PCI, CISA and NIST on phishing

Phishing vs. vishing is not a useful comparison if it is reduced to email versus voice. Cross-referencing PCI DSS, NIST CSF 2.0, CISA, CTIR Gov Brasil, and empirical evidence shows something less convenient: phishing has explicit requirements for automated technical controls separate from training, while vishing is mainly addressed through signal recognition, alternate-channel verification, and escalation. That asymmetry makes clicks alone or an annual course an incomplete way to measure risk.

What emerges when the sources are compared

No single source in the material builds this map on its own. Side by side, they show that phishing and vishing share the same social engineering base, but they do not leave the same observable trail, do not trigger the same controls, and should not be audited with the same dashboard.

Why the common mistake is treating them as equivalent channels

CISA defines phishing as a form of social engineering that uses email or malicious websites to request personal information, and defines vishing as the social engineering approach that uses voice communications. If that separation is taken at face value, the operational reading looks simple: email on one side, phone calls on the other.

But NIST complicates that classification by noting that phishing is not limited to email and can also arrive through text messages, phone calls, social media, or postal mail. Whalemate’s reading is that the problem is not best organized by pure channel, but by observable signals and by the type of control each scenario supports. That difference ultimately affects compliance, metrics, and budget.

What really changes between phishing and vishing when risk is measured?

Phishing leaves more structured traces to observe. The material indicates that links, attachments, domains, delivery, and credentials can be measured, and the CISA, NSA, FBI, and MS-ISAC guidance separates two common tactics: credential theft through a fake site and malware delivery through a malicious attachment.

Vishing has different signals. According to CTIR Gov Brasil, teams should watch for spoofed caller ID, requests to confirm identity or a token, requests to install AnyDesk or TeamViewer, and urgency or threat-based language. Whalemate’s reading is that if a program uses the same indicator for both, such as click rate, it leaves out the behavior that matters most in voice-based attacks.

What does PCI DSS require, and why does that break the single-awareness approach?

PCI DSS v4.0 Requirement 5.4.1 requires processes and automated mechanisms to detect and protect personnel against phishing attacks, according to the PCI Security Standards Council. The same standard, in Requirement 12.6.3.1, requires training to include awareness of "Phishing and related attacks" and "Social engineering," also according to the PCI Security Standards Council.

The tension is not minor. PCI DSS explicitly separates the technical mechanism from training, and meeting one does not equal meeting the other, according to the standard itself. Whalemate’s reading is that many organizations in LATAM present awareness campaigns as if they covered both fronts, but that approach leaves a compliance gap for phishing and says almost nothing about vishing.

What happens when evidence calls training alone into question?

The PCI DSS split becomes more relevant when paired with empirical evidence. A large-scale replication published in 2025 found no significant main effects from training interventions on either click rate, p=0.450, or reporting rate, p=0.417, with negligible effect sizes, according to the academic study on arXiv.

Whalemate’s reading is that this does not invalidate training, but it does invalidate using training as the sole argument for risk reduction. If the standard already requires a separate technical layer for phishing, relying only on awareness may not only perform poorly, it may also leave compliance without sufficient control evidence.

Does CISA still recommend training even if the evidence is modest?

Yes. CISA recommends that organizations continue diligent employee training against vishing and spearphishing, in addition to implementing phishing-resistant MFA, according to its guidance on Scattered Spider. That "in addition to" matters more than the standalone recommendation.

The tension becomes clearer when compared with a NIST-related report. That report found a small statistical improvement, 2% less likelihood of falling for phishing among those who received training, and also found that static training did not show a benefit, while interactive training made people 20% less likely to fail future simulations, according to NIST Public Safety Communications Research. Whalemate’s reading is that the question is not whether to train, but which kind of training justifies investment and which controls it is paired with.

Which metrics fall short when only clicks are tracked?

The benchmarks in the material show why clicks are not enough. The 2025 Phishing Simulation Benchmark Report from Fortra, based on 13.9 million recipients and 7,504 customer campaigns, reported a 5.42% click rate, a 1.99% password-submission rate, and a 10.50% reporting rate. The same report warns that a 10.5% reporting rate should not automatically be celebrated and that a 5.42% click rate or 1.99% password-submission rate is not necessarily acceptable simply because it is low, according to Fortra.

Whalemate’s reading is that the dashboard needs to measure sequence, not a single event. For phishing, the value lies in seeing delivery, interaction, credential submission, reporting, time to report, and escalation. For vishing, the logic shifts even more, because neither clicks nor delivery describe the real risk of a fraudulent phone call very well.

What should be measured in vishing if there are no links or attachments?

CTIR Gov Brasil provides concrete signals that can be turned into operational metrics. Its Recomendação 04/2025 identifies spoofed caller ID, requests to confirm identity or a token, installation of AnyDesk or TeamViewer, and urgency or threat-based language as vishing indicators.

Whalemate’s reading is that this enables a different dashboard. In vishing, teams should measure recognition of spoofed caller ID, the share of users who accept or reject token requests, remote-installation attempts, out-of-band verification, and time to escalation to the incident team. If those metrics do not exist, the program is not seeing the channel, only naming it.

What role does early reporting play in both scenarios?

NIST CSF 2.0 PR.AT-01 includes as an example that users are trained to recognize social engineering attempts and report attacks and suspicious activity, according to NIST’s implementation examples. CIS Control 14.6 identifies training the workforce to recognize and report security incidents as a separate practice, which makes it possible to measure reporting in addition to clicks or credential submission, according to the Center for Internet Security.

The regional material reinforces that reading. CTIR Gov Brasil says that, when phishing or credential compromise is suspected, the incident, security, or IT support team should be notified immediately. Whalemate’s reading is that reporting and escalation are not secondary metrics, they are the variable that connects awareness to real response.

Why does phishing-resistant MFA remain the technical priority?

CISA recommends FIDO or PKI-based MFA and describes these forms as phishing-resistant. It also recommends requiring phishing-resistant MFA especially for webmail, VPNs, and accounts that access critical systems, according to CISA.

The technical urgency is easier to understand with two data points from the material. Google evaluated 14 types of login challenges against more than 350,000 real account takeover attempts and found that knowledge-based challenges blocked only 10% of phishing-driven attempts, while device-based challenges blocked more than 94%, according to Google Research. At the same time, CISA warns that push notifications without number matching can enable fatigue attacks and that attackers can achieve phone-number transfers to receive MFA codes by SMS or call. Whalemate’s reading is that not all MFA reduces risk in the same way, and part of the vishing problem appears precisely in the exploitation of the phone channel around authentication.

What does incident volume say about investment decisions?

The FBI reported that IC3 received 859,532 complaints of internet crime in 2024 and losses above US$16 billion, a 33% increase from 2023. According to the FBI, phishing and spoofing were among the three cybercrimes with the most complaints in 2024.

The activity picture also supports the idea that this is not a marginal risk. APWG observed 853,244 phishing attacks in Q4 2025 and 3.8 million attacks during 2025, up from 3.76 million in 2024. Whalemate’s reading is that, at this volume, declining to separate metrics and controls by modality is no longer a harmless simplification, it is a surrender of visibility.

What breaks in common regional programs?

What breaks is the assumption that one annual course, one email simulation, and one click metric describe the full human risk. Verizon reports that human involvement in breaches remained at about 60%, and also describes social engineering as an incident category led by phishing and pretexting, according to the 2025 Data Breach Investigations Report.

Whalemate’s reading is that the practical problem is not a lack of campaigns, but too much homogeneity. When phishing and vishing are bundled into a generic awareness package, the program does not show technical compliance where the standard requires it, does not observe voice-specific signals where the attack occurs, and does not prioritize critical access with phishing-resistant controls.

What does this mean tomorrow for CISOs, IT, and compliance teams in LATAM?

The operational decision is to separate two layers of management. For phishing, the program has to demonstrate technical and automated controls, plus measurement of delivery, interaction, credential submission, reporting, time to report, and adoption of phishing-resistant MFA for webmail, VPNs, and critical access, according to PCI DSS v4.0, CISA, and Google Research. For vishing, the program has to measure recognition of spoofed caller ID, token requests, remote-installation requests, alternate-channel verification, and immediate escalation, according to CTIR Gov Brasil.

For compliance, this changes what evidence is requested and audited. For IT, it changes which controls get priority first. For a CISO, it changes what risk can honestly be said to be reduced and what risk is only being measured incompletely.

What to read next?

• Awareness on the platform
• NIST and CISA on social engineering
• PCI DSS: Phishing vs. Spam in LATAM