control. A sustained program is required, behavior to be measured and effectively benchmarking phishing awareness programs call for behavior to be measured, and harm can come through voice, text, and in less than a minute shows that harm can come through voice, text, and in less than a minute. The practical response is to segment by channel, measure click rate, report rate, and reaction time, and prioritize interventions by relative risk.

For a compliance team, that also changes the evidence. A training certificate is no longer enough. It takes traceability of simulations, results, remediation, and periodic updates, because that is what best fits an auditable, continuous program.

What to read next?

• Awareness on the platform