By 
For CISOs, IT, and compliance teams in LATAM, "explain social engineering" means treating it as a risk of decisions induced by deception and trust, broader than email phishing, and measuring whether the program drives recognition, reporting, and coverage by role and channel. The practical problem is that annual training and completion rates are still used as proxies for maturity, even though the overlap between NIST, CISA, and empirical studies questions whether that reflects real risk reduction.
Placed side by side, the sources do not say the same thing or measure the same thing. NIST and ISO/IEC 27002 call for a recurring program adapted to the role, CISA pushes observable behaviors across multiple channels, Verizon provides exposure context, and empirical studies question whether annual training alone improves performance. According to Verizon, the human element was present in 62% of breaches, up from 60% the year before.
| Standard | Risk scope | What it asks for or shows | How to measure | Channels covered | Frequency or update | Source |
|---|---|---|---|---|---|---|
| NIST CSRC + NIST SP 800-53/800-50 | NIST CSRC defines social engineering as deceiving someone to reveal information, obtain unauthorized access, or commit fraud by gaining trust. NIST CSRC defines phishing as a technique to obtain sensitive data through a fraudulent request by email or website. | According to NIST SP 800-53 Rev. 5, control AT-2(3) requires training to recognize and report potential and real instances of social engineering and social mining. According to NIST SP 800-53 Rev. 5, control AT-2 requires training for users, including managers, executives, and contractors. According to NIST SP 800-50 Rev. 1, the program should be managed with a lifecycle approach. | According to NIST SP 800-50, metrics are used to determine awareness and training needs, quantify implementation, effectiveness, and efficiency, assess adequacy, and identify improvements. NIST SP 800-50 gives as an example the share of employees with significant responsibilities who received specialized training. The draft of NIST SP 800-50 Rev. 1 proposes longitudinal data, pre and post tests, three month follow up, attendance, performance evaluations, and completion rates. | not specified | According to NIST SP 800-53 Rev. 5, post onboarding frequency is defined by the organization. The same control requires content and techniques to be updated at a frequency defined by the organization and after defined events, incorporating lessons learned. | NIST CSRC, NIST SP 800-53 Rev. 5, NIST SP 800-50, and draft NIST SP 800-50 Rev. 1 |
| ISO/IEC 27001/27002 | The material does not provide a definition of social engineering in ISO/IEC 27001 or ISO/IEC 27002. The available framing is competence, awareness, and information security training. | According to ISO/IEC 27002:2022, control 6.3, staff and relevant interested parties should receive appropriate awareness, education, and training, with periodic updates to policies and procedures relevant to their job function. The same control recommends an appropriate plan for technical teams with specific skills and experience. | not specified | According to ISO/IEC 27002:2022, control 6.3, possible channels include campaigns, brochures, posters, newsletters, websites, briefings, e-learning modules, and emails. | According to ISO/IEC 27002:2022, control 6.3, activities should be scheduled over time, preferably regularly, repeated, and extended to new staff. | ISO/IEC 27001:2022 and ISO/IEC 27002:2022 |
| CISA | CISA defines social engineering as an attempt to trick someone into revealing information or taking an action that compromises systems or networks. CISA defines phishing as a form of social engineering. | According to CISA, organizations should implement user training on social engineering and phishing, teach people to identify suspicious messages and links, not interact with them, and report them, even if the user has already opened a suspicious email, link, or attachment. CISA also recommends DMARC, SPF, DKIM, and prioritizing phishing resistant MFA for administrative and privileged accounts. | According to CISA, reporting suspicious activity is one of the most efficient ways to protect organizations. The guidance also recommends establishing a baseline of normal traffic, tracking MFA attempts or denials, and identifying and remediating successful phishing attempts, without universal numeric targets. | According to CISA, the scope includes email, SMS, Slack, Teams, Signal, WhatsApp chats, and VoIP calls with spoofed caller ID. | According to CISA, users should be educated periodically. For small businesses, CISA recommends annual review of anti phishing material and a retention check. | CISA |
| Verizon DBIR | According to Verizon 2026 DBIR, the human element was present in 62% of observed breaches, and Social Engineering was the third most common breach pattern, with 16% of the breaches in the analyzed set. | Verizon shows that, in phishing simulations, the median success click rate was 40% higher in mobile focused vectors, such as voice and text messages, than by email. | According to Verizon 2024 DBIR, in awareness exercise data contributed by partners during 2023, 20% of users reported the simulated phishing. | According to Verizon, the available comparative data covers email, voice, and text messages. | not specified | Verizon 2026 DBIR and Verizon 2024 DBIR |
| Empirical studies on training effectiveness | The reviewed studies focus on simulated phishing as the practical manifestation of social engineering risk. | According to University of Chicago and IEEE Computer Society, the study at UC San Diego Health found no significant correlation between how recently employees had completed annual training and their ability to avoid simulated phishing traps. The same study reported that people who had just completed it did not perform better than those who had gone more than a year without it. According to University of Chicago, interactive training was associated with a lower likelihood of falling for it than static informational approaches. According to ETH Zurich, there were more clicks and dangerous actions among participants who received contextual training after failing in simulations, and the authors warn that they did not evaluate the effectiveness of mandatory training. | According to University of Chicago and IEEE Computer Society, the UC San Diego Health study measured performance in more than 19,500 employees. According to ETH Zurich, the study recorded 6,680 clicks in 117,864 simulated emails, an aggregate click rate of 5.67% in the studied sample. | not specified | According to University of Chicago and IEEE Computer Society, the comparison included how close annual training was in time and found no significant improvement from having completed it recently. | University of Chicago, IEEE Computer Society, and ETH Zurich |
Is explaining social engineering the same as explaining email phishing?
No. NIST CSRC defines social engineering as deceiving a person to reveal information, allow unauthorized access, or commit fraud through trust and deception. NIST CSRC and CISA place phishing as a technique or form within that universe, not as its synonym. Whalemate's reading is that reducing the problem to email narrows the risk scope and leaves out decisions induced by voice, SMS, and messaging. According to ENISA, phishing accounted for 60% of observed intrusion vectors and remained the dominant intrusion vector.
What changes when CISA treats phishing as a form of social engineering?
CISA says in the same guidance that phishing is a form of social engineering and documents lures by SMS, Slack chats, Teams, Signal, WhatsApp, and VoIP calls with spoofed caller ID. Whalemate's reading is that the program should not be organized by historical channel, but by the expected behavior in the face of lures that seek trust, urgency, or obedience, regardless of whether they arrive by email, voice, or messaging. According to ENISA, approximately 73% of phishing cases were classified as unknown and 27% led to intrusions.
Do the standards ask for a course or a program?
They do not ask for an isolated course. According to ISO/IEC 27002:2022, control 6.3, staff and relevant interested parties should receive appropriate awareness, education, and training, with periodic updates based on their job role. According to NIST SP 800-50 Rev. 1, the approach is lifecycle based and focused on continuous evaluation. Whalemate's reading is that reasonable compliance looks more like a recurring and segmented program than a closed annual training event.
What tension exists between measuring completion and measuring real risk reduction?
NIST SP 800-50 Rev. 1 proposes measuring with longitudinal data, pre and post tests, three month follow up, attendance, performance, and completion rates. But, according to University of Chicago and IEEE Computer Society, at UC San Diego Health there was no significant correlation between having recently completed annual training and avoiding simulated phishing. Whalemate's reading is that completion can serve as administrative data, but not as the main proxy for risk reduction.
Does annual training still work as the central signal?
It serves to show that an activity took place, but not necessarily that behavior changed. According to NIST SP 800-53 Rev. 5, post onboarding frequency is defined by the organization, and the control requires updating content and techniques with lessons learned. According to University of Chicago and IEEE Computer Society, the timing of annual training did not improve performance in simulations. Whalemate's reading is that the useful decision is to move from a fixed cadence to an update model based on role, incident, and exposure.
What behavior do CISA and NIST prioritize when faced with a lure?
CISA recommends teaching people to identify suspicious messages and links, not interact with them, and report them, even if the person has already opened the email, link, or attachment. NIST SP 800-53 Rev. 5, control AT-2(3), requires recognizing and reporting potential and real instances of social engineering. Whalemate's reading is that the key observable behavior is not only avoiding the click, but recognizing, escalating, and enabling early remediation.
