---
title: "NITAM needs a measurable insider threat program | Whalemate"
description: "NITAM is useful only if September becomes a measurable program for reporting, detection, and response, not isolated training."
url: https://www.whalemate.com/en/resources/blog/nitam-needs-measurable-insider-threat/
lang: en
updated: 2026-11-12
alternates:
  es: https://www.whalemate.com/recursos/blog/nitam-exige-pasar-awareness-programa/
  pt-BR: https://www.whalemate.com/br/recursos/blog/nitam-pede-programa-mensuravel-insider/
index: https://www.whalemate.com/llms.txt
---

[Back to blog](https://www.whalemate.com/en/resources/blog/)

Blog

# NITAM needs a measurable insider threat program

NITAM is useful only if September becomes a measurable program for reporting, detection, and response, not isolated training.

Nov 12, 2026
By [Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/)
13 min read

[Awareness](https://www.whalemate.com/en/resources/blog/topic/awareness/)

![NITAM needs a measurable insider threat program](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/nitam-needs-measurable-insider-threat.webp)

In this article

1. [What emerges when campaign, requirements, metrics, and outcomes are placed together](#s1)
2. [Why do course completion and click tracking remain the dominant signals if they are not enough?](#s2)
3. [What does NITAM actually require, a campaign or a program?](#s3)
4. [Does documented awareness equal reduced exposure?](#s4)
5. [What is actually measured when the goal is to recognize and report indicators?](#s5)
6. [What fails when the program relies on an isolated annual course?](#s6)
7. [Which metrics help make decisions tomorrow?](#s7)
8. [What do real cases show about missed early signals?](#s8)
9. [Why does the reporting channel matter as much as training?](#s9)
10. [Where does the integration between security, HR, legal, and compliance fit?](#s10)
11. [What weight does human and insider exposure have today?](#s11)
12. [What concrete decision does September enable for LATAM?](#s12)
13. [What to read next?](#s13)

September, when [National Insider Threat Awareness Month](https://www.cisa.gov/news-events/alerts/2020/08/31/national-insider-threat-awareness-month) takes place, only leads to a useful decision if the campaign becomes a measurable program for detection, reporting, and response. The overlap between DCSA and CISA, NIST controls, ISO requirements, and the metrics proposed by NIST and ENISA points to the same conclusion: awareness alone is not enough, and completing courses or tracking clicks as the only signal leaves out speed, reporting quality, and real multidisciplinary handling capability.

## What emerges when campaign, requirements, metrics, and outcomes are placed together

No single source in the material brings the four layers into one view. When they are compared, a consistent gap appears between what the frameworks require, what organizations usually measure, and what real outcomes continue to show about human and insider exposure.

| Standard | Type | What it asks or measures | Focus | Sufficiency signal | Visible gap | Source |
| --- | --- | --- | --- | --- | --- | --- |
| DCSA NITAM | Annual awareness campaign | The official structure includes Promote Awareness, Establish an Insider Threat Program, Train the Workforce, and Support through Reporting | Recognize all forms of insider threat and support reporting | not specified | The campaign itself does not specify effectiveness metrics or detection times | Defense Counterintelligence and Security Agency, DCSA |
| NIST SP 800-53 AT-2(2) | Training and awareness control | Requires providing training to recognize and report potential insider threat indicators | Recognition and reporting of insider threat indicators | not specified | The control requires recognizing and reporting, but does not define operational metrics for report quality or speed | National Institute of Standards and Technology, NIST |
| NIST SP 800-53 IR-4(6) | Incident response control | Requires implementing an incident handling capability for incidents involving insider threats | Insider threat incident response | not specified | Shows that awareness without handling capability leaves the program incomplete | National Institute of Standards and Technology, NIST |
| NIST SP 800-53 PM-12 | Program control | Requires implementing an insider threat program that includes a cross-discipline incident handling team | Multidisciplinary program and centralized integration of technical and nontechnical information | not specified | An annual standalone course does not satisfy the cross-discipline team requirement or centralized integration | National Institute of Standards and Technology, NIST |
| ISO Annex SL 7.2 and 7.3 | Management system requirement | Requires determining competence, ensuring competence through education, training, or experience, evaluating the effectiveness of those actions, and retaining documented evidence; it also requires awareness of the policy, the contribution to the system, and the implications of nonconformity | Competence, awareness, and documented evidence | Evaluate the effectiveness of actions and retain documented information as evidence of competence | It does not go down to specific insider threat or phishing metrics; the organization must define them | International Organization for Standardization, ISO |
| ISO/IEC 27002:2022 6.1.3 according to JTC 1/SC 27 | Control practice | Summarizes the practice as regular, role-specific training, including phishing simulations, participation tracking, and material adjustments based on feedback and incidents | Regular role-based training and adjustment based on results | Participation tracking and material adjustment based on feedback and incidents | Participation appears as a signal, but it does not necessarily measure detection, reporting, or response | ISO/IEC JTC 1/SC 27 |
| NIST study on awareness effectiveness | Practical measurement | Organizations use the number and type of incidents tied to training topics, user-initiated reports, click rates in phishing simulations, views or engagement with materials, and stakeholder surveys; 84% used training completion, 72% used click rate, and 67% used audits or program evaluations | Program effectiveness indicators | No single measure; it combines completion, clicks, reports, incidents, and audits | The most common measure is training completion, even though it does not by itself prove detection or reporting capability | National Institute of Standards and Technology, NIST |
| NIST phishing metrics study | Practical measurement | The 72% of organizations surveyed used phishing simulation click rates, 62% used simulated phishing reports, and 53% used real phishing reports to assess the effectiveness of phishing-related training | Reporting behavior in addition to clicks | Include simulated and real phishing reports, not just click rate | Even in phishing, real reporting is used less than click rate | National Institute of Standards and Technology, NIST |
| ENISA exercise methodology | Operational measurement | Proposes measuring time to detect and reporting accuracy to evaluate detection and reporting of simulated phishing | Reporting speed and quality | Define one or more clear metrics for each success indicator | These time and quality metrics do not appear in many practices centered only on course completion or click tracking | European Union Agency for Cybersecurity, ENISA |
| NITTF best practices compendium | Program measurement | Says many programs regularly request feedback and maintain metrics to evaluate training effectiveness; it mentions reports received soon after training and comments captured through forms | Training-adjacent effectiveness and feedback | Reports received soon after training and feedback captured | Introduces a response window that an isolated annual course does not capture consistently | National Insider Threat Task Force, NITTF |
| Verizon DBIR 2025 and EMEA | Exposure outcome | Human involvement in breaches stayed around 60%; in EMEA, 29% of breaches originated inside organizations, 19% were attributed to unintentional errors, 8% to misuse, and phishing appeared in 19% of regional breaches | Real weight of human and insider factors in breaches | not specified | If human involvement stays around 60% and internal origin in EMEA is 29%, awareness without measured detection and reporting does not seem sufficient | Verizon |
| UK Cyber Security Breaches Survey 2025/2026 | Market practice | 19% of companies had provided some form of training to staff during the last 12 months; 54% in medium-sized companies and 84% in large companies. 38% of companies had experienced phishing during the survey year | Training coverage versus phishing exposure | not specified | Phishing exposure remains high while company training is still a minority at the aggregate level | Government of the United Kingdom |
| CERT/SEI insider sabotage | Real case patterns | In 49 cases, 62% had been planned in advance, 80% of insiders had shown unusual workplace behavior before acting, and 57% had exploited systemic vulnerabilities in applications, processes, or procedures | Pre-incident indicators and systemic failures | not specified | The cases show behavioral signals and process weaknesses before the incident, so awareness without monitoring, reporting processes, and access controls leaves signals unused | Software Engineering Institute, Carnegie Mellon University |

## Why do course completion and click tracking remain the dominant signals if they are not enough?

According to NIST's study on awareness effectiveness, [84% of participants](https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=934952) used training completion as an effectiveness measure and 72% used click rate in phishing simulations. According to ENISA's exercise methodology, [time to detect](https://www.whalemate.com/en/resources/blog/nist-what-measure-security-awareness/) and reporting accuracy are the right measures for evaluating detection and reporting. Whalemate's reading is that many organizations still measure what is easiest to record, not what is most useful for response decisions.

The problem is not that completion or click rate are useless. The problem is using them as a substitute for operational capability. According to NIST, user-initiated reports, incidents tied to training topics, and audits are also used, but those signals are less standardized than course completion or clicks in a simulation.

## What does NITAM actually require, a campaign or a program?

According to DCSA, NITAM is structured around Promote Awareness, Establish an Insider Threat Program, Train the Workforce, and Support through Reporting. According to NIST, PM-12 requires implementing an insider threat program that includes a cross-discipline incident handling team, and IR-4(6) requires an incident handling capability for incidents involving insider threats. Whalemate's reading is that September is not enough as a communication campaign if it does not lead to a governance and operations decision.

CISA also organizes mitigation into four steps, Define, Detect and Identify, Assess, and Manage, according to its Insider Threat Mitigation Guide. That shifts the conversation away from awareness messaging and toward a system with detection, assessment, and response, supported by tracking critical assets and metrics on data and behaviors investigated by the insider threat team, according to CISA.

## Does documented awareness equal reduced exposure?

According to ISO Annex SL 7.2 and 7.3, the organization must ensure competence, evaluate the effectiveness of actions, and retain [documented evidence](https://www.whalemate.com/en/resources/blog/iso-27001-2022-requires-continuous/), in addition to ensuring awareness of the policy and the implications of nonconformity. According to Verizon's 2025 DBIR, human involvement in breaches stayed around 60%, and in the EMEA slice [29% of breaches](https://www.verizon.com/about/news/2025-data-breach-investigations-report-emea) originated inside organizations. Whalemate's reading is that meeting the documentation requirement does not by itself prove a material reduction in risk.

The tension is operational, not normative. ISO requires effectiveness to be evaluated, but it does not impose a specific metric. If the organization chooses attendance or course passing as the main evidence, it can be formally compliant while still being blind to reporting quality, detection speed, or role-based exposure.

## What is actually measured when the goal is to recognize and report indicators?

According to NIST SP 800-53 AT-2(2), the requirement is to provide training to [recognize and report](https://csrc.nist.gov/CSRC/media/Projects/risk-management/800-53%20Downloads/800-53r5/SP_800-53_v5_1_XML.xml) potential insider threat indicators. According to NIST, those indicators can include intense and prolonged job dissatisfaction, attempts to access information not needed for the job, unexplained access to financial resources, bullying or harassment, workplace violence, and other serious policy or rule violations. Whalemate's reading is that measuring phishing alone leaves out much of the problem the control itself is meant to cover.

According to the FBI, possible signs include taking proprietary information without need or authorization, seeking information outside job duties, copying unnecessary material, remotely accessing systems at unusual hours, and ignoring policies on software, hardware, or confidential downloads. That requires combining technical and nontechnical signals, not reducing insider threat to a simulated email campaign.

## What fails when the program relies on an isolated annual course?

According to the ISO/IEC JTC 1/SC 27 material on ISO/IEC 27002:2022 6.1.3, the expected practice includes regular, role-specific training, phishing simulations, participation tracking, and material adjustments based on feedback and incidents. According to NITTF, many programs regularly request feedback and measure reports received shortly after training. Whalemate's reading is that the isolated annual course fails because it does not create a continuous cycle of testing, learning, adjustment, and retraining.

PCI DSS 12.6, according to the material provided, requires a security awareness program, not a standalone course. Applied to insider threat, the September campaign only has value if it opens a longer measurement and follow-up phase, with focused interventions based on results.

Whalemate

Want to see Whalemate in your organization?

Book a demo. We will walk through email and QRishing simulations for your team, and what CISO, IT or compliance can decide from there.

[Book a demo](https://www.whalemate.com/en/demo/)

## Which metrics help make decisions tomorrow?

According to NIST, organizations already use the number and type of incidents tied to training topics, user-initiated reports, click rates, engagement with materials, and program audits or evaluations. According to ENISA, for simulated phishing it makes sense to measure time to detect and reporting accuracy. According to the academic review in ar5iv / arXiv, programs can also calculate click rate, re-click rate, and report rate.

Whalemate's reading is that a useful minimum set combines participation, click rate, report rate, re-click rate, time to detect, reporting accuracy, incidents tied to training, and audits. That dashboard does not replace the team's judgment, but it does enable evidence-based prioritization, especially by area, role, or type of exposure.

## What do real cases show about missed early signals?

According to CERT/SEI's analysis of 49 insider sabotage cases in critical infrastructure, 62% of incidents had been planned in advance, 80% of insiders had shown unusual behavior at work before acting, and 57% had exploited systemic vulnerabilities in applications, processes, or procedures. According to a study of the banking and financial sector by the United States Secret Service and the CERT Coordination Center, 87% of cases involved legitimate and simple commands, 78% involved authorized users with active access, and 81% were planned ahead of time.

Whalemate's reading is that insider threat is often seen too late not because signals do not exist, but because the signals are separated across access, behavior, process, and reporting. If the actor uses legitimate commands and authorized access, the value lies less in detecting exotic malware and more in correlating technical and behavioral deviations.

## Why does the reporting channel matter as much as training?

According to DCSA, one of NITAM's four official lines is Support through Reporting. According to the FBI, employees should be given convenient and nonthreatening ways to report suspicions. Whalemate's reading is that awareness without a usable channel produces underreporting, and underreporting means poor metrics and delayed response.

The UK example makes this visible. According to the United Kingdom's National Cyber Security Centre, the Suspicious Email Reporting Service received 160,000 suspicious emails in its first two weeks, and those reports led to 395 phishing sites being taken down. The figure is not portable as a benchmark for LATAM, but it does show that when the channel exists and is clear, reporting produces operational results.

## Where does the integration between security, HR, legal, and compliance fit?

According to NIST PM-12, the program must include a cross-discipline incident handling team. According to NIST's description of insider threat programs, technical and nontechnical information must be integrated and analyzed centrally, relevant information must be received from appropriate offices, and self-assessments of the program's posture must be performed. According to CISA, procedures should allow relevant and credible information to be accessed, collected, integrated, and reported across human resources, security, information assurance, and legal review.

Whalemate's reading is that this integration is not an add-on to maturity, but part of the operational requirement. Many indicators that NIST lists, such as workplace violence, harassment, or prolonged dissatisfaction, do not live in the SOC. If information does not cross domains, the program loses context before the investigation even starts.

## What weight does human and insider exposure have today?

According to Verizon's 2025 DBIR, human involvement in breaches stayed around 60%. According to Verizon's EMEA slice, 29% of breaches originated inside organizations, 19% were attributed to unintentional errors, 8% to misuse, and phishing appeared in 19% of regional breaches. According to IBM, malicious insider attacks had an average cost of USD 4.92 million per breach for the second year in a row, while phishing was the most common initial vector, with 16% of cases and an average cost of USD 4.8 million.

There is no primary evidence in the material for benchmarks or implementation cases specific to Latin America, so these figures should be read as global, European, British, or U.S. figures depending on the source. Even with that caution, the signal is consistent: the human and insider problem still carries enough weight that September should not be treated as a cosmetic action.

## What concrete decision does September enable for LATAM?

For a CISO, IT, or compliance team in LATAM, September works better as a budget and governance trigger than as a communication month. If DCSA and CISA frame the campaign around awareness, program, training, and reporting, and NIST adds indicator recognition, incident handling, and a multidisciplinary team, the useful decision is to redesign the program to measure and operate, not just train.

That means defining metrics for participation, click rate, report rate, re-click rate, time to detect, reporting accuracy, incidents tied to training, and audits, according to NIST, ENISA, and the academic review cited. It also means reviewing access, adding simulated scenarios, focusing training based on results, maintaining reporting channels, and coordinating security, HR, legal, compliance, and incident management, according to NIST, CISA, FBI, and CERT/SEI. In that setup, the [HRM risk score](https://www.whalemate.com/en/resources/blog/human-risk-management-what-measures/) helps prioritize interventions where the evidence shows higher exposure, not to reward or punish someone for clicking.

## What to read next?

- [Awareness on the platform](https://www.whalemate.com/en/platform/advanced-simulations/)
- [LATAM Awareness Platforms: What to Evaluate](https://www.whalemate.com/en/resources/blog/latam-awareness-platforms-what-evaluate/)
- [NIST and CISA on social engineering](https://www.whalemate.com/en/resources/blog/nist-cisa-social-engineering/)

[See the full topic guide](https://www.whalemate.com/en/platform/advanced-simulations/)

Questions

## Frequently asked questions

**What is the most useful thing that Insider Threat Awareness Month leaves for a company in LATAM?**

The most useful thing is not the campaign itself, but the decision it enables. According to DCSA, NITAM includes awareness, program, training, and support through reporting. If September is used only to complete courses, it falls short. If it is used to formalize metrics, reporting channels, response, and integration across areas, it becomes an operational lever.

**Which metrics are worth looking at besides click rate?**

According to NIST, besides click rates it is worth measuring user-initiated reports, incidents linked to training topics, and program audits. According to ENISA, it is also worth measuring time to detect and reporting accuracy. The cited academic review adds report rate and re-click rate to understand sustained behavior, not just a one-time reaction.

**Does an annual awareness course comply with what the frameworks require?**

No, not by itself. According to NIST SP 800-53 AT-2(2), training must be provided to recognize and report insider threat indicators. According to IR-4(6), there must also be an incident handling capability, and according to PM-12 there must be a program with a multidisciplinary team. According to the provided material, PCI DSS 12.6 requires a security awareness program, not a standalone course.

**Why should insider threat not be reduced to phishing?**

Because the frameworks and real cases show a broader scope. According to NIST AT-2(2), the indicators include attempts at unnecessary access, harassment, workplace violence, and serious policy violations. According to the FBI and CERT/CERT Division, behaviors also include unnecessary copying, unusual access, and repeated policy violations. Phishing is useful as an exercise, but it does not cover the full risk.

**Are there benchmarks specific to Latin America in this material?**

No. The material itself indicates that no specific primary evidence was found for benchmarks or implementation cases in Latin America. The available figures come from global, European, British, or U.S. sources, such as Verizon, IBM, the UK government, CISA, NIST, and CERT/SEI. To use those data in LATAM, it is advisable to always label their geographic scope.

Whalemate

Is this risk in your program?

If this article describes something you already faced — or that the board is asking you to explain — book a demo.

[Book a demo](https://www.whalemate.com/en/demo/)

## Would you like to go deeper on this topic?

Open this article directly in Claude or ChatGPT — ask questions, get a summary, or explore related ideas.

- [Open with Claude](https://claude.ai/new?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CNITAM%20needs%20a%20measurable%20insider%20threat%20program%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.)
- [Open with ChatGPT](https://chatgpt.com/?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CNITAM%20needs%20a%20measurable%20insider%20threat%20program%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.)

In this article

1. [What emerges when campaign, requirements, metrics, and outcomes are placed together](#s1)
2. [Why do course completion and click tracking remain the dominant signals if they are not enough?](#s2)
3. [What does NITAM actually require, a campaign or a program?](#s3)
4. [Does documented awareness equal reduced exposure?](#s4)
5. [What is actually measured when the goal is to recognize and report indicators?](#s5)
6. [What fails when the program relies on an isolated annual course?](#s6)
7. [Which metrics help make decisions tomorrow?](#s7)
8. [What do real cases show about missed early signals?](#s8)
9. [Why does the reporting channel matter as much as training?](#s9)
10. [Where does the integration between security, HR, legal, and compliance fit?](#s10)
11. [What weight does human and insider exposure have today?](#s11)
12. [What concrete decision does September enable for LATAM?](#s12)
13. [What to read next?](#s13)

Whalemate

Is this risk in your program?

[Book a demo](https://www.whalemate.com/en/demo/)

## Related articles

[!\[PCI, ISO and NIST: awareness is not annual training\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/pci-iso-nist-awareness-not.webp)](https://www.whalemate.com/en/resources/blog/pci-iso-nist-awareness-not/)

Awareness

Nov 13, 2026
By Federico Hombre

### PCI, ISO and NIST: awareness is not annual training

ISO, NIST, PCI DSS, CISA and ENISA point to a continuous, role-based program. Completion or click rates alone do not prove effectiveness.

Read more

[!\[CISA and NIST on cyberattack simulations\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/cisa-nist-cyberattack-simulations.webp)](https://www.whalemate.com/en/resources/blog/cisa-nist-cyberattack-simulations/)

Awareness

Nov 10, 2026
By Federico Hombre

### CISA and NIST on cyberattack simulations

CISA, NIST, and ISO/IEC 27001 show what to measure in simulations: clicks, reports, opens, difficulty

Read more

[!\[Phishing types need separate metrics\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/phishing-types-need-separate-metrics.webp)](https://www.whalemate.com/en/resources/blog/phishing-types-need-separate-metrics/)

Awareness

Nov 9, 2026
By Federico Hombre

### Phishing types need separate metrics

CISO, IT, and compliance teams should manage phishing by channel, target, control, and metric, not as a list of labels.

Read more

[See all articles](https://www.whalemate.com/en/resources/blog/)