NIST and CIS on measuring social engineering

Social engineering has a more demanding operational definition for CISOs, IT teams, and compliance than "doing awareness." Across NIST, CIS, ISO, PCI DSS, and CISA, the risk must be measured as the ability to recognize, report, and respond, with training coverage and freshness also tracked. The gap appears when that standard is compared with practice: according to Verizon, the human element remained present in approximately 60% of breaches analyzed in 2025, and according to the UK Statistics Authority many incidents are not even reported. According to Verizon, in 2026 the human factor was present in 62% of the breaches analyzed, up from 60% the year before.

What changes when the definition becomes governance

NIST defines social engineering as an attempt to trick a person into revealing information or taking an action that could compromise a system, according to the NIST glossary and NIST SP 800-53. That definition already shifts the conversation from the course to observable behavior: reveal, act, report, or fail to report. Whalemate's reading is that if the risk sits in behavior, the program cannot be measured only by attendance or completion.

ISO/IEC 27001 takes a holistic approach that includes people, policy, and technology, according to ISO. PCI DSS 12.6 requires an ongoing awareness program, not a one-time course, according to Bright Defense. CISA, together with NSA, FBI, and MS-ISAC, also adds technical monitoring of email and messaging, according to its joint guidance. The full map forces people, process, and technical controls onto the same dashboard. According to Verizon, the 2026 Verizon Data Breach Investigations Report analyzed more than 31,000 real security incidents occurring at companies in 145 countries, including at least 22,000 confirmed data breach cases.

What you see when NIST, CIS, ISO, PCI, and CISA are compared

Placed side by side, the sources do not say exactly the same thing, but they do point to the same practical requirement. NIST goes deeper on recognition and reporting, CIS adds coverage and freshness metrics, ISO expands the scope to employees and contractors, PCI formalizes periodic review, and CISA adds a technical layer that is not covered in the same detail by the others.

If CIS already measures coverage and freshness, why does the human factor still show up in breaches?

CIS Controls v8 measures initial training as the percentage of workforce members who received initial training, using M4/M3, and current training as the percentage of compliant members, using M6/M3, according to CIS documentation. Verizon, in its 2025 Data Breach Investigations Report, said the human element's share of breaches stayed at roughly 60% within its analyzed sample. Whalemate's reading is that coverage and freshness are necessary, but they are not enough if they are not tied to real behavior when lures and escalation are involved. According to Verizon, in 2026 social engineering was the third most common breach pattern and accounted for 16% of all breaches analyzed.

The problem is not that CIS metrics are weak. The problem is that they are baseline program metrics, not enough evidence of performance under pressure. A dashboard that celebrates 100% current training can still be blind to who recognizes impersonation, who reports it, and how fast.

What happens when NIST requires reporting, but many incidents are not reported in practice?

NIST AT-2(3) requires training to recognize and report potential and actual instances of social engineering, and it also requires explaining how to communicate concerns through organizational channels based on established policies and procedures, according to NIST SP 800-53 Rev. 5. The UK Statistics Authority reported that, in the year ending September 2024, only one in seven fraud offenses and one in fifteen computer misuse offenses were reported to Action Fraud or the police. Whalemate's reading is direct: having a channel does not mean the channel is used effectively.

For CISOs and compliance teams, that tension shows up in evidence. If the program proves that a reporting mailbox or button exists, but does not show volume, timing, and escalation quality, the organization may be documented and still underreporting. The risk is not only educational, it is also about early detection.

Is it enough to teach people how to spot suspicious messages?

CISA, NSA, FBI, and MS-ISAC recommend regularly educating users to identify suspicious emails and links, not interact with them, and report suspicious opens, links, attachments, or lures, according to their joint guidance. A study published in Data: Journal of Information Systems and Management reported bimodal click patterns: 20% of participants clicked within the first 5 seconds and 30% after 15 seconds. The same study also reported a median time of about 30 minutes to report a phishing simulation.

Whalemate's reading is that recognition without operational speed arrives too late. Some of the damage happens in seconds, while reporting can take dozens of minutes. That is why the useful metric is not only who spotted it, but when they spotted it and when they escalated. According to Verizon, in phishing simulations in the Verizon DBIR 2026, the median successful click rate in mobile-device-centered vectors, such as voice calls and text messages, was 40% higher than by email.

What does the difference between training delivered and phishing suffered show?

The Cyber Security Breaches Survey 2025 found that only 19% of companies had provided some type of training to staff in the previous 12 months, according to the UK Department for Science, Innovation and Technology. The same survey reported that phishing affected 37% of the companies surveyed. Whalemate's reading is that there is a clear coverage gap, but also a warning: increasing coverage is a minimum condition, not a guarantee of performance.

The data matters for LATAM because many organizations are still debating whether to formalize the program. That debate looks outdated next to frameworks such as CIS, PCI, or CISA, which already treat training and periodic review as expected parts of control. According to Verizon, in 2026 vulnerability exploitation accounted for 47% of initial access vectors in breaches, phishing for 28%, and credential abuse for 6%.

What does NIST require beyond classic phishing?

NIST AT-2(3) is not limited to phishing. According to NIST, it includes phishing, pretexting, impersonation, baiting, quid pro quo, thread-jacking, social media exploitation, and tailgating. It also calls for training staff to identify suspicious emails, including unexpected messages with strange or poor grammar, or from unknown senders posing as known sponsors or contractors.

Whalemate's reading is that a program measured only on email campaigns leaves gaps. If the framework requires recognizing multiple forms of social engineering, the dashboard should reflect that scope too, at least for phishing, BEC, pretexting, and tailgating, which CIS explicitly lists in 14.2.

Where does ISO fit when it does not set a specific frequency?

ISO/IEC 27001 and the ISO/IEC JTC 1/SC 27 awareness guidance require employees and, where relevant, contractors to receive appropriate awareness, education, and training plus regular updates according to their role. The consulted guidance on ISO/IEC 27001:2022 Annex A 6.3 says it does not require a specific training format or frequency. Whalemate's reading is that ISO does not solve day-to-day operations, but it does broaden governance scope.

That has two practical effects. First, it requires including relevant third parties and contractors, not just internal employees. Second, it leaves room to design a risk-based scheme, as long as the organization can show consistency, role relevance, and regular updates.

What does PCI DSS add compared with broader frameworks?

PCI DSS v4.0.1 Requirement 12.6 requires awareness to be an ongoing activity and the formal program to be reviewed at least once every 12 months, according to Bright Defense. The same material says Requirement 12.6.3.1 requires awareness of phishing, related attacks, and social engineering. According to CyberAware, that obligation became effective on March 31, 2025.

Whalemate's reading is that PCI grounds a requirement that appears more open in other frameworks. If an organization processes cardholder data, the question is no longer whether awareness matters, but how to prove continuity, periodic review, and enough topical coverage.

Why does CISA include DMARC and monitoring in a discussion about behavior?

The joint CISA, NSA, FBI, and MS-ISAC guidance recommends enabling DMARC for received email and internally monitoring email and messaging traffic to detect suspicious activity. Whalemate's reading is that the source itself breaks the false split between awareness and technical defense. The choice is not between trained users and email controls.

For IT, this changes program design. If human reporting is not cross-checked against email and messaging telemetry, context is lost for prioritizing response. If monitoring exists but nobody reports, early signal is also lost for campaigns that have not yet triggered other controls.

What metrics appear when behavior is measured, not just attendance?

The PhishingSimulation.eu guide distinguishes click rate, report rate, and reporting speed. HailBytes / GoPhish Training Templates defines Click Rate as "Number of clicks ÷ Number of emails delivered × 100" and Report Rate as "Number of reports ÷ Number of emails delivered × 100". The same guide proposes an operational benchmark of a median report time within 4 hours during the first year and within 30 minutes for a mature program of three years or more, although it notes those are goals from that guide and not a universal regulatory requirement.

Whalemate's reading is that these metrics complete what the frameworks ask for but do not always spell out. If NIST requires recognizing, reporting, and knowing how to respond, then click rate alone is insufficient. Report rate and reporting speed get much closer to real detection and escalation capability.

What do current campaigns show about the kind of training needed?

Proofpoint reported that pure social engineering appeared in 25% of the APT campaigns analyzed in The Human Factor 2025, Vol. 1. According to Proofpoint, more than 90% of those campaigns appeared to be interested in collaboration and engagement. In The Human Factor 2025, Vol. 2, Proofpoint said URLs were used four times more than attachments in analyzed malicious emails, and that at least 55% of analyzed smishing messages contained malicious URLs.

Whalemate's reading is that training should not remain anchored to the old poorly written email with a suspicious attachment as the main case. If campaigns present themselves as legitimate collaboration and favor URLs, expected recognition must include context, apparent intent, urgency, and interaction pattern, not just obvious indicators.

What do third parties and AI mean for the program?

Verizon said in its 2025 DBIR Executive Summary that third-party involvement in breaches doubled from 15% to 30%. IBM said in its Cost of a Data Breach Report 2025 that phishing was the most common initial attack vector, present in 16% of the breaches analyzed, and that 16% of breaches involved attackers using AI. Within those AI cases, according to IBM, the most frequent forms were AI-generated phishing at 37% and impersonation attacks using deepfakes at 35%.

Whalemate's reading is that the program's scope cannot stay limited to the internal employee or traditional email. Relevant third parties, alternative channels, and more convincing impersonation scenarios raise the need to measure who receives training, who reports, and how an ambiguous signal is investigated.

What decision does this enable tomorrow for a LATAM team?

The operational decision is to move away from a program centered on course completion and toward one with combined evidence from people, process, and technology. According to CIS, there are already metrics for initial and current training. According to NIST, the requirement includes recognizing, reporting, and knowing how to respond. According to CISA, DMARC and internal email and messaging monitoring should also be added.

For a CISO, IT team, or compliance function in LATAM, the minimum dashboard should include percentage with initial training, percentage with current training, coverage across employees and contractors, recognition of phishing, BEC, pretexting, and tailgating, existence and use of reporting channels, report rate, reporting speed, and evidence of email response or monitoring. If that is not measured, the organization may look compliant because it gave annual courses, yet still be blind to early detection and escalation.

What to read next

• Awareness on the platform
• NIST and CISA: explain social engineering
• NIST and SANS on phishing awareness