For CISOs, IT teams, and compliance leaders in LATAM, security awareness training is no longer an attendance requirement. It becomes a human risk program. Evidence from NIST, academic studies, and industry reports shows that a one-time annual course measures compliance, but does not reliably change clicking, reporting, or retention. The right approach is to operate with behavior metrics and continuous reinforcement. According to KnowBe4, the 2026 Phishing by Industry Benchmarking Report analyzed 42 million phishing simulations, 14.8 million users, and 64,000 organizations worldwide.
Before looking at each source separately, the comparison brings together something none of them provide in full: the regulatory framework, the empirical evidence, and the operational consequence. That makes it clear that the value is not in finishing a course, but in sustaining learning, simulation, and measurement by cohort and role. According to KnowBe4, the global average Phish-prone Percentage (PPP) was 33.2% before security awareness training, and dropped to 20.1% after 90 days of security awareness training.
Human element present in 62% of breaches, social engineering in 16%
Prioritize human behavior metrics and social engineering controls
HIPAA Journal
90 days and 12 months of continuous training
Phish-prone Percentage
PPP fell from 32.4% to 17.6% at 90 days and to 5% after one year
Use continuous campaigns and compare PPP by segment
What does NIST say about the program, and what changes with the revision?
NIST SP 800-50, Building an Information Technology Security Awareness and Training Program, organizes the program into four steps: design, development, implementation, and post-implementation. It also separates awareness from training, where awareness is making security matter and training is teaching specific tasks. That distinction matters because it prevents everything from being measured with one variable, course completion.
The 2024 revision, NIST SP 800-50 Revision 1, shifts the focus toward a continuous learning program for the entire workforce, based on roles. Whalemate reads this straightforwardly: the standard no longer pushes an annual-event model, but a sustained and segmented approach. For a CISO, that enables program design, not just a training calendar.
Why is the annual course not enough in practice?
The UC San Diego study evaluated 10 types of phishing emails over eight months and found that embedded phishing training reduced the probability of clicking links by only 2%. The study’s own conclusion is that these programs are unlikely to offer significant practical value in reducing phishing risk. That creates an uncomfortable tension for compliance, because the course can exist and still not change behavior.
Importance of Cybersecurity Awareness in an Employee Life Cycle by Mr. Monil Adhikari, Growth Sellers HR Solution and more. Ver el original
Whalemate reads this as a problem of timing and design. If the intervention happens once a year, but the risk appears every day, the control expires before it matures. That is why the useful metric is not attendance, but behavior change across simulations and reinforcements.
What does the evidence show about awareness, not just training?
The Frontiers in Computer Science study found that Information Security Training has a positive effect on Security Awareness, but awareness is the strongest predictor of both phishing mitigation and reporting. In other words, training does not directly drive the most valuable behavior change; it does so through the level of awareness it builds.
The Best Free One Hour Security Awareness Training Ever, LSNTAP Videos. Ver el original
The operational tension here is not theoretical. If the indicator that best explains behavior is awareness, then a dashboard that only counts completed courses is watching the wrong variable. For CISOs and compliance teams, the value is in measuring awareness and reporting rates as intermediate signals, because that is where you can see whether the intervention is working.
What happens when the program is continuous and practice-based?
The summary reported by HIPAA Journal shows that the average Phish-prone Percentage dropped from 32.4% to 17.6% after 90 days and to 5% after one year of continuous training. In healthcare and pharmaceuticals, the PPP also reached 4.1%, 5.1%, and 5.9% depending on organization size. The signal is clear: when there is continuity, practice, and reinforcement, the indicator that matters does move. According to KnowBe4, that same global pattern brought the Phish-prone Percentage (PPP) to 4.2% after one year of continuous security awareness training, and organizations reduced phishing susceptibility by 40% in the first 90 days and by 79% after one year of continuous security awareness training.
This does not contradict UC San Diego. It complements it. The difference does not seem to be whether training exists, but how it is structured. Continuity, repetition, and cohort tracking change the outcome where an isolated course does not.
What do Verizon and SANS say about the real priority of human risk?
The Verizon DBIR 2026 indicates that the human element appears in 62% of breaches and that social engineering accounts for 16% of patterns. Social engineering, including phishing, smishing, and vishing, remains the main human risk. Both sources point to the same reading: the problem is neither marginal nor episodic.
The Best Free One Hour Security Awareness Training Ever, LSNTAP Videos. Ver el original
For a CISO in LATAM, the implication is that training stops being a compliance checkbox and becomes a first-line control against social engineering. If attackers get in through people, the organization needs to see behavior, not just completion certificates.
What breaks when you only look at course completion?
The main failure is that completion does not predict clicking, reporting, or retention. The ERIC study reports that SETA programs can reduce phishing susceptibility by 50% in an initial experiment, but knowledge gain fades in about a month. The USENIX / ACM paper adds that improvements in email identification disappear after six months and that semiannual reminders and formats with videos and interactive examples are needed.
Whalemate interprets that combination as evidence of fragile retention. If knowledge fades quickly, the organization has to measure decay, not a static snapshot. That is where periodic reinforcement, simulations, and role-based segmentation become program decisions rather than optional extras.
What decision does this enable for a CISO, IT team, or compliance leader in LATAM?
The enabled decision is to replace the annual-course model with a human risk program built on operational KPIs. That means measuring click-through rates in simulations, incident reporting, awareness, knowledge retention, and PPP by cohort or role. It also means using the score to prioritize interventions, not to discipline people, because the value is in identifying where to strengthen technical controls, communications, and training.
For IT and compliance, this changes the conversation with audit and leadership. Instead of proving that training happened, the organization proves whether susceptibility dropped, reporting increased, and human risk moved over time. That enables more concrete decisions about investment, prioritization, and coverage.
A security awareness platform in LATAM is a continuous program for the entire workforce, based on roles and focused on measuring behavior, not just completion. In this article, the right logic is to move from the isolated annual course to simulation, reinforcement, and cohort tracking.
NIST SP 800-50 separates awareness from training, and the 2024 revision pushes a sustained learning program. In addition, the cited studies show that clicking, reporting, and phishing susceptibility change better when measurement follows behavior over time.
Which platform should you choose to simulate vishing in LATAM?
If the question is which platform to use to simulate vishing in a Latin American company, the decision should not come only from price or the number of courses. First, you should validate that the tool measures behavior, reporting, and cohort-level change, because that is the type of signal this article already shows as useful.
The right choice is the one that supports continuous simulation and reinforcement, with comparable metrics by segment and not just training completion. In this article, the evidence points to awareness, reporting, and behavior, not just attendance in an annual course.
It serves as a compliance baseline and as a starting point, but it is not enough as an effective control if used on its own. UC San Diego showed a minimal impact on clicks, and other sources show that the improvement fades over time. The value appears when training is integrated with simulations, reinforcement, and follow-up through behavior metrics.
What should a CISO measure instead of just completion?
They should look at click rate in simulations, reporting rate, awareness level, knowledge retention, and Phish-prone Percentage by cohorts or roles. Those metrics show whether the program changes behavior and whether risk decreases over time. Completion alone does not distinguish between a user who learned and one who only clicked to close the course.
Why does NIST matter if it does not include an effectiveness benchmark?
Because NIST provides the operating framework. SP 800-50 separates awareness from training and organizes the program into stages, while the 2024 revision pushes toward continuous and role-based learning. That allows the CISO to design the program with a management logic, not as an isolated event.
How does this translate to compliance in LATAM?
Compliance can stop asking for attendance evidence as the main proof and start asking for effectiveness evidence. That includes campaigns, simulation results, reporting trends, and traceability by roles. The focus shifts from proving that training happened to proving that human risk decreased or, at least, was measured continuously.
What does a human risk score like Whalemate’s add?
It brings together signals, simulations, courses, reporting, and behavior into a single view to prioritize interventions. It does not replace the program, it makes it operable. For CISO and IT, that helps decide where to reinforce and whom to train again, without confusing prioritization with punishment.
Would you like to go deeper on this topic?
Open this article directly in Claude or ChatGPT —
ask questions, get a summary, or explore related ideas.
By 
