Phishing types need separate metrics

For CISO, IT, and compliance teams, phishing types are not best separated by label, but by channel, target, observable signal, primary control, and useful metric. When CISA definitions are compared with what CISA and NIST measure, and with evidence from Verizon, Proofpoint, and UNICC, an operational gap appears: much of the measurement still centers on email clicks, even though relevant risk also comes from credential theft with MFA bypass, malicious attachments, and channels outside email such as SMS, messaging, and voice.

The missing comparison across sources

None of the materials here builds the full operational taxonomy. CISA defines modalities and metrics separately, ISO/IEC 27001 requires selecting controls based on risk and documenting them, and Verizon, Proofpoint, and UNICC provide incident and simulation performance data, but they do not connect all of it in a single decision matrix.

Why treat phishing types as a matrix, not a glossary?

The problem is not semantic. It is program design. According to CISA, there are tactics aimed at stealing credentials and others aimed at deploying malware, while CISA also distinguishes spearphishing, whaling, smishing, and vishing as modalities with distinct traits. Whalemate's reading is that if each modality changes the channel, the signal, and the goal, then the control that gets priority and the metric used to track risk also have to change.

What does CISA measure today, and what does that measurement leave out?

CISA describes its Phishing Campaign Assessment as a six-week evaluation that measures workforce propensity to click on email phishing lures. CISA also says phishing vulnerability scanning identifies how many users opened and how many clicked the link. Whalemate's reading is that these metrics are useful, but they narrow risk to email and to visible interaction inside a single simulation.

How does email-based measurement coexist with attacks that leave email?

The tension is in CISA's own documentation. On one hand, CISA measures opens and clicks in email campaigns, but on the other it warns that email scanning does not necessarily detect messages sent by SMS or by messaging apps such as Telegram, Signal, Slack, Facebook, Twitter, Teams, iMessage, and Google Chat. Whalemate's reading is that a program can show improvement in email and still leave part of the attack surface explicitly uncovered.

What changes when the goal is credential theft?

CISA explains that in credential phishing, the attacker sends an email with a link to a fake site so the victim enters a username and password. CISA adds that some fake sites also ask for MFA codes and calls that approach MFA bypass. Whalemate's reading is that measuring clicks alone is not enough, because the real risk is whether the person gives up credentials, gives up a second factor, or exits the flow.

Is enabling MFA enough for credential phishing?

CISA says a primary mitigation for phishing intended to steal credentials is enabling MFA, especially phishing-resistant MFA such as FIDO. But CISA also warns about fake sites that ask for MFA codes and use them for MFA bypass. Whalemate's reading is that the decision is not only to turn on MFA, but to prioritize phishing-resistant methods and review what share of the user base still depends on factors vulnerable to relay or voluntary disclosure.

What do malicious attachments show about failure metrics?

CISA defines malware phishing as sending a malicious attachment that the person may be tricked into running. In the 2024 State of the Phish report, Proofpoint said attachment-based simulations accounted for 10% of the total, but had the highest failure rate, 17%. Whalemate's reading is that a program centered on links can underestimate the operational risk of attachments, even if they appear less often in volume.

What do Verizon and CISA say about the operational relevance of human behavior?

The Verizon 2025 Data Breach Investigations Report analyzed more than 22,000 security incidents, including 12,195 confirmed data breaches, and said the human element remained involved in about 60% of the breaches analyzed. In that same report, according to Verizon, credential abuse appeared as the initial vector in 22% of cases. Whalemate's reading is that the discussion about phishing types is not educational. It is a discussion about operational exposure.

What happens when click rate is used as a proxy for risk?

The evidence does not support that simplification. The New York State Office of Information Technology's presentation of the Verizon 2025 DBIR said users with recent training reported simulated phishing emails at an approximate rate of 21%, compared with a baseline rate of 5%, while DomainTools, citing Verizon 2025 DBIR, said the effect of recent training on click rate was much smaller, with a relative impact of about 5%. Whalemate's reading is that the program may be improving a valuable capability, reporting, without that showing up with the same force in reduced clicking.

Why separate open, click, report, and participation?

CISA already separates users who opened from users who clicked in phishing vulnerability scanning, and CIO FISMA metric 2.15 asks for reporting on how many users participated in exercises in the previous quarter. NIST says simulations can measure who clicks and who reports the message as phishing. Whalemate's reading is that collapsing all of that into one rate erases different behaviors with different value for risk and intervention.

How much does the result change based on the lure used?

Quite a lot. A NIST study on differential susceptibility found four simulated emails with click rates of 53.8%, 54.7%, 29.1%, and 5.1%, and concluded that Phish Scale scores closely matched the observed rates. UNICC's 2024 report also said that when NIST Phish Scale was applied, high-difficulty messages had a click rate of 36.15%, compared with 5.74% for low-difficulty messages. Whalemate's reading is that comparing campaigns without normalizing for difficulty or lure type can produce misleading risk readings.

What do Proofpoint and UNICC say about campaign design and reporting?

Proofpoint reported in 2024 a general simulated phishing reporting rate of 18.3% and a general failure rate of 9.3%, while in 2025 it reported an average failure rate of 4.93% and an average reporting rate of 18.65% in the campaigns analyzed. UNICC reported that 45% of organizations had a phishing report button integrated into the corporate email client, and that organizations with that feature recorded an average reporting rate of 16%, compared with 8.5% among those without it. Whalemate's reading is that reporting capability depends on both training and the operating design of the channel.

What does ISO/IEC 27001 mean for this coverage problem?

ISO/IEC JTC 1/SC 27 explains that ISO/IEC 27001, clause 6.1.3 b), requires determining the information security controls needed to reduce exposure to risk to an acceptable level. The same committee explains that ISO/IEC 27001, clause 6.1.3 c), requires comparing the controls determined by the organization with the controls in Annex A and verifying that no necessary control was left out. Whalemate's reading is that if the identified risk includes SMS, messaging, voice, attachments, and MFA bypass, measuring only email leaves a gap that is hard to justify in control applicability.

What does regional practice say about exposed channels and sectors?

According to information attributed by Securitic to the ESET Security Report 2025, 73% of companies in Latin America surveyed said they were targeted by phishing campaigns during 2025. The same information attributed to the ESET Security Report 2025 reported incidence of 81.4% in education, 81.1% in manufacturing, 79.6% in banking and finance, 72.6% in government, and 67.6% in health care. Whalemate's reading is that, even without a comparable Latin American rate by phishing modality, there is enough evidence not to treat phishing as a single homogeneous scenario.

What decision does this enable tomorrow for CISO, IT, and compliance in LATAM?

The practical decision is to redesign the phishing program as a matrix by type, channel, role, and observed behavior. For credential phishing, CISA prioritizes phishing-resistant MFA such as FIDO; for malicious attachments, Proofpoint's evidence supports specific controls and simulations around files; for smishing and vishing, CISA and the FTC require out-of-band verification and channels not covered by email; and for spearphishing and whaling, ISO/IEC JTC 1/SC 27 supports regular role-specific training, with participation logging and adaptation based on incident trends. If PCI DSS 12.6 also requires a security awareness program, not a one-off course, then using a single click rate as a proxy for risk is no longer enough to show coverage, prioritization, and intervention.

What to read next?

• Awareness on the platform
• LATAM Awareness Platforms: What to Evaluate
• NIST and CISA on social engineering