ABANCA: One Indicator to Govern Them All in Human Cyber Risk Management

The challenge: turning every employee into part of the defense

For financial organizations, CISOs face the growing challenge of engaging every employee as part of a united defense against increasingly frequent and sophisticated cyberattacks.

Attackers constantly rely on human error as an entry vector, using it as a shortcut to bypass advanced technical defenses. For ABANCA, a bank with critical operations and strict regulatory requirements, the challenge was to implement a comprehensive awareness and training strategy that could scale across the entire workforce.

The solution: segmented awareness and continuous measurement

In collaboration with Áudea and Kymatio®, ABANCA launched a Security Awareness Office built on three key domains:

1. Increase employee knowledge
   Provide theoretical understanding of attack types, defensive strategies, and available support resources.
2. Train secure behavior
   Expose employees to practical situations and run realistic attack simulations to measure and improve their responses.
3. Boost commitment to cybersecurity
   Reinforce motivation with personalized learning paths that link employees’ roles to the bank’s cybersecurity mission.

To achieve this, ABANCA leverages Kymatio’s AI-powered platform, which enables:

• Designing tailored awareness programs.
• Continuously measuring both knowledge and behavioral change.
• Running targeted phishing simulations and awareness campaigns with full granularity.

“The use of Kymatio’s AI-driven tool is indispensable, as it is the only way to achieve the level of granularity needed in training, with the ability to continuously measure both knowledge and behavioral change.”
— Carlos Pérez Saldaña, CISO, ABANCA

The impact: a strategic Security Awareness Office

ABANCA’s initiative has delivered measurable impact by:

• Orchestrating multiple services and technologies into an integrated, synergistic approach.
• Engaging HR, Training, Change Management, and Communication departments in a coordinated effort.
• Establishing relevant indicators to measure the effectiveness of awareness activities and their evolution over time.
• Implementing a comprehensive dashboard with specialized views for different stakeholders.
• Moving from theory to practice with a continuous improvement model for human cyber risk management.

Results at a glance

• 90% accuracy in personalized training thanks to AI-driven paths.
• 75% improvement in response to simulated attacks within the first year.
• 100% alignment with financial sector compliance requirements (GDPR, ISO, DORA, NIST, etc.).