--- title: "PCI, CISA and NIST on phishing | Whalemate" description: "PCI DSS, NIST, CISA and CTIR show phishing and vishing are not managed the same way. Metrics, controls and compliance decisions change." url: https://www.whalemate.com/en/resources/blog/pci-cisa-nist-phishing/ lang: en updated: 2026-10-28 alternates: es: https://www.whalemate.com/recursos/blog/pci-cisa-nist-phishing-vs/ pt-BR: https://www.whalemate.com/br/recursos/blog/pci-cisa-nist-phishing-vs/ index: https://www.whalemate.com/llms.txt --- [Back to blog](https://www.whalemate.com/en/resources/blog/) Blog # PCI, CISA and NIST on phishing PCI DSS, NIST, CISA and CTIR show phishing and vishing are not managed the same way. Metrics, controls and compliance decisions change. Oct 28, 2026 By [Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) 10 min read [Awareness](https://www.whalemate.com/en/resources/blog/topic/awareness/) ![PCI, CISA and NIST on phishing](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/pci-cisa-nist-phishing.webp) In this article 1. [What emerges when the sources are compared](#s1) 2. [Why the common mistake is treating them as equivalent channels](#s2) 3. [What really changes between phishing and vishing when risk is measured?](#s3) 4. [What does PCI DSS require, and why does that break the single-awareness approach?](#s4) 5. [What happens when evidence calls training alone into question?](#s5) 6. [Does CISA still recommend training even if the evidence is modest?](#s6) 7. [Which metrics fall short when only clicks are tracked?](#s7) 8. [What should be measured in vishing if there are no links or attachments?](#s8) 9. [What role does early reporting play in both scenarios?](#s9) 10. [Why does phishing-resistant MFA remain the technical priority?](#s10) 11. [What does incident volume say about investment decisions?](#s11) 12. [What breaks in common regional programs?](#s12) 13. [What does this mean tomorrow for CISOs, IT, and compliance teams in LATAM?](#s13) 14. [What to read next?](#s14) Phishing vs. vishing is not a useful comparison if it is reduced to email versus voice. Cross-referencing PCI DSS, NIST CSF 2.0, CISA, CTIR Gov Brasil, and empirical evidence shows something less convenient: phishing has explicit requirements for [automated technical controls](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-D-Merchant.pdf) separate from training, while vishing is mainly addressed through signal recognition, alternate-channel verification, and escalation. That asymmetry makes [clicks alone](https://www.whalemate.com/en/resources/blog/cisa-nist-cis-phishing-training/) or an annual course an incomplete way to measure risk. ## What emerges when the sources are compared No single source in the material builds this map on its own. Side by side, they show that phishing and vishing share the same social engineering base, but they do not leave the same observable trail, do not trigger the same controls, and should not be audited with the same dashboard. | Standard or guidance | Channel | What is observed | Main control | What it requires | Reporting | Source | | --- | --- | --- | --- | --- | --- | --- | | PCI DSS v4.0 Requirement 5.4.1 | phishing | not specified | automated processes and mechanisms | "Processes and automated mechanisms are in place to detect and protect personnel against phishing attacks." | not specified | PCI Security Standards Council | | PCI DSS v4.0 Requirement 12.6.3.1 | phishing and related attacks, social engineering | threats and vulnerabilities that could affect the CDE | awareness training | training must include awareness of "Phishing and related attacks" and "Social engineering" | not specified | PCI Security Standards Council | | NIST CSF 2.0 PR.AT-01 | social engineering and other common attacks | recognition of attempts and suspicious activity | awareness and training | personnel must receive awareness and training, including recognizing social engineering attempts and reporting attacks and suspicious activity, according to NIST | yes | NIST | | CTIR Gov Brasil Recomendação 04/2025 | vishing | spoofed caller ID, requests to confirm identity or token, requests to install AnyDesk or TeamViewer, urgency or threats | campaigns promoting official channels and training | reinforce official channels and train users to recognize vishing attempts, according to CTIR Gov Brasil | not specified | CTIR Gov Brasil | | CTIR Gov Brasil Recomendação 01/2019 | phishing or credential compromise | suspected phishing or credential compromise | internal team notification | notify the incident, security, or IT support team immediately, according to CTIR Gov Brasil | yes | CTIR Gov Brasil | | LNCC Brasil A.6.3 | fraudulent emails, SMS, and calls, phishing, vishing, and smishing | fraud identification, sender verification, new attack tactics | awareness, education, and training | includes content on fraudulent emails, SMS, and calls, sender verification, and reporting fraud attempts, according to LNCC | yes | LNCC Brasil | | CISA Phishing Guidance and Scattered Spider | phishing, also vishing and spearphishing | not specified | phishing-resistant MFA and diligent training | recommends FIDO/WebAuthn or PKI-based MFA, and continuing training against vishing and spearphishing, according to CISA | not specified | CISA | ## Why the common mistake is treating them as equivalent channels CISA defines phishing as a form of social engineering that uses email or malicious websites to request personal information, and defines vishing as the social engineering approach that uses voice communications. If that separation is taken at face value, the operational reading looks simple: email on one side, phone calls on the other. But NIST complicates that classification by noting that phishing [is not limited to email](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/phishing) and can also arrive through text messages, phone calls, social media, or postal mail. Whalemate’s reading is that the problem is not best organized by pure channel, but by observable signals and by the type of control each scenario supports. That difference ultimately affects compliance, metrics, and budget. ## What really changes between phishing and vishing when risk is measured? Phishing leaves more structured traces to observe. The material indicates that links, attachments, domains, delivery, and credentials can be measured, and the CISA, NSA, FBI, and MS-ISAC guidance separates two common tactics: credential theft through a fake site and malware delivery through a malicious attachment. Vishing has different signals. According to CTIR Gov Brasil, teams should watch for spoofed caller ID, requests to confirm identity or a token, requests to install AnyDesk or TeamViewer, and urgency or threat-based language. Whalemate’s reading is that if a program uses the same indicator for both, such as click rate, it leaves out the behavior that matters most in voice-based attacks. ## What does PCI DSS require, and why does that break the single-awareness approach? PCI DSS v4.0 Requirement 5.4.1 requires processes and automated mechanisms to detect and protect personnel against phishing attacks, according to the PCI Security Standards Council. The same standard, in Requirement 12.6.3.1, requires training to include awareness of "Phishing and related attacks" and "Social engineering," also according to the PCI Security Standards Council. The tension is not minor. PCI DSS explicitly separates the technical mechanism from training, and meeting one does not equal meeting the other, according to the standard itself. Whalemate’s reading is that many organizations in LATAM present awareness campaigns as if they covered both fronts, but that approach leaves a compliance gap for phishing and says almost nothing about vishing. ## What happens when evidence calls training alone into question? The PCI DSS split becomes more relevant when paired with empirical evidence. A large-scale replication published in 2025 found no significant main effects from training interventions on either click rate, p=0.450, or reporting rate, p=0.417, with negligible effect sizes, according to the academic study on arXiv. Whalemate’s reading is that this does not invalidate training, but it does invalidate using training as the sole argument for risk reduction. If the standard already requires a separate technical layer for phishing, relying only on awareness may not only perform poorly, it may also leave compliance without sufficient control evidence. ## Does CISA still recommend training even if the evidence is modest? Yes. CISA recommends that organizations continue diligent employee training against vishing and spearphishing, in addition to implementing phishing-resistant MFA, according to its guidance on Scattered Spider. That "in addition to" matters more than the standalone recommendation. The tension becomes clearer when compared with a NIST-related report. That report found a small statistical improvement, 2% less likelihood of falling for phishing among those who received training, and also found that static training did not show a benefit, while interactive training made people 20% less likely to fail future simulations, according to NIST Public Safety Communications Research. Whalemate’s reading is that the question is not whether to train, but which kind of training justifies investment and which controls it is paired with. ## Which metrics fall short when only clicks are tracked? The benchmarks in the material show why clicks are not enough. The 2025 Phishing Simulation Benchmark Report from Fortra, based on 13.9 million recipients and 7,504 customer campaigns, reported a 5.42% click rate, a 1.99% password-submission rate, and a 10.50% reporting rate. The same report warns that a 10.5% reporting rate should not automatically be celebrated and that a 5.42% click rate or 1.99% password-submission rate is not necessarily acceptable simply because it is low, according to Fortra. Whalemate’s reading is that the dashboard needs to measure sequence, not a single event. For phishing, the value lies in seeing delivery, interaction, credential submission, reporting, time to report, and escalation. For vishing, the logic shifts even more, because neither clicks nor delivery describe the real risk of a fraudulent phone call very well. Whalemate Want to see Whalemate in your organization? Book a demo. We will walk through email and QRishing simulations for your team, and what CISO, IT or compliance can decide from there. [Book a demo](https://www.whalemate.com/en/demo/) ## What should be measured in vishing if there are no links or attachments? CTIR Gov Brasil provides concrete signals that can be turned into operational metrics. Its Recomendação 04/2025 identifies spoofed caller ID, requests to confirm identity or a token, installation of AnyDesk or TeamViewer, and urgency or threat-based language as vishing indicators. Whalemate’s reading is that this enables a different dashboard. In vishing, teams should measure recognition of spoofed caller ID, the share of users who accept or reject token requests, remote-installation attempts, out-of-band verification, and time to escalation to the incident team. If those metrics do not exist, the program is not seeing the channel, only naming it. ## What role does early reporting play in both scenarios? NIST CSF 2.0 PR.AT-01 includes as an example that users are trained to recognize social engineering attempts and report attacks and suspicious activity, according to NIST’s implementation examples. CIS Control 14.6 identifies training the workforce to recognize and report security incidents as a separate practice, which makes it possible to measure reporting in addition to clicks or credential submission, according to the Center for Internet Security. The regional material reinforces that reading. CTIR Gov Brasil says that, when phishing or credential compromise is suspected, the incident, security, or IT support team should be notified immediately. Whalemate’s reading is that reporting and escalation are not secondary metrics, they are the variable that connects awareness to real response. ## Why does phishing-resistant MFA remain the technical priority? CISA recommends FIDO or PKI-based MFA and describes these forms as phishing-resistant. It also recommends requiring phishing-resistant MFA especially for webmail, VPNs, and accounts that access critical systems, according to CISA. The technical urgency is easier to understand with two data points from the material. Google evaluated 14 types of login challenges against more than 350,000 real account takeover attempts and found that knowledge-based challenges blocked only 10% of phishing-driven attempts, while device-based challenges blocked more than 94%, according to Google Research. At the same time, CISA warns that push notifications without number matching can enable fatigue attacks and that attackers can achieve phone-number transfers to receive MFA codes by SMS or call. Whalemate’s reading is that not all MFA reduces risk in the same way, and part of the vishing problem appears precisely in the exploitation of the phone channel around authentication. ## What does incident volume say about investment decisions? The FBI reported that IC3 received 859,532 complaints of internet crime in 2024 and losses above US$16 billion, a 33% increase from 2023. According to the FBI, phishing and spoofing were among the three cybercrimes with the most complaints in 2024. The activity picture also supports the idea that this is not a marginal risk. APWG observed 853,244 phishing attacks in Q4 2025 and 3.8 million attacks during 2025, up from 3.76 million in 2024. Whalemate’s reading is that, at this volume, declining to separate metrics and controls by modality is no longer a harmless simplification, it is a surrender of visibility. ## What breaks in common regional programs? What breaks is the assumption that one annual course, one email simulation, and one click metric describe the full human risk. Verizon reports that human involvement in breaches remained at about 60%, and also describes social engineering as an incident category led by phishing and pretexting, according to the 2025 Data Breach Investigations Report. Whalemate’s reading is that the practical problem is not a lack of campaigns, but too much homogeneity. When phishing and vishing are bundled into a generic awareness package, the program does not show technical compliance where the standard requires it, does not observe voice-specific signals where the attack occurs, and does not prioritize critical access with phishing-resistant controls. ## What does this mean tomorrow for CISOs, IT, and compliance teams in LATAM? The operational decision is to separate two layers of management. For phishing, the program has to demonstrate technical and automated controls, plus measurement of delivery, interaction, credential submission, reporting, time to report, and adoption of phishing-resistant MFA for webmail, VPNs, and critical access, according to PCI DSS v4.0, CISA, and Google Research. For vishing, the program has to measure recognition of spoofed caller ID, token requests, remote-installation requests, alternate-channel verification, and immediate escalation, according to CTIR Gov Brasil. For compliance, this changes what evidence is requested and audited. For IT, it changes which controls get priority first. For a CISO, it changes what risk can honestly be said to be reduced and what risk is only being measured incompletely. ## What to read next? - [Awareness on the platform](https://www.whalemate.com/en/platform/advanced-simulations/) - [NIST and CISA on social engineering](https://www.whalemate.com/en/resources/blog/nist-cisa-social-engineering/) - [PCI DSS: Phishing vs. Spam in LATAM](https://www.whalemate.com/en/resources/blog/pci-dss-phishing-vs-spam/) [See the full topic guide](https://www.whalemate.com/en/platform/advanced-simulations/) Questions ## Frequently asked questions **Can phishing and vishing be covered by the same awareness program?** Not entirely. According to PCI DSS v4.0, phishing requires a technical layer separate from training, while for vishing the available material emphasizes signal recognition, alternate-channel verification, and escalation, according to CTIR Gov Brasil. A single generic program can serve as a foundation, but it does not provide the same compliance, visibility, or response coverage. **What metric should replace click rate as the main indicator?** There is no single metric that replaces click rate. According to NIST CSF 2.0, CTIR Gov Brasil, and CIS Control 14.6, it is advisable to measure reporting and escalation in addition to interaction. For phishing, add credential submission and time to report. For vishing, measure out-of-band verification, token requests, remote installation, and recognition of spoofed caller ID. **Does training still make sense if some studies show little effect?** Yes, but not as the only defense or in just any format. A report associated with NIST found a small overall improvement and better results in interactive training, while a large-scale replication in 2025 found no significant effects on click or reporting. The reasonable decision is to train, measure reporting, and combine it with phishing-resistant technical controls. **Which technical control should be prioritized first for critical access?** According to CISA, the priority is phishing-resistant MFA, especially FIDO/WebAuthn or PKI-based MFA, for webmail, VPN, and accounts with access to critical systems. The Google Research study reinforces that priority by showing more than 94% blocking with device-based challenges versus 10% with knowledge-based challenges. **What evidence should compliance request in an internal audit?** Compliance should request evidence separated by modality. For phishing, proof of technical and automated mechanisms, coverage of phishing-resistant MFA, and reporting and escalation metrics, according to PCI DSS v4.0 and CISA. For vishing, specific campaigns, alternate-channel verification guides, observed signals, and an immediate notification procedure, according to CTIR Gov Brasil and NIST CSF 2.0. Whalemate Is this risk in your program? If this article describes something you already faced — or that the board is asking you to explain — book a demo. [Book a demo](https://www.whalemate.com/en/demo/) ## Would you like to go deeper on this topic? Open this article directly in Claude or ChatGPT — ask questions, get a summary, or explore related ideas. - [Open with Claude](https://claude.ai/new?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CPCI%2C%20CISA%20and%20NIST%20on%20phishing%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) - [Open with ChatGPT](https://chatgpt.com/?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CPCI%2C%20CISA%20and%20NIST%20on%20phishing%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) In this article 1. [What emerges when the sources are compared](#s1) 2. [Why the common mistake is treating them as equivalent channels](#s2) 3. [What really changes between phishing and vishing when risk is measured?](#s3) 4. [What does PCI DSS require, and why does that break the single-awareness approach?](#s4) 5. [What happens when evidence calls training alone into question?](#s5) 6. [Does CISA still recommend training even if the evidence is modest?](#s6) 7. [Which metrics fall short when only clicks are tracked?](#s7) 8. [What should be measured in vishing if there are no links or attachments?](#s8) 9. [What role does early reporting play in both scenarios?](#s9) 10. [Why does phishing-resistant MFA remain the technical priority?](#s10) 11. [What does incident volume say about investment decisions?](#s11) 12. [What breaks in common regional programs?](#s12) 13. [What does this mean tomorrow for CISOs, IT, and compliance teams in LATAM?](#s13) 14. [What to read next?](#s14) Whalemate Is this risk in your program? [Book a demo](https://www.whalemate.com/en/demo/) ## Related articles [!\[Awareness campaigns: what they require\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/awareness-campaigns-what-they-require.webp)](https://www.whalemate.com/en/resources/blog/awareness-campaigns-what-they-require/) Awareness Oct 30, 2026 By Federico Hombre ### Awareness campaigns: what they require ISO, PCI DSS, CIS, NIST, ENISA, and California do not ask for the same thing. The comparison shows what to measure Read more [!\[LATAM Awareness Platforms: What to Evaluate\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/latam-awareness-platforms-what-evaluate.webp)](https://www.whalemate.com/en/resources/blog/latam-awareness-platforms-what-evaluate/) Awareness Oct 29, 2026 By Federico Hombre ### LATAM Awareness Platforms: What to Evaluate For CISOs, IT, and compliance teams, an awareness platform should measure, segment, and audit behavior, not just deliver courses. Read more [!\[Phishing vs spear phishing: what CISOs need\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/phishing-vs-spear-phishing-what.webp)](https://www.whalemate.com/en/resources/blog/phishing-vs-spear-phishing-what/) Awareness Oct 27, 2026 By Federico Hombre ### Phishing vs spear phishing: what CISOs need The distinction changes metrics and controls. Clicks alone and a yearly course are not enough to judge risk or training effectiveness. Read more [See all articles](https://www.whalemate.com/en/resources/blog/)