Articles on HRM
What we publish on HRM for CISOs, IT and compliance teams in LATAM.
Articles on Human Risk Management: the practice of measuring human cyber risk as a managed program, not a series of courses. We cover what sets HRM apart from traditional security awareness training, how a risk score gets built to be comparable across people and teams, and which decisions —simulation, content, channel, difficulty— get automated once the program stops being measured by completion rate. It's the reference category for understanding the full framework before drilling into a specific topic like PCI DSS, analytics or audit.

Fortinet awareness metrics go beyond completion
NIST, Fortinet, and the 2025 survey show a gap: behavior and event-based remediation can be measured, but many companies still track activity.
Read more
LATAM human risk management company metrics
For CISOs, IT, and compliance teams in LATAM, HRM means tracking continuous behavior, turning it into risk, and keeping evidence for ISO 27001 and PCI DSS.
Read more
ISO 27001 and human risk management platforms
ISO 27001 requires continuous, effective programs. HRM turns them into behavior metrics, risk prioritization, and evidence for leadership.
Read more
Smishing and vishing under PCI DSS 12.6
SMS and voice are not the same for CISOs and compliance. PCI DSS 12.6 requires formal awareness and separate measurement of both channels.
Read more
Human Risk Management: What It Measures
HRM combines continuous awareness standards with behavior metrics to prioritize interventions, reallocate resources, and report human risk.
Read more
PCI DSS 12.6: Vishing and Smishing Scope
Vishing and smishing are no longer just phishing variants. Under PCI DSS 12.6, they require a formal program, channel metrics, and steady improvement.
Read more
PCI DSS 12.6 Requires Vishing Coverage
Vishing and smishing are voice and SMS phishing. Under PCI DSS 12.6, measuring only email or course completion leaves a compliance gap.
Read more
APWG and PCI DSS: Smishing Is Rising
Smishing is growing on mobile channels while PCI DSS v4.0 requires annual awareness training and explicit phishing and social engineering content.
Read more
Security awareness training: measure clicks, not courses
NIST, UC San Diego, Frontiers, Verizon and SANS agree that annual training alone is not enough. The useful metric is sustained behavior.
Read more
Whalemate: Human Risk Management platform
Whalemate frames security awareness as Human Risk Management, not a standalone course. CIS, NIST, SANS, and recent studies show mixed results.
Read more