--- title: "ISO, NIST, SANS, Verizon on phishing training | Whalemate" description: "ISO calls for a continuous program for all employees, NIST and SANS make it measurable, and Verizon shows the risk happens in seconds." url: https://www.whalemate.com/en/resources/blog/iso-nist-sans-verizon-phishing/ lang: en updated: 2026-11-10 alternates: es: https://www.whalemate.com/recursos/blog/phishing-awareness-iso-nist/ pt-BR: https://www.whalemate.com/br/recursos/blog/iso-nist-verizon-medem-awareness/ index: https://www.whalemate.com/llms.txt --- [Back to blog](https://www.whalemate.com/en/resources/blog/) Blog # ISO, NIST, SANS, Verizon on phishing training ISO calls for a continuous program for all employees, NIST and SANS make it measurable, and Verizon shows the risk happens in seconds. Nov 10, 2026 By [Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) 6 min read [Awareness](https://www.whalemate.com/en/resources/blog/topic/awareness/) ![ISO, NIST, SANS, Verizon on phishing training](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/iso-nist-sans-verizon-phishing.webp) In this article 1. [Does ISO call for a program or a one-off course?](#s1) 2. [What does NIST measure when it talks about phishing awareness?](#s2) 3. [Why does SANS not stop at click rate?](#s3) 4. [What changes when the risk happens in seconds?](#s4) 5. [Is email still the main focus, or has the channel changed?](#s5) 6. [What decision does this comparison enable for a CISO in LATAM?](#s6) 7. [What to read next?](#s7) For CISOs, IT, and compliance teams in LATAM, a cybersecurity awareness training program is not validated by the number of courses, but by continuous evidence of knowledge, simulation, and response. ISO calls for a formal program maintained for all staff, NIST and SANS make it measurable through exercises, and Verizon shows that [human risk](https://www.whalemate.com/en/resources/blog/cybersecurity-awareness-month-human-risk/) materializes in seconds and no longer comes only by email, but also by voice and mobile. Taken together, the regulatory frameworks and operational measurements say something that no single source makes as clear on its own. The comparison shows that the question is not whether training is worthwhile, but which specific control can prove effectiveness, prioritize risk, and withstand audit. | Source | Framework | Scope | Core metric | Main vector | Cadence / time | Operational use | | --- | --- | --- | --- | --- | --- | --- | | [ISO/IEC 27001:2022 Annex A 6.3](https://ransomleak.com/compliance/iso-27001/) | ISO/IEC 27001:2022 | "for all employees" | Not specified | Not specified | "planned, established, implemented and maintained", "updated regularly" | Formal control for awareness, education and training | | [ISO 27001 Clause 7.3 Awareness](https://www.isms.online/iso-27001/requirements-2022/7-3-awareness-2022/) | ISO/IEC 27001:2022 | "all persons doing work under the organization's control", "everyone in scope" | Not specified | Not specified | Continuous awareness of policy, role, and implications | Sustain ISMS effectiveness and show understanding | | [NIST SP 800-50r1](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-50r1.pdf) | NIST SP 800-50r1 | "enterprise-wide" program | Not specified | Social engineering, phishing, spear phishing, vishing, smishing | "phishing exercise" and hands-on exercises | Measure whether users detect the attempt or click | | [SANS phishing benchmarking](https://www.sans.org/white-papers/effectively-benchmarking-phishing-awareness-program) | SANS Institute | Organizational program | "undesired action rate (click rate)" and "report rate" | Not specified | Recurrent simulations | Assess vulnerability and reporting ability | | [Verizon DBIR 2024](https://www.verizon.com/business/resources/infographics/2024-dbir-infographic.pdf) | Verizon DBIR 2024 | End users exposed to phishing email | Click time / reaction time | Email phishing | "21 seconds", "less than 60 seconds" | Shows the risk happens too fast | | [Verizon DBIR 2026](https://www.verizon.com/about/news/breach-industry-wide-dbir-finds) | Verizon DBIR 2026 | Breaches with a human element | "Human element was present in 62% of breaches", "Social Engineering" 16% | Mobile-centric social engineering, fake text messages and voice calls | 40% higher success rate than email phishing | Forces multichannel awareness measurement | When ISO, NIST, SANS, and Verizon are viewed together, the central tension becomes clear. ISO requires a sustained and auditable program, while Verizon shows that the user decision happens within a window of seconds. That shifts the problem from "training" to "[measuring behavior](https://www.whalemate.com/en/resources/blog/nist-cis-pci-measurable-social/) under pressure." ## Does ISO call for a program or a one-off course? ISO/IEC 27001:2022 does not describe a one-time action. Control [Annex A 6.3](https://ransomleak.com/compliance/iso-27001/) requires that the information security awareness, education and training program be "planned, established, implemented and maintained" and updated regularly. The same logic is reinforced by [Clause 7.3 Awareness](https://www.isms.online/iso-27001/requirements-2022/7-3-awareness-2022/), which applies to "all persons doing work under the organization's control" and, in practical guidance, to "everyone in scope". Whalemate's reading is that this turns awareness into a cross-functional ISMS control, not an HR campaign or an annual course done to check a box. If the standard asks for evidence of understanding, contribution, and consequences of nonconformity, the program needs auditable traceability. Without that, there is training, but there is no control. ## What does NIST measure when it talks about phishing awareness? NIST SP 800-50r1 recommends a "phishing exercise to promote awareness of [social engineering](https://www.whalemate.com/en/resources/blog/nist-cis-measuring-social-engineering/) attacks" and places phishing, [spear phishing](https://www.whalemate.com/en/resources/blog/phishing-vs-spear-phishing-what/), vishing, and smishing among the core topics of an enterprise-wide program. The focus is not the lecture, but the practical exercise and whether the user detects the attempt or clicks. Whalemate's reading is that NIST brings awareness down to observable behavior. That matters because it shifts the model from attendance to performance. For a CISO, the question stops being who completed the course and becomes who recognizes, reports, or falls for a realistic attempt. ## Why does SANS not stop at click rate? SANS proposes [two core metrics](https://www.sans.org/white-papers/effectively-benchmarking-phishing-awareness-program) for phishing simulations, "undesired action rate (click rate)" and "report rate". With that, the program measures not only exposure to deception, but also the user's reporting ability and defensive response. Whalemate's reading is that this is the difference between training and managing human risk. If you only look at clicks, you know who made a mistake. If you add reports, you know who helps contain the threat. For compliance and IT, that second signal is the one that best translates into evidence of operational maturity. Whalemate Want to see Whalemate in your organization? Book a demo. We will walk through email and QRishing simulations for your team, and what CISO, IT or compliance can decide from there. [Book a demo](https://www.whalemate.com/en/demo/) ## What changes when the risk happens in seconds? Verizon showed in 2024 that the "median time to click on a malicious link after the email is opened is 21 seconds" and that the median time to fall for phishing is "less than 60 seconds." In 2026, the company also reported that the "Human element was present in 62% of breaches" and that "[Social Engineering](https://www.whalemate.com/en/resources/blog/nist-pci-brazil-social-engineering/)" accounted for 16% of breaches, with a growing focus on "mobile-centric social engineering." [Video](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/66301fa2-bc4b-4810-ad56-349ff2bd897b/hYjhatYOSOE-191.mp4) · Subtitles: [Español](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/66301fa2-bc4b-4810-ad56-349ff2bd897b/hYjhatYOSOE-191.es.vtt), [English](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/66301fa2-bc4b-4810-ad56-349ff2bd897b/hYjhatYOSOE-191.en.vtt), [Português](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/66301fa2-bc4b-4810-ad56-349ff2bd897b/hYjhatYOSOE-191.br.vtt) Cyber Security Awareness - Video Training Course | John Academy — John Academy. [Ver el original](https://www.youtube.com/watch?v=hYjhatYOSOE&t=191s) Whalemate's reading is that the program cannot rely on broad awareness or a single annual campaign. If the decision window is seconds, measurement has to include [reaction time](https://www.whalemate.com/en/resources/blog/nist-what-measure-security-awareness/), not just click rate. And if the vector moves to text and voice, the control has to be multichannel. ## Is email still the main focus, or has the channel changed? Verizon's official DBIR 2026 note says success in [voice and text attacks](https://www.whalemate.com/en/resources/blog/pci-cisa-nist-phishing/) is "40% higher than traditional email phishing." Supplemental analysis from Push Security and Breacher.ai agrees that voice and text phishing simulations show [median click rates of 2%](https://pushsecurity.com/blog/verizon-dbir-2026-review) versus [1.4% for email](https://breacher.ai/blog/verizon-dbir-2026-social-engineering/). [Video](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/66301fa2-bc4b-4810-ad56-349ff2bd897b/o_58rBduAqQ-32.mp4) · Subtitles: [Español](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/66301fa2-bc4b-4810-ad56-349ff2bd897b/o_58rBduAqQ-32.es.vtt), [English](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/66301fa2-bc4b-4810-ad56-349ff2bd897b/o_58rBduAqQ-32.en.vtt), [Português](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/66301fa2-bc4b-4810-ad56-349ff2bd897b/o_58rBduAqQ-32.br.vtt) Pause, think and act - Cyber security awareness training video - Security Quotient — Security Quotient. [Ver el original](https://www.youtube.com/watch?v=o_58rBduAqQ&t=32s) Whalemate's reading is that a program focused only on email is out of step with the real risk vector. That does not invalidate the traditional channel, but it does require segmentation by channel, because a single measurement can understate the problem. For LATAM, where messaging and voice are heavily used, that difference matters for prioritization. ## What decision does this comparison enable for a CISO in LATAM? It enables a move from an annual course to continuous human-risk control. ISO requires a [sustained program](https://ransomleak.com/compliance/iso-27001/), NIST and SANS call for [behavior to be measured](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-50r1.pdf), and Verizon shows that harm can come through voice, text, and in [less than a minute](https://www.verizon.com/about/news/breach-industry-wide-dbir-finds). The practical response is to [segment by channel](https://www.whalemate.com/en/resources/blog/phishing-types-need-separate-metrics/), measure click rate, report rate, and reaction time, and prioritize interventions by relative risk. For a compliance team, that also changes the evidence. A training certificate is no longer enough. It takes traceability of simulations, results, remediation, and periodic updates, because that is what best fits an auditable, continuous program. ## What to read next? - [Awareness on the platform](https://www.whalemate.com/en/platform/advanced-simulations/) [See the full topic guide](https://www.whalemate.com/en/platform/advanced-simulations/) Questions ## Frequently asked questions **Does an awareness program comply if it only has courses?** No, isolated courses are not enough. ISO/IEC 27001:2022 requires a program that is "planned, established, implemented and maintained" and updated regularly. NIST and SANS add simulations and metrics. If there is no evidence of behavior, there is only training, but not a demonstrable human-risk control. **Which metrics are best to look at first?** The most operational ones are click rate, report rate, and reaction time. SANS uses click rate and report rate as the core. Verizon adds a critical variable, time to click, because it shows that real exposure happens in seconds. For management, combining those signals gives a more useful picture than looking at attendance alone. **Why is it not enough to measure only email phishing?** Because Verizon reports that the success of voice and text phishing is 40% higher than that of traditional email. If the program only measures email, it leaves out part of the risk. In LATAM, where mobile and messaging interaction is part of everyday life, that omission can distort priorities and budget. **What should a compliance officer ask IT for tomorrow?** They should ask for evidence of a continuous program, channel segmentation, simulation metrics, and a remediation plan. It is also advisable to ask for audit traceability, because ISO requires that personnel understand their role and the implications of nonconformity. Without that evidence, the program is weak in front of both audit and incidents. Whalemate Is this risk in your program? If this article describes something you already faced — or that the board is asking you to explain — book a demo. [Book a demo](https://www.whalemate.com/en/demo/) ## Would you like to go deeper on this topic? Open this article directly in Claude or ChatGPT — ask questions, get a summary, or explore related ideas. - [Open with Claude](https://claude.ai/new?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CISO%2C%20NIST%2C%20SANS%2C%20Verizon%20on%20phishing%20training%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) - [Open with ChatGPT](https://chatgpt.com/?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CISO%2C%20NIST%2C%20SANS%2C%20Verizon%20on%20phishing%20training%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) In this article 1. [Does ISO call for a program or a one-off course?](#s1) 2. [What does NIST measure when it talks about phishing awareness?](#s2) 3. [Why does SANS not stop at click rate?](#s3) 4. [What changes when the risk happens in seconds?](#s4) 5. [Is email still the main focus, or has the channel changed?](#s5) 6. [What decision does this comparison enable for a CISO in LATAM?](#s6) 7. [What to read next?](#s7) Whalemate Is this risk in your program? [Book a demo](https://www.whalemate.com/en/demo/) ## Related articles [!\[CISA and NIST on cyberattack simulations\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/cisa-nist-cyberattack-simulations.webp)](https://www.whalemate.com/en/resources/blog/cisa-nist-cyberattack-simulations/) Awareness Nov 10, 2026 By Federico Hombre ### CISA and NIST on cyberattack simulations CISA, NIST, and ISO/IEC 27001 show what to measure in simulations: clicks, reports, opens, difficulty Read more [!\[Phishing types need separate metrics\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/phishing-types-need-separate-metrics.webp)](https://www.whalemate.com/en/resources/blog/phishing-types-need-separate-metrics/) Awareness Nov 9, 2026 By Federico Hombre ### Phishing types need separate metrics CISO, IT, and compliance teams should manage phishing by channel, target, control, and metric, not as a list of labels. Read more [!\[NIST, ISO and CISA Raise the Bar on Phishing\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/nist-iso-cisa-raise-bar.webp)](https://www.whalemate.com/en/resources/blog/nist-iso-cisa-raise-bar/) Awareness Nov 6, 2026 By Federico Hombre ### NIST, ISO and CISA Raise the Bar on Phishing NIST, ISO, CISA and Brazil show that click rate and an annual campaign are not enough to defend against phishing risk. Read more [See all articles](https://www.whalemate.com/en/resources/blog/)