By 
The operational difference between phishing and spear phishing supports different metrics and controls. NIST, PCI DSS, and CIS all require continuous training and the ability to recognize and report social engineering, but the evidence does not support measuring clicks alone or treating traditional training as sufficient. To make the right call, a CISO has to separate mass campaigns from targeted attacks, compare results while controlling for lure difficulty, and prioritize credential submission, reports, and response time.
Seen side by side, the sources show something that is not obvious when read separately. The standards describe awareness obligations and evidence requirements, the guidance points to measurement, and the benchmarks and studies make clear that clicks by themselves do not tell the full story about human risk.
| Topic | Attack type | Definition | Objective | Distinctive trait | What is measured | Decision it enables | Source |
|---|---|---|---|---|---|---|---|
| Phishing | General family of scams | A technique used to try to obtain sensitive data through a fraudulent request by email or website, and also the use of a spoofed email to collect private information, distribute malware, or commit fraud | Broad audience, usually generic messages | Seeks to persuade a person to hand over sensitive data to an impostor | CISA describes a six-week assessment that measures workforce tendency to click phishing lures. Fortra reports click rate, credential submission rate, and report rate. The NIST Cybersecurity Framework 2.0 Concept Paper gives as examples the number of phishing attempts prevented and 80% of users reporting known attempts | Guide anti-phishing training and awareness and assess effectiveness with more than one metric, not just clicks | NIST, NIST SP 800-177 Rev. 1, CISA, Fortra, NIST Cybersecurity Framework 2.0 Concept Paper |
| Spear phishing | Targeted phishing variant | A highly targeted phishing attack, usually against a specific person or department within an organization, where the adversary knows the victim profile and uses contextual information so the message appears to come from a legitimate source | One person, group, organization, or specific department | Target selection, prior research, and personalization using contextual information or known personal data. ENISA adds frequent use of OSINT | Not defined as a single benchmark in the standards. NIST Phish Scale is designed to score the human difficulty of detecting a phishing email and make simulations comparable across lures. INCIBE indicates follow-up actions if credentials were submitted | Segment by role or criticality and do not compare campaigns of different difficulty without normalizing the lure | NIST, NIST SP 800-177 Rev. 1, ENISA, NIST Phish Scale, INCIBE |
| NIST SP 800-53 Rev. 5 | Does not separate a phishing vs spear phishing requirement, but does mention spear phishing in exercises | Requires security and privacy literacy training for users, managers, senior executives, and contractors. It also requires training to recognize and report potential and actual social engineering and social mining instances | All system users, including managers, senior executives, and contractors | Requires practical exercises that simulate events and incidents, including unannounced social engineering attempts and the impact of opening malicious attachments or activating malicious links through spear phishing | Does not specify a single numeric metric. AT-4 treats training records as separate evidence from the training activity | Separate compliance evidence from real effectiveness and use practical simulations, including spear phishing, not just initial training | NIST SP 800-53 Rev. 5, NIST |
| PCI DSS v4.0 | Phishing and related attacks within awareness, with a separate technical control for phishing | Training must include awareness of threats and vulnerabilities that could affect CDE security, including the literal phrase phishing and related attacks and social engineering | All personnel | PCI DSS v4.0.1 states that security awareness education is an ongoing activity. It also distinguishes requirement 5.4.1 for technical and automated controls to detect and protect personnel against phishing from requirement 12.6.3.1 for training | Not specified as a KPI. It does require a formal program, and the v4.0 change summary says the program should be reviewed and updated at least every 12 months | Do not treat phishing as satisfied by awareness alone or by technology alone. Maintain both fronts separately | PCI DSS v4.0.1, PCI DSS v4.0, PCI Security Standards Council |
| CIS Controls v8.1 | Phishing as an example of social engineering to recognize | Requires establishing and maintaining a security awareness program and training the workforce to recognize social engineering attacks such as phishing, BEC, pretexting, and tailgating | Workforce members | The policy template makes clear that an effective program should not be limited to a generic annual video paired with periodic phishing tests. In addition to annual training, there should be more frequent topical messages and notifications | No numeric KPI specified in the cited control | Avoid minimum-compliance programs based only on an annual course and periodic tests. Sustain more frequent interventions | CIS Controls v8.1, Center for Internet Security |
| Operational metrics observed | Simulated phishing campaigns | Human behavior benchmarks under simulations and response measurement | Recipients of simulation campaigns | Fortra reports 5.42% clicks, 1.99% credential submission, and 10.50% reporting across 13.9 million recipients and 7,504 campaigns. Proofpoint reports a 4.93% average failure rate, 6.59% in attachment-based campaigns, and 2.46% in data-entry campaigns. It also reports that 10% of users were responsible for 100% of clicks within a given wave | Clicks, credential submission, reporting, lure type, and user risk concentration | Prioritize credential submission and reporting, and focus controls on higher-risk groups or users instead of treating click rate as a sufficient indicator | Fortra, Proofpoint |
Do phishing and spear phishing require the same measurement?
No. NIST defines phishing as the general family of scams and spear phishing as a highly targeted variant against a specific person or department. NIST SP 800-177 Rev. 1 adds that in spear phishing the adversary knows the victim profile and uses contextual information. Whalemate's view is that this difference changes measurement: mass campaigns can support aggregated KPIs, while targeted attacks require segmentation by role, exposure, criticality, and degree of personalization.
What changes when the attack is mass and not targeted?
According to NIST, general phishing usually targets a broad audience and uses generic messages. CISA describes the Phishing Campaign Assessment as a six-week evaluation that measures workforce tendency to click phishing lures. Whalemate's view is that, in this context, measurement helps show aggregate behavior, but it is still incomplete if it is reduced to clicks and does not include credential submission, reports, and time to report.
What changes when the attack is spear phishing?
NIST and ENISA agree that spear phishing includes target selection, prior research, and personalization. ENISA adds that this personalization often relies on OSINT. Whalemate's view is that it makes no sense to compare a generic campaign with a targeted one without controlling for the human difficulty of the lure, and that is why NIST Phish Scale becomes not a methodological detail but a condition for interpreting results without self-deception.
Do the standards call for continuous awareness or is one course enough?
One isolated course is not enough. NIST SP 800-53 Rev. 5, in AT-2, requires security and privacy literacy training as part of initial training and at a frequency defined by the organization, and it also requires training to recognize and report potential and actual instances of social engineering and social mining. PCI DSS v4.0.1, requirement 12.6, states literally that security awareness education is an ongoing activity. Whalemate's view is that compliance requires continuity, not a yearly event.
Do the standards distinguish awareness from technical controls?
Yes, and that point is often missed in practice. PCI DSS v4.0 distinguishes requirement 5.4.1, which covers technical and automated controls to detect and protect personnel against phishing, from requirement 12.6.3.1, which covers training. NIST SP 800-53 Rev. 5 also separates the training activity from its records, since AT-4 treats training records as evidence distinct from the activity itself. Whalemate's view is that there are three separate planes: training, technology, and documentation.
Does the evidence support using clicks as the primary KPI?
Not as the only indicator. CISA uses clicks for a specific assessment, but Fortra also reports credential submission and reporting, with 5.42% clicks, 1.99% credential submission, and 10.50% reporting across 13.9 million recipients and 7,504 campaigns. The NIST Cybersecurity Framework 2.0 Concept Paper uses examples such as phishing attempts prevented and users reporting known attempts. Whalemate's view is that the click is an early signal, not a sufficient reading of risk.
What does practice show about the real risk behind a low click rate?
Proofpoint reports that even best-in-breed organizations still recorded more than 1% clicks in their measurements, so a low rate does not mean zero risk. The same Proofpoint report says that, in one malicious attack measurement, 10% of users were responsible for 100% of the clicks within a given wave, and that 40% of clicks usually come from users who clicked only once. Whalemate's view is that averages can hide risk concentration and critical users.
