--- title: "LATAM Awareness Platforms: What to Evaluate | Whalemate" description: "For CISOs, IT, and compliance teams, an awareness platform should measure, segment, and audit behavior, not just deliver courses." url: https://www.whalemate.com/en/resources/blog/latam-awareness-platforms-what-evaluate/ lang: en updated: 2026-10-29 alternates: es: https://www.whalemate.com/recursos/blog/latam-evaluar-plataformas-awareness/ pt-BR: https://www.whalemate.com/br/recursos/blog/latam-avaliar-plataformas-awareness/ index: https://www.whalemate.com/llms.txt --- [Back to blog](https://www.whalemate.com/en/resources/blog/) Blog # LATAM Awareness Platforms: What to Evaluate For CISOs, IT, and compliance teams, an awareness platform should measure, segment, and audit behavior, not just deliver courses. Oct 29, 2026 By [Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) 11 min read [Awareness](https://www.whalemate.com/en/resources/blog/topic/awareness/) ![LATAM Awareness Platforms: What to Evaluate](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/latam-awareness-platforms-what-evaluate.webp) In this article 1. [What the regulatory requirements show together](#s1) 2. [Is the platform bought to deliver courses or to measure behavior?](#s2) 3. [Does annual training reduce phishing?](#s3) 4. [Which matters more, the click or the report?](#s4) 5. [Can a click rate be compared without context?](#s5) 6. [Do studies show sustained improvement or null results?](#s6) 7. [What should you do with optimistic vendor benchmarks?](#s7) 8. [Does performance improve when intervention is immediate and segmented?](#s8) 9. [What does compliance want besides content?](#s9) 10. [Why does Brazil make this more operational in LATAM?](#s10) 11. [What minimum metrics should a platform be able to produce?](#s11) 12. [What goes wrong in practice when the platform is bought badly?](#s12) 13. [Operational takeaway for CISOs, IT, and compliance in LATAM](#s13) 14. [What to read next?](#s14) For CISOs, IT, and compliance teams in LATAM, a security awareness training platform should be evaluated as a system for measurement, segmentation, and evidence, not as a course catalog. The material's frameworks consistently call for ongoing, updated training, and several add exercises, effectiveness testing, and verifiable records. The tension comes when that regulatory demand meets empirical evidence: training alone does not show a consistent reduction in phishing, so the useful decision is who to intervene on, with what intensity, and how to prove whether the program works. ## What the regulatory requirements show together Placed side by side, the sources do not simply describe a duty to "train." They describe a system that combines frequency, exercises, measurement, and evidence, with different levels of detail depending on the framework. | Standard | What it requires | Frequency | Exercises | What to measure | Evidence | Source | | --- | --- | --- | --- | --- | --- | --- | | NIST SP 800-53 Rev. 5 AT-2 | Security and privacy literacy training for system users, including managers, senior executives, and contractors; update content and incorporate lessons learned from internal or external incidents or breaches | Initial training for new users and then at the frequency defined by the organization; also when system changes or organization-defined events require it | Includes AT-2(1) "Practical Exercises" and AT-2(3) "Social Engineering and Mining" | not specified | not specified | according to NIST SP 800-53 Rev. 5 | | PCI DSS v4.0 Req. 12.6 | A formal awareness program so all personnel understand the information security policy and procedures and their role in protecting account data; training must include phishing and related attacks and social engineering | Security awareness education is an ongoing activity | not specified | not specified | not specified | according to PCI DSS v4.0 | | ISO/IEC 27001:2022 Annex A 6.3 + clause 7.2 | Personnel and relevant interested parties must receive appropriate awareness, education, and training and regular updates; the needed competence must also be determined, competence ensured, measures taken to acquire it, and the effectiveness of those measures evaluated | Regular updates | not specified | Evaluate the effectiveness of the measures taken to acquire competence | Retain documented information as evidence of competence | according to ISO/IEC 27001:2022 and the interpretation cited by Sentrix | | CISA phishing guidance + CISA FISMA metrics | Implement user training on social engineering and phishing; regularly educate users to identify suspicious emails and links, avoid interacting with them, and report them; combine awareness and training, simulated attacks, and results analysis to adjust training and reduce risk | Employees should review anti-phishing training material annually; monitoring and analysis of quantitative and qualitative metrics is also required | Phishing vulnerability assessment using simulated emails to defined groups; includes evidence of exercises aimed at senior executives, privileged users, or cybersecurity staff | Percentage of users who completed annual training; percentage of new users who completed training before access; number of users who participated in exercises, number who passed, and number who identified and reported phishing | Data supporting the metrics must be collected accurately, consistently, and reproducibly | according to CISA | | ENISA | Programs should include capability building, periodic assessments of trends and challenges, measurement of cybersecurity behavior, and campaign planning; it recommends identifying objectives, segmenting employees into target groups, selecting channels, implementing, and evaluating | Regular phishing simulations and periodic assessments | Recommends a baseline assessment and regular phishing simulations to identify staff who need additional training | Measurement of cybersecurity behavior; baseline assessment to determine where risks are | not specified | according to ENISA | | Central Bank of Brazil CMN Resolution 4,893/2021 | Mechanisms to spread a cybersecurity culture, including implementing training programs and periodic employee assessments; the policy must reflect senior management's commitment to continuous improvement of cybersecurity-related procedures | Periodic employee assessment | not specified | Periodic employee assessment | not specified | according to CMN Resolution 4,893/2021 of the Central Bank of Brazil | ## Is the platform bought to deliver courses or to measure behavior? Whalemate's reading is that the material's frameworks look more like a management system than a content library. According to NIST SP 800-53 Rev. 5, control [AT-2 requires](https://csrc.nist.gov/files/pubs/sp/800/53/r5/upd1/final/docs/sp800-53r5-control-catalog.xlsx) initial training, follow-on training at a frequency defined by the organization, content updates, and incorporation of lessons learned from incidents. According to PCI DSS v4.0, Requirement 12.6 says awareness education is an ongoing activity, not a one-off course. That changes the buying criterion. If the problem were only distributing content, a basic LMS would be enough. But according to ENISA, the program should start with a baseline, segment employees into target groups, run regular simulations, and measure behavior, so the useful platform is the one that turns observed behavior into intervention decisions. ## Does annual training reduce phishing? CISA places anti-phishing training at the minimum floor. According to CISA guidance, employees should review training material annually, and the organization should combine awareness, simulated attacks, and results analysis to adjust training and reduce risk. The empirical evidence in the material complicates any linear promise. According to the large-scale study published on arXiv, the control group had a [click rate](https://www.whalemate.com/en/resources/blog/security-awareness-training-measure-clicks/) of 9.8% versus 10.5% among trained participants, with no statistically significant difference, p=0.450. The same study also found no statistically significant difference in reporting, with p=0.417 and effect sizes below 0.01. Whalemate's reading is that annual training may be necessary for compliance and for establishing a baseline, but it is not enough as proof of behavioral effectiveness. ## Which matters more, the click or the report? Organizational practice still focuses heavily on the click. According to a NIST study, 72% of surveyed organizations used phishing simulation click rates to measure effectiveness and 62% used simulated phishing reports. According to another NIST study, training completion was used by 84% of surveyed organizations and click rate by 72%. The material's recommendations are broader. According to the NCSC, organizations should not measure only how many people clicked but also how many reported. According to CISA, one of the behaviors that should be taught is [reporting suspicious emails, links, and attachments](https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf). Whalemate's reading is that a platform that only captures clicks leaves out a central signal of operational resilience, because early reporting speeds response and containment. ## Can a click rate be compared without context? According to NIST, no. The NIST Phish Scale exists precisely to give context to click rates based on the human difficulty of detecting the lure. NIST says a rate should not be compared without considering that difficulty. The same point appears in the empirical evidence. According to the arXiv study, the click rate rose from 7.0% for easy lures to 15.0% for difficult lures. Whalemate's reading is straightforward: a platform that shows a raw rate without classifying campaigns, lures, and populations can lead to wrong decisions because it mixes attack difficulty with user performance. ## Do studies show sustained improvement or null results? They show both, and that tension matters. According to the longitudinal study from Ruhr University Bochum, click rates fell from 19% to 10% as training progressed, with 429,418 emails sent and 59,689 clicks, equivalent to 13.90%, and in a second phase 27,501 links clicked, equivalent to 10.55%. The same study reported that 61 of 77 clients improved their click rate after using simulated emails. But according to the scoping review in Computers & Security, which identified 42 studies, short-term impact is documented and the evidence for sustained behavioral change is limited. According to arXiv, a recent large-scale study also found no significant main effects on either clicks or reports. Whalemate's reading is that organizations should not buy the promise of guaranteed reduction, but rather the ability to measure locally whether the intervention works in their own population and campaigns. ## What should you do with optimistic vendor benchmarks? Treat them as commercial references, not independent verdicts. According to KnowBe4, its analysis covered 67.7 million phishing simulations, 14.5 million users, and 62.4 thousand organizations. The vendor reported a global average simulated phishing rate of 33.1% before training, a 40% reduction after three months, and a cumulative 86% reduction after 12 months. In another report, KnowBe4 reported a drop from 34.3% to 4.6% for its training category. The material itself requires those figures to be tested against other evidence. According to SC Magazine UK, in a study of 10 campaigns over eight months involving more than 19,500 employees at a U.S. healthcare organization, click rates did not improve over time and traditional in-person or static training had little measurable effect. Whalemate's reading is that benchmarks help size scenarios, but the purchase decision should rest on methodological traceability, segmentation, and verifiable results inside the organization itself. Whalemate Want to see Whalemate in your organization? Book a demo. We will walk through email and QRishing simulations for your team, and what CISO, IT or compliance can decide from there. [Book a demo](https://www.whalemate.com/en/demo/) ## Does performance improve when intervention is immediate and segmented? The material's evidence suggests it does, more than generic training. According to SC Magazine UK, embedded training shown immediately after a person clicked reduced future failures by 1.7% in the cited healthcare study. According to the Computers & Security review, factors associated with better outcomes include training intensity, active approaches, detailed feedback, and the combination of skill-based training with attention-based approaches. ENISA points in the same operational direction. According to ENISA, organizations should do a baseline assessment and regular simulations to identify staff who need additional training. Whalemate's reading is that the platform should enable contextual and adaptive reinforcement by risk group, not just broad campaigns that are the same for everyone in the organization. ## What does compliance want besides content? It wants proof. According to ISO/IEC 27001:2022, clause 7.2 requires determining the necessary competence, ensuring people are competent, taking action to acquire that competence, evaluating the effectiveness of those actions, and retaining [documented information as evidence of competence](https://www.whalemate.com/en/resources/blog/iso-27001-2022-requires-continuous/). According to Annex A 6.3 of ISO/IEC 27001:2022, personnel and relevant interested parties must also receive regular updates. CISA reinforces the standard for evidence quality. According to CISA's FISMA guidance, the data supporting the metrics must be collected [accurately, consistently, and reproducibly](https://www.cisa.gov/sites/default/files/2024-05/FY%202024%20IG%20FISMA%20Metrics%20Evaluation%20Guide%20Final.pdf). Whalemate's reading is that a platform without verifiable records by user, campaign, result, and competence evidence leaves an audit gap, even if the content is good. ## Why does Brazil make this more operational in LATAM? Because training and periodic assessment already appear in concrete regulation. According to Central Bank of Brazil CMN Resolution 4,893/2021, entities must implement mechanisms to spread a cybersecurity culture, including training programs and periodic employee assessments. The same resolution requires the policy to reflect senior management's commitment to continuous improvement in cybersecurity-related procedures. In addition, according to Decree 11,856/2023, Brazil's National Cybersecurity Policy seeks to encourage protection and risk management measures to prevent, mitigate, and neutralize vulnerabilities, incidents, and attacks, and includes among its objectives the development of education and technical professional training in cybersecurity. Whalemate's reading is that, in regulated LATAM environments, the platform has to support both human-risk management and audit and oversight. ## What minimum metrics should a platform be able to produce? The material allows for a clear baseline. According to NIST, measurable indicators of effectiveness include incidents related to training topics, user-initiated reports, click rates in simulations, viewing or engagement with materials, and feedback through surveys and interviews. According to CISA, the percentage of users who completed annual training, the percentage of new users who completed it before access, and the number of users who participated, passed, identified, and reported phishing also matter. Whalemate's reading is that this minimum set requires looking at several layers at once. There are coverage metrics, such as completion. There are behavioral metrics, such as [clicks and reports](https://www.whalemate.com/en/resources/blog/nist-pci-brazil-social-engineering/). There are operational metrics, such as related incidents. And there are program-quality metrics, such as feedback and data reproducibility. ## What goes wrong in practice when the platform is bought badly? The next decision fails. If an organization buys a platform as a course library, it will likely end up measuring attendance and a raw click rate, which NIST says are commonly used metrics but not sufficient on their own. If it also fails to record lure difficulty, results by campaign, risk groups, and documentary evidence, it may believe performance improved when only the type of lure or the exposed population changed. Compliance also fails. According to ISO/IEC 27001:2022, documented evidence of competence must be retained, and according to CISA, the data must be accurate, consistent, and reproducible. Whalemate's reading is that the common mistake is not just training too little, but measuring badly and therefore intervening badly. ## Operational takeaway for CISOs, IT, and compliance in LATAM The useful decision that a security awareness training platform should enable is not buying courses, but operating a behavior-prioritization system with verifiable evidence. For tomorrow, that means requiring the platform to establish a baseline, segment by risk, run controlled simulations, record clicks and reports, contextualize campaigns by lure difficulty, show results by group, and retain evidence of competence and program effectiveness, according to NIST, CISA, ENISA, PCI DSS v4.0, ISO/IEC 27001:2022, and Central Bank of Brazil CMN Resolution 4,893/2021. If it does not do that, it can leave the compliance team exposed and also lead to wrong decisions about whom to intervene on and with what intensity. ## What to read next? - [Awareness on the platform](https://www.whalemate.com/en/platform/advanced-simulations/) - [NIST and CISA on social engineering](https://www.whalemate.com/en/resources/blog/nist-cisa-social-engineering/) - [PCI DSS: Phishing vs. Spam in LATAM](https://www.whalemate.com/en/resources/blog/pci-dss-phishing-vs-spam/) [See the full topic guide](https://www.whalemate.com/en/platform/advanced-simulations/) Questions ## Frequently asked questions **What should a CISO evaluate first in an awareness platform?** First, whether it measures behavior and not just attendance. According to ENISA, the program should start from a baseline, segment target groups, and include regular simulations. According to CISA and NIST, it should also combine quantitative and qualitative metrics. If the platform does not record clicks, reports, results by campaign, and reproducible evidence, it evaluates content, not human risk. **Is the course completion rate useful as the main indicator?** It is useful as a coverage indicator, but not as a sufficient measure of effectiveness. According to NIST, training completion was used by 84% of the surveyed organizations, but NIST recommends combining it with incidents, user reports, clicks in simulations, engagement with content, and qualitative feedback. Measuring only completion leaves unanswered whether behavior changed. **Why does phishing reporting matter as much as the click?** Because reporting is a defensive behavior that improves early response. According to the NCSC, organizations should not measure only how many people clicked, but also how many reported. According to CISA, training should teach people to identify and report suspicious emails, links, and attachments. A platform that does not capture reports measures exposure, but not detection and escalation capability. **What evidence does compliance need for an audit?** According to ISO/IEC 27001:2022, clause 7.2, documented information must be retained as evidence of competence and the effectiveness of the measures taken must be evaluated. According to CISA, the data supporting the metrics must be accurate, consistent, and reproducible. In practice, that requires verifiable records by user, campaign, result, date, and corrective action or reinforcement applied. Whalemate Is this risk in your program? If this article describes something you already faced — or that the board is asking you to explain — book a demo. [Book a demo](https://www.whalemate.com/en/demo/) ## Would you like to go deeper on this topic? Open this article directly in Claude or ChatGPT — ask questions, get a summary, or explore related ideas. - [Open with Claude](https://claude.ai/new?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CLATAM%20Awareness%20Platforms%3A%20What%20to%20Evaluate%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) - [Open with ChatGPT](https://chatgpt.com/?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CLATAM%20Awareness%20Platforms%3A%20What%20to%20Evaluate%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) In this article 1. [What the regulatory requirements show together](#s1) 2. [Is the platform bought to deliver courses or to measure behavior?](#s2) 3. [Does annual training reduce phishing?](#s3) 4. [Which matters more, the click or the report?](#s4) 5. [Can a click rate be compared without context?](#s5) 6. [Do studies show sustained improvement or null results?](#s6) 7. [What should you do with optimistic vendor benchmarks?](#s7) 8. [Does performance improve when intervention is immediate and segmented?](#s8) 9. [What does compliance want besides content?](#s9) 10. [Why does Brazil make this more operational in LATAM?](#s10) 11. [What minimum metrics should a platform be able to produce?](#s11) 12. [What goes wrong in practice when the platform is bought badly?](#s12) 13. [Operational takeaway for CISOs, IT, and compliance in LATAM](#s13) 14. [What to read next?](#s14) Whalemate Is this risk in your program? [Book a demo](https://www.whalemate.com/en/demo/) ## Related articles [!\[Awareness campaigns: what they require\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/awareness-campaigns-what-they-require.webp)](https://www.whalemate.com/en/resources/blog/awareness-campaigns-what-they-require/) Awareness Oct 30, 2026 By Federico Hombre ### Awareness campaigns: what they require ISO, PCI DSS, CIS, NIST, ENISA, and California do not ask for the same thing. The comparison shows what to measure Read more [!\[PCI, CISA and NIST on phishing\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/pci-cisa-nist-phishing.webp)](https://www.whalemate.com/en/resources/blog/pci-cisa-nist-phishing/) Awareness Oct 28, 2026 By Federico Hombre ### PCI, CISA and NIST on phishing PCI DSS, NIST, CISA and CTIR show phishing and vishing are not managed the same way. Metrics, controls and compliance decisions change. Read more [!\[Phishing vs spear phishing: what CISOs need\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/phishing-vs-spear-phishing-what.webp)](https://www.whalemate.com/en/resources/blog/phishing-vs-spear-phishing-what/) Awareness Oct 27, 2026 By Federico Hombre ### Phishing vs spear phishing: what CISOs need The distinction changes metrics and controls. Clicks alone and a yearly course are not enough to judge risk or training effectiveness. Read more [See all articles](https://www.whalemate.com/en/resources/blog/)