KnowBe4 has expanded its positioning from security awareness training to human risk management, with an HRM+ offering that combines training, simulations, real-time coaching, AI agents, and compliance training. For CISO, IT, and compliance teams in LATAM, the competitive gap is not having courses. It is being able to explain an HRM program that measures human risk and connects it to security decisions.
What changed in KnowBe4's positioning?
KnowBe4 has moved from selling an awareness platform to presenting itself as a comprehensive human risk management platform. Its public portfolio includes Security Awareness Training, Threat Simulation, Real-Time Coaching, and Compliance Training, and in its HRM+ launch the company brought those functions together under the HRM label.
That shift in narrative matters because it changes the comparison point. It is no longer enough to answer whether a platform has courses or simulated phishing. The question is whether it can organize signals, prioritize interventions, and support a human risk management program.
Where does the difference appear with an agentic HRM like Whalemate?
Whalemate presents itself as an agentic Human Risk Management platform for CISO, IT, and compliance teams in Latin America, with a focus on context, behavior, simulations, training, measurement, and intervention. Its risk score combines signals from simulations, courses, reports, and behavior to prioritize actions, not to punish.
The core difference is operational. KnowBe4 offers a broad platform for awareness, simulation, and coaching, along with human risk analytics, while an agentic HRM approach is meant to turn those signals into concrete decisions, with prioritization and traceability for the security team.
What does the compliance discussion require?
PCI DSS 12.6 requires a security awareness program, not a one-off course. In that context, the commercial discussion changes, because the buyer needs to show that there is an ongoing program with training and follow-up, not just a content library.
Whalemate also highlights its ISO/IEC 27001:2022 certification and its public modules for advanced simulations, adaptive training, human risk analytics, and an awareness agent. In a market like LATAM, that framing helps translate HRM into evidence for audit, governance, and operations.
What is the concrete competitive gap?
The gap is that KnowBe4 has already occupied the human risk management language and moved beyond awareness training alone. To compete in that category, it is not enough to offer courses. A vendor has to explain an HRM program that measures risk, prioritizes interventions, and aligns with regulatory frameworks and security decisions.
In practice, the LATAM equivalent needs to show what it means by human risk, how it scores that risk, what signals it uses, how it intervenes, and how it sustains compliance. That is the conversation now shaping the comparison.
By 