By 
September, when National Insider Threat Awareness Month takes place, only leads to a useful decision if the campaign becomes a measurable program for detection, reporting, and response. The overlap between DCSA and CISA, NIST controls, ISO requirements, and the metrics proposed by NIST and ENISA points to the same conclusion: awareness alone is not enough, and completing courses or tracking clicks as the only signal leaves out speed, reporting quality, and real multidisciplinary handling capability.
What emerges when campaign, requirements, metrics, and outcomes are placed together
No single source in the material brings the four layers into one view. When they are compared, a consistent gap appears between what the frameworks require, what organizations usually measure, and what real outcomes continue to show about human and insider exposure.
| Standard | Type | What it asks or measures | Focus | Sufficiency signal | Visible gap | Source |
|---|---|---|---|---|---|---|
| DCSA NITAM | Annual awareness campaign | The official structure includes Promote Awareness, Establish an Insider Threat Program, Train the Workforce, and Support through Reporting | Recognize all forms of insider threat and support reporting | not specified | The campaign itself does not specify effectiveness metrics or detection times | Defense Counterintelligence and Security Agency, DCSA |
| NIST SP 800-53 AT-2(2) | Training and awareness control | Requires providing training to recognize and report potential insider threat indicators | Recognition and reporting of insider threat indicators | not specified | The control requires recognizing and reporting, but does not define operational metrics for report quality or speed | National Institute of Standards and Technology, NIST |
| NIST SP 800-53 IR-4(6) | Incident response control | Requires implementing an incident handling capability for incidents involving insider threats | Insider threat incident response | not specified | Shows that awareness without handling capability leaves the program incomplete | National Institute of Standards and Technology, NIST |
| NIST SP 800-53 PM-12 | Program control | Requires implementing an insider threat program that includes a cross-discipline incident handling team | Multidisciplinary program and centralized integration of technical and nontechnical information | not specified | An annual standalone course does not satisfy the cross-discipline team requirement or centralized integration | National Institute of Standards and Technology, NIST |
| ISO Annex SL 7.2 and 7.3 | Management system requirement | Requires determining competence, ensuring competence through education, training, or experience, evaluating the effectiveness of those actions, and retaining documented evidence; it also requires awareness of the policy, the contribution to the system, and the implications of nonconformity | Competence, awareness, and documented evidence | Evaluate the effectiveness of actions and retain documented information as evidence of competence | It does not go down to specific insider threat or phishing metrics; the organization must define them | International Organization for Standardization, ISO |
| ISO/IEC 27002:2022 6.1.3 according to JTC 1/SC 27 | Control practice | Summarizes the practice as regular, role-specific training, including phishing simulations, participation tracking, and material adjustments based on feedback and incidents | Regular role-based training and adjustment based on results | Participation tracking and material adjustment based on feedback and incidents | Participation appears as a signal, but it does not necessarily measure detection, reporting, or response | ISO/IEC JTC 1/SC 27 |
| NIST study on awareness effectiveness | Practical measurement | Organizations use the number and type of incidents tied to training topics, user-initiated reports, click rates in phishing simulations, views or engagement with materials, and stakeholder surveys; 84% used training completion, 72% used click rate, and 67% used audits or program evaluations | Program effectiveness indicators | No single measure; it combines completion, clicks, reports, incidents, and audits | The most common measure is training completion, even though it does not by itself prove detection or reporting capability | National Institute of Standards and Technology, NIST |
| NIST phishing metrics study | Practical measurement | The 72% of organizations surveyed used phishing simulation click rates, 62% used simulated phishing reports, and 53% used real phishing reports to assess the effectiveness of phishing-related training | Reporting behavior in addition to clicks | Include simulated and real phishing reports, not just click rate | Even in phishing, real reporting is used less than click rate | National Institute of Standards and Technology, NIST |
| ENISA exercise methodology | Operational measurement | Proposes measuring time to detect and reporting accuracy to evaluate detection and reporting of simulated phishing | Reporting speed and quality | Define one or more clear metrics for each success indicator | These time and quality metrics do not appear in many practices centered only on course completion or click tracking | European Union Agency for Cybersecurity, ENISA |
| NITTF best practices compendium | Program measurement | Says many programs regularly request feedback and maintain metrics to evaluate training effectiveness; it mentions reports received soon after training and comments captured through forms | Training-adjacent effectiveness and feedback | Reports received soon after training and feedback captured | Introduces a response window that an isolated annual course does not capture consistently | National Insider Threat Task Force, NITTF |
| Verizon DBIR 2025 and EMEA | Exposure outcome | Human involvement in breaches stayed around 60%; in EMEA, 29% of breaches originated inside organizations, 19% were attributed to unintentional errors, 8% to misuse, and phishing appeared in 19% of regional breaches | Real weight of human and insider factors in breaches | not specified | If human involvement stays around 60% and internal origin in EMEA is 29%, awareness without measured detection and reporting does not seem sufficient | Verizon |
| UK Cyber Security Breaches Survey 2025/2026 | Market practice | 19% of companies had provided some form of training to staff during the last 12 months; 54% in medium-sized companies and 84% in large companies. 38% of companies had experienced phishing during the survey year | Training coverage versus phishing exposure | not specified | Phishing exposure remains high while company training is still a minority at the aggregate level | Government of the United Kingdom |
| CERT/SEI insider sabotage | Real case patterns | In 49 cases, 62% had been planned in advance, 80% of insiders had shown unusual workplace behavior before acting, and 57% had exploited systemic vulnerabilities in applications, processes, or procedures | Pre-incident indicators and systemic failures | not specified | The cases show behavioral signals and process weaknesses before the incident, so awareness without monitoring, reporting processes, and access controls leaves signals unused | Software Engineering Institute, Carnegie Mellon University |
Why do course completion and click tracking remain the dominant signals if they are not enough?
According to NIST's study on awareness effectiveness, 84% of participants used training completion as an effectiveness measure and 72% used click rate in phishing simulations. According to ENISA's exercise methodology, time to detect and reporting accuracy are the right measures for evaluating detection and reporting. Whalemate's reading is that many organizations still measure what is easiest to record, not what is most useful for response decisions.
The problem is not that completion or click rate are useless. The problem is using them as a substitute for operational capability. According to NIST, user-initiated reports, incidents tied to training topics, and audits are also used, but those signals are less standardized than course completion or clicks in a simulation.
What does NITAM actually require, a campaign or a program?
According to DCSA, NITAM is structured around Promote Awareness, Establish an Insider Threat Program, Train the Workforce, and Support through Reporting. According to NIST, PM-12 requires implementing an insider threat program that includes a cross-discipline incident handling team, and IR-4(6) requires an incident handling capability for incidents involving insider threats. Whalemate's reading is that September is not enough as a communication campaign if it does not lead to a governance and operations decision.
CISA also organizes mitigation into four steps, Define, Detect and Identify, Assess, and Manage, according to its Insider Threat Mitigation Guide. That shifts the conversation away from awareness messaging and toward a system with detection, assessment, and response, supported by tracking critical assets and metrics on data and behaviors investigated by the insider threat team, according to CISA.
Does documented awareness equal reduced exposure?
According to ISO Annex SL 7.2 and 7.3, the organization must ensure competence, evaluate the effectiveness of actions, and retain documented evidence, in addition to ensuring awareness of the policy and the implications of nonconformity. According to Verizon's 2025 DBIR, human involvement in breaches stayed around 60%, and in the EMEA slice 29% of breaches originated inside organizations. Whalemate's reading is that meeting the documentation requirement does not by itself prove a material reduction in risk.
The tension is operational, not normative. ISO requires effectiveness to be evaluated, but it does not impose a specific metric. If the organization chooses attendance or course passing as the main evidence, it can be formally compliant while still being blind to reporting quality, detection speed, or role-based exposure.
What is actually measured when the goal is to recognize and report indicators?
According to NIST SP 800-53 AT-2(2), the requirement is to provide training to recognize and report potential insider threat indicators. According to NIST, those indicators can include intense and prolonged job dissatisfaction, attempts to access information not needed for the job, unexplained access to financial resources, bullying or harassment, workplace violence, and other serious policy or rule violations. Whalemate's reading is that measuring phishing alone leaves out much of the problem the control itself is meant to cover.
According to the FBI, possible signs include taking proprietary information without need or authorization, seeking information outside job duties, copying unnecessary material, remotely accessing systems at unusual hours, and ignoring policies on software, hardware, or confidential downloads. That requires combining technical and nontechnical signals, not reducing insider threat to a simulated email campaign.
What fails when the program relies on an isolated annual course?
According to the ISO/IEC JTC 1/SC 27 material on ISO/IEC 27002:2022 6.1.3, the expected practice includes regular, role-specific training, phishing simulations, participation tracking, and material adjustments based on feedback and incidents. According to NITTF, many programs regularly request feedback and measure reports received shortly after training. Whalemate's reading is that the isolated annual course fails because it does not create a continuous cycle of testing, learning, adjustment, and retraining.
PCI DSS 12.6, according to the material provided, requires a security awareness program, not a standalone course. Applied to insider threat, the September campaign only has value if it opens a longer measurement and follow-up phase, with focused interventions based on results.
