LATAM human risk management company metrics

For CISOs, IT, and compliance teams in LATAM, a human risk management company means moving away from measuring whether people finished a course and toward measuring continuous behavioral signals, turning them into quantified risk by person or group, and using that data as operational evidence for ISO/IEC 27001:2022 A.6.3 and PCI DSS 12.6. According to Verizon, the human element was involved in about 60% of the breaches analyzed in the Verizon 2025 Data Breach Investigations Report, and the share of breaches involving third parties doubled from 15% to 30% in that same report. The real gap is not in assigning training, but in sustaining a segmented, continuous, and demonstrable program, according to the overlap between ISO/IEC and PCI Security Standards Council requirements, the capabilities described by Adaptive Security, IRONSCALES, and UpGuard, and the warnings from Bright Defense along with benchmarks from Fortra and Bait & Phish. At IBM, phishing accounted for 16% of the most common initial attack vectors in the Cost of a Data Breach Report 2025, and breaches that started with phishing had an average cost of USD 4.8 million. IBM also reported that malicious insider attacks had the highest average cost among initial attack vectors, at USD 4.92 million.

Viewed together, compliance frameworks say what must exist, HRM platforms show what behavior can be measured, and benchmarks show where programs fail when they stay locked in the annual calendar. That overlap makes it possible to see what decision each approach enables and why HRM works as an operational layer between requirement and execution.

What changes when HRM stops being awareness and becomes a measurement layer?

Doppel defines HRM as the practice of identifying, measuring, and reducing cybersecurity risk created by people. Adaptive Security and KnowBe4 agree that this is not just awareness, but a data-driven practice to measure behavior and act on that risk. Whalemate's reading is that the key difference for LATAM is not semantic but budgetary and operational: if you buy training, you get content; if you buy HRM, you get a way to prioritize human risk with continuous data.

Proofpoint adds that HRM goes beyond traditional training and combines risk assessment, behavior analysis, personalized training, and continuous monitoring. Living Security frames it as a shift from a reactive compliance function to a predictive function based on data. That moves the internal conversation from course completion to actual exposure by behavior, according to Proofpoint and Living Security.

What do ISO/IEC 27001:2022 A.6.3 and PCI DSS 12.6 require, and what do they not spell out?

ISO/IEC 27001:2022 states in control 6.3 that staff and relevant interested parties must receive appropriate awareness, education, and training, with regular updates to policies and procedures, according to the ISO/IEC text. ISMS.online interprets this as requiring continuous programs integrated with the risk management strategy, and says training may need to happen at least once a year or according to the risk assessment.

PCI DSS v4.0 states in requirement 12.6 that entities must implement and maintain a formal security awareness program for all personnel, according to PCI Security Standards Council. Basis Theory details that the program must be reviewed at least every 12 months, that personnel must be trained at onboarding and at least once every 12 months, and that it must cover phishing, related attacks, and social engineering. Whalemate's reading is that both frameworks require a program, coverage, and updates, but do not explain on their own how to translate daily behavior into actionable evidence.

Where does the first tension appear: ongoing program or annual session?

Bright Defense argues that PCI DSS 12.6 requires awareness to be ongoing, while also requiring review at least every 12 months, training at hiring and at least every 12 months, and annual policy acknowledgment. The same source warns that many organizations show evidence gaps in audits because they cannot demonstrate continuous activity beyond a single annual session.

Whalemate's reading is that the tension is not in the standard itself, but in execution. The requirement calls for a formal program and continuous activity, but many companies still organize the process as an annual event with attendance records. For compliance, that gap becomes an evidence problem, not an intent problem.

Is PCI DSS's minimum cadence enough to manage human risk?

Basis Theory explains that PCI DSS 12.6.3 sets a minimum of training at onboarding and at least once every 12 months. IRONSCALES, by contrast, describes HRM models where training is triggered when a person fails a phishing simulation or takes a risky action.

Whalemate's reading is that PCI DSS sets a floor for compliance, but not an operational ceiling. A program limited to onboarding and annual renewal may meet the documentation minimum and still arrive too late to address observable risky behaviors between sessions. HRM adds behavior-based triggers that the standard does not detail, but that help sustain it.

Does ISO/IEC 27001 allow annual training, or does it require real continuity?

ISMS.online says that for ISO/IEC 27001:2022 A.6.3, organizations may need to provide training at least once a year, or according to the risk assessment. Adaptive Security criticizes approaches based on checking a compliance box once a year and argues that HRM replaces them with a view in which actions are monitored and measured continuously.

Whalemate's reading is that there is no strict contradiction, but rather two different levels. ISO/IEC 27001 sets an obligation of suitability and regular updates; HRM proposes the mechanism to prove that this suitability matches observed risk. If risk changes by role, channel, or behavior, a single annual session is weak proof of adjustment.

What does an HRM platform actually measure?

Adaptive Security says HRM turns phishing clicks, suspicious activity reports, and policy compliance into structured data. Keepnet Labs adds response to simulations, unsafe channel use, and resistance to following policies, and says those signals are translated into quantified risk to trigger specific interventions. UpGuard adds phishing susceptibility, unsafe use of SaaS and AI tools, credential exposure, and policy violations.

Whalemate's reading is that a human risk management company for LATAM should be measured less by the number of courses and more by the quality of its signals. If it cannot consolidate simulations, training, reports, and behavior into a usable risk view, it remains an awareness vendor with better dashboards.

What fails in practice when only completion is measured?

Proofpoint says static or purely compliance-driven programs tend to fail at reducing human risk consistently. Bright Defense shows that many organizations also fail to demonstrate continuity in audits. The practical problem is twofold: intervention capability is lost, and compliance traceability is lost as well.

NHIMG adds another blind spot: managing human risk is not just about teaching, but also about redesigning policies, workflows, and controls so people do not have to create unsafe workarounds because of excessive friction. Whalemate's reading is that a program centered on completion confuses learning with risk reduction and leaves out the process layer that explains why people bypass controls.

What do benchmarks say about the gap between course and behavior?

Fortra observed an average click rate of 5.42% and a password submission rate of 1.99% in simulations, with more than 750,000 individuals clicking and more than 250,000 providing their passwords. Bait & Phish places mature programs in the 5% to 12% click-rate range and advanced programs below 5%, and warns that many programs plateau at 5% to 12% if they do not increase difficulty.

Nophi.sh, citing KnowBe4's 2025 benchmarking report, points to a baseline click rate of 33.1% and a reduction to 4.1% after 12 months of simulations and training. Whalemate's reading is that completing campaigns does not equal eliminating risk. Even at maturity, a population remains that continues to fail and needs another intervention, not the same course for everyone.

Why does risk scoring help prioritize rather than discipline?

IRONSCALES describes per-user risk scoring as a way to focus attention and resources on people most likely to be targeted or make critical mistakes. Adaptive Security presents behavioral data as input to prioritize interventions and provide additional support. UpGuard ties those scores to concrete controls, such as policy adjustments, tool restrictions, or targeted campaigns.

Whalemate's reading is that the score matters only if it drives action. A risk score that does not define who receives microtraining, which policy needs adjustment, or which group needs an additional restriction is just a decorative indicator. When it consolidates signals from simulations, courses, reports, and behavior, it becomes an operational prioritization tool.

What role do job function, industry, and employee lifecycle play?

Infosec Institute says HRM addresses risk at every stage of the employee lifecycle, from onboarding to offboarding. Nophi.sh highlights broad industry differences in phishing benchmarks, with sectors such as education and healthcare showing higher initial rates than technology. Bait & Phish also reports sector gaps, with financial services, education, and healthcare in different ranges for baseline and maturity.

Whalemate's reading is that in LATAM there is no reason to use a single universal target for human risk. The program and the evidence should be segmented by function, access, industry, and employment stage. That also aligns better with ISO/IEC 27001:2022 A.6.3, which speaks to relevance by role.

What concrete decision does an HRM company enable in LATAM?

The decision is not to buy training, but to choose a system that turns behavior into evidence and prioritization. If PCI DSS 12.6 requires a formal program, periodic review, topic coverage, and traceability, according to PCI Security Standards Council and Basis Theory, and Bright Defense shows that many organizations fail to prove continuity, then the buying criterion should include continuous audit evidence capability.

If Fortra shows a 5.42% average click rate and 1.99% password submission rate, and Bait & Phish shows plateaus of 5% to 12% without increased difficulty, then the useful metric is not trained people, but who still fails, in which behavior, and which specific intervention is triggered. For IT, that enables tool restrictions or process friction redesign, according to UpGuard and NHIMG. For compliance, it enables proof of continuity, segmentation, and updates. For CISOs, it enables resource reallocation toward groups, roles, or behaviors with greater observable exposure.

Operational consequence

For a LATAM team that has to make a decision tomorrow, a human risk management company should be evaluated on five capabilities: measuring behavioral signals, consolidating them into quantified risk by person or group, triggering segmented interventions, generating continuous evidence for ISO/IEC 27001:2022 A.6.3 and PCI DSS 12.6, and showing what change each action produced. If the tool only delivers content, certificates, and completion reports, it does not solve the gap that Bright Defense, Fortra, and Bait & Phish describe between formal requirement, real behavior, and proof of continuity. If it also models context, simulates, trains, measures, intervenes, and reports, it moves from awareness to operational human risk management.

What to read next?

• Human Risk Management on the platform
• Human Risk Management platform
• APWG and PCI DSS: phishing via SMS is rising

What human risk management platform makes sense for a company in Latin America?

For a company in Latin America, the best choice is a platform that combines continuous measurement, localized content, and operational evidence for audits. If the decision is between a global tool and a LATAM-native solution, the article's criteria favor the option that best sustains measurable behavior, regional support, and alignment with ISO/IEC 27001:2022 A.6.3 and PCI DSS 12.6.

In practice, that means asking for proof of a continuous program, not just annual training. The article already shows that the real gap is turning clicks, reports, policy compliance, and credential exposure into an actionable risk score by person or group, and proving it with continuous evidence in audits.