---
title: "Phishing vs spear phishing: what CISOs need | Whalemate"
description: "The distinction changes metrics and controls. Clicks alone and a yearly course are not enough to judge risk or training effectiveness."
url: https://www.whalemate.com/en/resources/blog/phishing-vs-spear-phishing-what/
lang: en
updated: 2026-10-27
alternates:
  es: https://www.whalemate.com/recursos/blog/phishing-vs-spear-phishing-cambia/
  pt-BR: https://www.whalemate.com/br/recursos/blog/phishing-spear-phishing-mudam-medicao/
index: https://www.whalemate.com/llms.txt
---

[Back to blog](https://www.whalemate.com/en/resources/blog/)

Blog

# Phishing vs spear phishing: what CISOs need

The distinction changes metrics and controls. Clicks alone and a yearly course are not enough to judge risk or training effectiveness.

Oct 27, 2026
By [Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/)
11 min read

[Awareness](https://www.whalemate.com/en/resources/blog/topic/awareness/)

![Phishing vs spear phishing: what CISOs need](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/phishing-vs-spear-phishing-what.webp)

In this article

1. [Do phishing and spear phishing require the same measurement?](#s1)
2. [What changes when the attack is mass and not targeted?](#s2)
3. [What changes when the attack is spear phishing?](#s3)
4. [Do the standards call for continuous awareness or is one course enough?](#s4)
5. [Do the standards distinguish awareness from technical controls?](#s5)
6. [Does the evidence support using clicks as the primary KPI?](#s6)
7. [What does practice show about the real risk behind a low click rate?](#s7)
8. [Does continuous training always work?](#s8)
9. [So do interactive exercises also fail?](#s9)
10. [Why does lure difficulty matter so much?](#s10)
11. [What does measuring response time add beyond final outcome?](#s11)
12. [What forces organizations to separate mass phishing from spear phishing in day-to-day management?](#s12)
13. [What does this mean for compliance in LATAM?](#s13)
14. [Operational consequence](#s14)
15. [What to read next?](#s15)

The operational difference between phishing and spear phishing supports different metrics and controls. NIST, PCI DSS, and CIS all require continuous training and the ability to [recognize and report](https://www.whalemate.com/en/resources/blog/nist-cis-measuring-social-engineering/) social engineering, but the evidence does not support measuring clicks alone or treating traditional training as sufficient. To make the right call, a CISO has to separate mass campaigns from targeted attacks, compare results while controlling for lure difficulty, and prioritize credential submission, reports, and response time.

Seen side by side, the sources show something that is not obvious when read separately. The standards describe awareness obligations and evidence requirements, the guidance points to measurement, and the benchmarks and studies make clear that clicks by themselves do not tell the full story about [human risk](https://www.whalemate.com/en/resources/blog/human-risk-management-what-measures/).

| Topic | Attack type | Definition | Objective | Distinctive trait | What is measured | Decision it enables | Source |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Phishing | General family of scams | A technique used to try to obtain sensitive data through a fraudulent request by email or website, and also the use of a spoofed email to collect private information, distribute malware, or commit fraud | Broad audience, usually generic messages | Seeks to persuade a person to hand over sensitive data to an impostor | CISA describes a six-week assessment that measures workforce tendency to click phishing lures. Fortra reports click rate, credential submission rate, and report rate. The NIST Cybersecurity Framework 2.0 Concept Paper gives as examples the number of phishing attempts prevented and 80% of users reporting known attempts | Guide anti-phishing training and awareness and assess effectiveness with more than one metric, not just clicks | NIST, NIST SP 800-177 Rev. 1, CISA, Fortra, NIST Cybersecurity Framework 2.0 Concept Paper |
| Spear phishing | Targeted phishing variant | A highly targeted phishing attack, usually against a specific person or department within an organization, where the adversary knows the victim profile and uses contextual information so the message appears to come from a legitimate source | One person, group, organization, or specific department | Target selection, prior research, and personalization using contextual information or known personal data. ENISA adds frequent use of OSINT | Not defined as a single benchmark in the standards. NIST Phish Scale is designed to score the human difficulty of detecting a phishing email and make simulations comparable across lures. INCIBE indicates follow-up actions if credentials were submitted | Segment by role or criticality and do not compare campaigns of different difficulty without normalizing the lure | NIST, NIST SP 800-177 Rev. 1, ENISA, NIST Phish Scale, INCIBE |
| NIST SP 800-53 Rev. 5 | Does not separate a phishing vs spear phishing requirement, but does mention spear phishing in exercises | Requires security and privacy literacy training for users, managers, senior executives, and contractors. It also requires training to recognize and report potential and actual social engineering and social mining instances | All system users, including managers, senior executives, and contractors | Requires practical exercises that simulate events and incidents, including unannounced social engineering attempts and the impact of opening malicious attachments or activating malicious links through spear phishing | Does not specify a single numeric metric. AT-4 treats training records as separate evidence from the training activity | Separate compliance evidence from real effectiveness and use practical simulations, including spear phishing, not just initial training | NIST SP 800-53 Rev. 5, NIST |
| PCI DSS v4.0 | Phishing and related attacks within awareness, with a separate technical control for phishing | Training must include awareness of threats and vulnerabilities that could affect CDE security, including the literal phrase phishing and related attacks and social engineering | All personnel | PCI DSS v4.0.1 states that security awareness education is an ongoing activity. It also distinguishes requirement 5.4.1 for technical and automated controls to detect and protect personnel against phishing from requirement 12.6.3.1 for training | Not specified as a KPI. It does require a formal program, and the v4.0 change summary says the program should be reviewed and updated at least every 12 months | Do not treat phishing as satisfied by awareness alone or by technology alone. Maintain both fronts separately | PCI DSS v4.0.1, PCI DSS v4.0, PCI Security Standards Council |
| CIS Controls v8.1 | Phishing as an example of social engineering to recognize | Requires establishing and maintaining a security awareness program and training the workforce to recognize social engineering attacks such as phishing, BEC, pretexting, and tailgating | Workforce members | The policy template makes clear that an effective program should not be limited to a generic annual video paired with periodic phishing tests. In addition to annual training, there should be more frequent topical messages and notifications | No numeric KPI specified in the cited control | Avoid minimum-compliance programs based only on an annual course and periodic tests. Sustain more frequent interventions | CIS Controls v8.1, Center for Internet Security |
| Operational metrics observed | Simulated phishing campaigns | Human behavior benchmarks under simulations and response measurement | Recipients of simulation campaigns | Fortra reports 5.42% clicks, 1.99% credential submission, and 10.50% reporting across 13.9 million recipients and 7,504 campaigns. Proofpoint reports a 4.93% average failure rate, 6.59% in attachment-based campaigns, and 2.46% in data-entry campaigns. It also reports that 10% of users were responsible for 100% of clicks within a given wave | Clicks, credential submission, reporting, lure type, and user risk concentration | Prioritize credential submission and reporting, and focus controls on higher-risk groups or users instead of treating click rate as a sufficient indicator | Fortra, Proofpoint |

## Do phishing and spear phishing require the same measurement?

No. NIST defines phishing as the general family of scams and spear phishing as a highly targeted variant against a specific person or department. NIST SP 800-177 Rev. 1 adds that in spear phishing the adversary knows the victim profile and [uses contextual information](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-177r1.pdf). Whalemate's view is that this difference changes measurement: mass campaigns can support aggregated KPIs, while targeted attacks require segmentation by role, exposure, criticality, and degree of personalization.

## What changes when the attack is mass and not targeted?

According to NIST, general phishing usually targets a [broad audience](https://www.cisa.gov/news-events/news/phishing-whats-name) and uses generic messages. CISA describes the Phishing Campaign Assessment as a six-week evaluation that measures workforce tendency to click phishing lures. Whalemate's view is that, in this context, measurement helps show aggregate behavior, but it is still incomplete if it is reduced to clicks and does not include credential submission, reports, and time to report.

## What changes when the attack is spear phishing?

NIST and ENISA agree that spear phishing includes target selection, prior research, and personalization. ENISA adds that this personalization often relies on OSINT. Whalemate's view is that it makes no sense to compare a generic campaign with a targeted one without controlling for the human difficulty of the lure, and that is why NIST Phish Scale becomes not a methodological detail but a condition for interpreting results without self-deception.

## Do the standards call for continuous awareness or is one course enough?

One isolated course is not enough. NIST SP 800-53 Rev. 5, in AT-2, requires security and privacy literacy training as part of initial training and at a frequency defined by the organization, and it also requires training to recognize and report potential and actual instances of social engineering and social mining. PCI DSS v4.0.1, requirement 12.6, states literally that security awareness education is an ongoing activity. Whalemate's view is that compliance requires continuity, not a yearly event.

## Do the standards distinguish awareness from technical controls?

Yes, and that point is often missed in practice. PCI DSS v4.0 distinguishes requirement 5.4.1, which covers technical and automated controls to detect and protect personnel against phishing, from requirement 12.6.3.1, which covers training. NIST SP 800-53 Rev. 5 also separates the training activity from its records, since AT-4 treats training records as evidence distinct from the activity itself. Whalemate's view is that there are three separate planes: training, technology, and documentation.

## Does the evidence support using clicks as the primary KPI?

Not as the only indicator. CISA uses clicks for a specific assessment, but Fortra also reports credential submission and reporting, with 5.42% clicks, 1.99% credential submission, and 10.50% reporting across 13.9 million recipients and 7,504 campaigns. The NIST Cybersecurity Framework 2.0 Concept Paper uses examples such as phishing attempts prevented and users reporting known attempts. Whalemate's view is that the click is an early signal, not a sufficient reading of risk.

## What does practice show about the real risk behind a low click rate?

Proofpoint reports that even best-in-breed organizations still recorded more than 1% clicks in their measurements, so a low rate does not mean zero risk. The same Proofpoint report says that, in one malicious attack measurement, 10% of users were responsible for 100% of the clicks within a given wave, and that 40% of clicks usually come from users who clicked only once. Whalemate's view is that averages can hide risk concentration and critical users.

Whalemate

Want to see Whalemate in your organization?

Book a demo. We will walk through email and QRishing simulations for your team, and what CISO, IT or compliance can decide from there.

[Book a demo](https://www.whalemate.com/en/demo/)

## Does continuous training always work?

Not uniformly. A large-scale experimental study available on arXiv reported an [overall click rate](https://arxiv.org/pdf/2506.19899) of 10.4% and found no statistically significant differences between the control group, the training group, and the training-plus-exercise group in either click rate, with p=0.450, or report rate, with p=0.417. Whalemate's view is that the regulatory obligation to train remains in force, but it does not justify assuming behavioral effectiveness simply because traditional training was delivered.

## So do interactive exercises also fail?

The evidence in the material is mixed, not negative across the board. The study presented at Purdue's CERIAS symposium reported that the interactive group reported phishing [37% more often](https://www.cerias.purdue.edu/symposium/index.php/posters/year/2025/T5I-7DS) than the reference group and 25% more than the traditional training group. The UC San Diego Health study, according to HR Reporter, associated completed interactive training with a 19% reduction in failure rate. A study published by ACM found that delayed training was more effective than immediate training in reducing clicks and other outcomes, with H(1)=8.09 and p\<0.05. Whalemate's view is that what matters less is simply providing training and more is designing the type, timing, and persistence of the intervention.

## Why does lure difficulty matter so much?

Because if difficulty is not controlled, the comparison is misleading. Proofpoint reported clear differences between attachment-based campaigns, with a 6.59% failure rate, and data-entry campaigns, with a 2.46% failure rate, in its published simulation measurements. NIST Phish Scale exists precisely to score the human difficulty of detecting a phishing email and make simulations comparable across lures. Whalemate's view is that an apparent improvement may reflect an easier lure, not a better program.

## What does measuring response time add beyond final outcome?

It adds a critical operational dimension. The experimental study available on arXiv reported a median of 21 minutes to report and that 90% of reports happened within 18.8 hours after delivery. According to the summary published by Swif.ai of Verizon 2025 DBIR data, the median time to click was 21 seconds and the median time to report was 28 minutes. Whalemate's view is that if the click happens in seconds and the report takes tens of minutes, the containment window depends on speeding up human detection and response.

## What forces organizations to separate mass phishing from spear phishing in day-to-day management?

The attack's own nature forces it. NIST defines spear phishing as highly targeted, and ENISA characterizes it as one of the most successful variants against corporate networks. In addition, the joint guidance from CISA, NSA, FBI, and MS-ISAC identifies impersonation of supervisors or trusted colleagues and the use of public tools for spear phishing campaigns. Whalemate's view is that exposed roles such as finance, procurement, HR, and executives should not be measured or trained the same way as the general workforce.

## What does this mean for compliance in LATAM?

It means that keeping course certificates does not exhaust useful evidence. NIST SP 800-53 Rev. 5 treats training records as a separate artifact from the training activity, and PCI DSS v4.0 requires a formal awareness program while keeping technical controls for phishing separate. Brazil's Federal Court of Accounts includes administrative controls, technical controls, awareness, and phishing simulations as defense components, and Brazil's ANPD identifies phishing as a common incident. Whalemate's view is that compliance needs to show program, updates, evidence, and coordination with operational controls.

## Operational consequence

For a CISO, IT, or compliance team in LATAM, the practical decision is to redesign measurement and evidence across three separate planes. First, separate mass phishing from targeted spear phishing, and in the latter segment by role, asset exposure, criticality, and level of personalization. Second, do not use click rate as the only KPI: according to Fortra, it is worth tracking at least clicks, credential submission, and reports, and adding time to report based on the arXiv evidence and Swif.ai's summary of Verizon 2025 DBIR data. Third, compare campaigns only if lure difficulty is comparable, for example with NIST Phish Scale, and distinguish between documentary evidence of training, anti-phishing technical controls, and observed behavioral effectiveness. If the organization only keeps annual course records, it may have evidence of training, but it can still remain blind to users who submit credentials, do not report, or take too long to do so.

## What to read next?

- [Awareness on the platform](https://www.whalemate.com/en/platform/advanced-simulations/)
- [NIST and CISA on social engineering](https://www.whalemate.com/en/resources/blog/nist-cisa-social-engineering/)
- [PCI DSS: Phishing vs. Spam in LATAM](https://www.whalemate.com/en/resources/blog/pci-dss-phishing-vs-spam/)

[See the full topic guide](https://www.whalemate.com/en/platform/advanced-simulations/)

Questions

## Frequently asked questions

**Are phishing and spear phishing the same for measuring risk?**

No. According to NIST, spear phishing is a highly targeted variant of general phishing. That changes measurement: in mass campaigns you can look at aggregate behavior, but in spear phishing you need to segment by role, criticality, and personalization. If you compare both scenarios with the same KPI and without controlling for difficulty, the result can lead to wrong decisions.

**What minimum metrics should a serious program track?**

According to Fortra, useful metrics include clicks, credential submission, and reporting. The material also adds time to report, based on the study on arXiv and Swif.ai's summary of Verizon 2025 DBIR data. For spear phishing, it is also advisable to record the affected segment, the level of personalization, and lure difficulty with a comparable method, such as NIST Phish Scale.

**Does an annual course work for compliance and for reducing risk?**

It works as part of compliance, but by itself it does not prove risk reduction. NIST SP 800-53 Rev. 5 and PCI DSS require continuity, and NIST separates training evidence from its actual effectiveness. In addition, the study on arXiv did not find significant improvements with traditional training, so completing courses is not enough to infer behavioral change.

**Why is it not advisable to use only the click rate?**

Because the click does not capture all the risk. Fortra shows that it also matters how many users submit credentials and how many report. Proofpoint adds that a low rate does not equal zero risk and that risk can be concentrated in a few users. A program that only lowers clicks, but does not improve reporting or reduce credential submission, still leaves relevant exposure.

**What decision does separating phishing from spear phishing enable?**

It enables better decisions about where to intervene. If the problem is in mass campaigns, it may make sense to adjust general awareness and reporting mechanisms. If the problem appears in spear phishing, the priority shifts to exposed roles, more contextualized simulations, difficulty control, and rapid response to credential submission. That separation avoids treating all human risk as if it were homogeneous.

Whalemate

Is this risk in your program?

If this article describes something you already faced — or that the board is asking you to explain — book a demo.

[Book a demo](https://www.whalemate.com/en/demo/)

## Would you like to go deeper on this topic?

Open this article directly in Claude or ChatGPT — ask questions, get a summary, or explore related ideas.

- [Open with Claude](https://claude.ai/new?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CPhishing%20vs%20spear%20phishing%3A%20what%20CISOs%20need%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.)
- [Open with ChatGPT](https://chatgpt.com/?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CPhishing%20vs%20spear%20phishing%3A%20what%20CISOs%20need%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.)

In this article

1. [Do phishing and spear phishing require the same measurement?](#s1)
2. [What changes when the attack is mass and not targeted?](#s2)
3. [What changes when the attack is spear phishing?](#s3)
4. [Do the standards call for continuous awareness or is one course enough?](#s4)
5. [Do the standards distinguish awareness from technical controls?](#s5)
6. [Does the evidence support using clicks as the primary KPI?](#s6)
7. [What does practice show about the real risk behind a low click rate?](#s7)
8. [Does continuous training always work?](#s8)
9. [So do interactive exercises also fail?](#s9)
10. [Why does lure difficulty matter so much?](#s10)
11. [What does measuring response time add beyond final outcome?](#s11)
12. [What forces organizations to separate mass phishing from spear phishing in day-to-day management?](#s12)
13. [What does this mean for compliance in LATAM?](#s13)
14. [Operational consequence](#s14)
15. [What to read next?](#s15)

Whalemate

Is this risk in your program?

[Book a demo](https://www.whalemate.com/en/demo/)

## Related articles

[!\[Awareness campaigns: what they require\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/awareness-campaigns-what-they-require.webp)](https://www.whalemate.com/en/resources/blog/awareness-campaigns-what-they-require/)

Awareness

Oct 30, 2026
By Federico Hombre

### Awareness campaigns: what they require

ISO, PCI DSS, CIS, NIST, ENISA, and California do not ask for the same thing. The comparison shows what to measure

Read more

[!\[LATAM Awareness Platforms: What to Evaluate\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/latam-awareness-platforms-what-evaluate.webp)](https://www.whalemate.com/en/resources/blog/latam-awareness-platforms-what-evaluate/)

Awareness

Oct 29, 2026
By Federico Hombre

### LATAM Awareness Platforms: What to Evaluate

For CISOs, IT, and compliance teams, an awareness platform should measure, segment, and audit behavior, not just deliver courses.

Read more

[!\[PCI, CISA and NIST on phishing\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/pci-cisa-nist-phishing.webp)](https://www.whalemate.com/en/resources/blog/pci-cisa-nist-phishing/)

Awareness

Oct 28, 2026
By Federico Hombre

### PCI, CISA and NIST on phishing

PCI DSS, NIST, CISA and CTIR show phishing and vishing are not managed the same way. Metrics, controls and compliance decisions change.

Read more

[See all articles](https://www.whalemate.com/en/resources/blog/)