Security Awareness Training Features

Training (Q4 2022 Features)

• Award-winning, on-demand, engaging, interactive browser-based training
• The world's largest library of well over 1300 security awareness training content items; including interactive modules, videos, games, posters and newsletters - with the Diamond level you get monthly, new fresh content
• Translated phishing and training content in 34+ languages across phishing
  and training content, with support for localized learner experience in select languages.
• NEW! The KnowBe4 Learner App enables your users to complete their security awareness and compliance training conveniently from their smartphones or tablets. With 24/7 access to assigned training modules, your users can complete training and quizzes when it’s convenient for them. The KnowBe4 Learner App is available today on iOS and Android, and free to all KnowBe4 customers with a KnowBe4 training platform subscription. 
• AI-Recommended Training powered by machine learning offers Admins informed training suggestions based on the simulated phishing test results of your users. Personalized to your overall organization, training modules are presented in the KnowBe4 ModStore training library. You can select these recommendations to add to your training campaigns to help reduce your users’ click rates over time.
• AI-Recommended Optional Learning The Learner Experience user interface offers optional gamification, with leaderboards and badges, to incentivize and motivate users to take their assigned training, and now an AI-driven "recommended" Library with training content just for that user. (Diamond only)
• Optional Learning enables you to offer your users additional training content from your KnowBe4 ModStore. Simply create specific training campaigns with the optional training content you would like to make available for your users to self-select.
• Brandable Content feature enables you to add branded custom content to the beginning and end of select KnowBe4 training modules.
• Upload Your Own Content Use KnowBe4 as your LMS. You now have the option to upload your own SCORM-compliant training and video content in any language you choose, directly into your KnowBe4 account - at no extra cost!
• Localized training interface option for your users! Currently available in
  30+ local languages, your users can choose the language they are most comfortable with, helping deliver a more immersive training experience. The platform has language settings for Training, Phishing and the Admin Console.
• Create multiple training campaigns as ongoing or with a completion date
• Mobile-First Modules are optimized to be viewed and interacted with on a mobile device. These modules are no longer than five minutes and are designed to engage users; whether while they’re on the go or located in low-bandwidth regions. Mobile-First Modules are brandable and SCORM-Compliant, so they can be downloaded for use with your own LMS
• Three Industry Benchmarking Features: Phishing, Knowledge and Culture assessments enable you to compare your organization with your peers. You have had the phish-prone percentage benchmark for a number of years, but we have added Knowledge and Culture Assessments that help you identify users that have a higher proficiency in security in not only knowing the right thing to do but also actually doing the right thing as part of the security culture you’re trying to achieve in your organization. You can now compare your organization's Security Awareness Proficiency Assessment (SAPA) and Security Culture Survey (SCS) scores with other companies in your industry with SAPA and SCS industry benchmarks.
• NEW ADD-ON: Compliance Plus with more than 400 pieces of brand new compliance training content.
• Automate enrollment and follow-up emails to “nudge” users
• Allows you to create an effective “Human Firewall” as your last line of defense
• Hosted in our Cloud LMS, run the course in your own LMS, or delivered as a Managed Service
• Hints & Tips Security Awareness emails for compliance
• Point-of-failure training auto-enrollment options
• Within one account, you can have multiple allowed domains (e.g. com, net, .org) and users can sign up with any of the domains associated to an account
• Industry's largest full-time content development staff: 100+ people
• Visible training results: Phish-prone™ percentage for whole organization graphed over time in your console for reporting
• Enhanced Training Campaigns with "relative enrollment duration" feature
• Certificate printing where users can view/download/print their own certificates after completing a course
• Extend training deadlines for overdue users
• Managed Training Campaign feature simplifies and centralizes training campaign management across multiple KnowBe4 accounts from a single interface, especially useful for Managed Service Providers. 

Simulated Phishing Attacks

The results of the 2023 KnowBe4 Phishing by Industry Benchmarking Report clearly show where organizations’ Phish-proneTM Percentages started and where they ended up after at least 12 months of regular testing and security awareness training. The study analyzed a data set that included 12.5 million users across 35,681 KnowBe4 customers with over 32.1 million simulated phishing security tests across 19 different industries.

The overall industry initial Phish-prone Percentage benchmark turned out to be a troubling 33.2%. Fortunately, the data showed that this 33.2% can be brought down to just 18.5% within 90 days of deploying new-school security awareness training. The one-year results show that by following these best practices, the final Phish-prone Percentage can be minimized to 5.4% on average. Read the full report.
 Read the full report.

Phishing

• The AI-Driven Phishing feature helps you deliver a personalized simulated phishing experience to every single user. The KnowBe4 phishing platform leverages machine learning to automatically choose the best phishing security test template for each user based on their individual phishing and training performance metrics.
• Virtual Risk Officer (VRO) feature, provides insight and actionable metrics that will allow you to understand the attack surface of your organization, and learn what users might be more vulnerable to a phishing attack. VRO provides dynamic risk scores, assigned to users, groups, and your organization as a whole, which enable you to make data-driven decisions when it comes to your security awareness plan and understand what users are the most susceptible to a phishing attack. You can even use Smart Group conditional statements that will allow selection based on individual risk scores. See a quick video overview of VRO on our support site.
• Industry Benchmarking feature lets you compare your organization's Phish-prone percentage™ with other same-size organizations in your space
• Initial free Phish-prone percentage test for 100 users (more on request)
• Year-round all-you-can-eat simulated phishing attacks
• Unlimited yearly use of all phishing templates
• We create regular "Current Events" templates you can send to users
• Set-it-and-forget-it scheduling of phishing campaigns
• Full library with 15,000+ successful phishing templates
• Easily create your own templates
• Community Templates: share and use other people’s phishing templates
• Customizable phishing attacks
• Customizable landing pages
• Phishing Security Test email reports sent to admin at the end of a phishing campaign
• “Anti-prairie dog” campaigns which send random templates at random times
• Ability to skip weekends in campaigns and assign time zone and working hours
• New Office templates with macros to simulate ransomware attacks
• GEO-location - See where your simulated phishing attack failures are on a map, with drilldown capability and CSV-export options.
• Ability to create anti-fraud templates that emulate spoofed CEO Fraud attacks
• Automatic "Scam Of The Week" Campaign - sent to all employees
• Anti-fraud "Phishing Reply Tracking" allows you to track if a user replies to a simulated phishing email and can capture the information sent in the reply

• Social Engineering Indicators™ patented technology turns every simulated phishing email into a tool you can use to dynamically train employees by instantly showing them the hidden red flags they missed within that email
• QR Code Phishing to test your users with simulated phishing attacks that use QR (quick response) codes as an attack vector
• USB Drive Test™ allows you to test your user’s reactions to unknown USBs they find
• Targeted spear-phishing campaigns, replace fields with personalized data
• “Click Only” and traditional Data Entry of sensitive information (credentials)
• Customized scenarios based on public and/or personal information
• Tests for opening MS Office Attachments: Word, Excel, PPT, and PDF (also zipped) and also HTML attachments
• Variable phishing campaign length, max six months
• Summary Information about all phishing campaigns
• Free Phishing Attack Surface - analysis of emails belonging to your domain
• Phish-Prone Percentage Comparison for different user groups
• Program trend reporting
• Customizable “hover-links” when a user "mouse-overs"
• Multi-domain accounts for admins or MSPs who manage multiple organizations (no extra charge)
• Top 10 Criminal Phishing Emails of the week - defanged and ready to send to employees
• Managed Phishing Campaign feature simplifies and centralizes phishing campaign management across multiple KnowBe4 accounts from a single interface, especially useful for Managed Service Providers. 

Reporting

• Advanced Reporting provides actionable metrics and insight into the effectiveness of your security awareness training program. You can generate over 60 different styles of reports that will help you understand where improvements need to be made to improve the strength of your human firewall. Using machine learning technology, Advanced Reporting will instantly create reports based on your spoken command or typing relevant keywords into the Find Report search function. You can now save, schedule and automatically send reports on a recurring basis.
• The Executive Reports feature allows you to create, tailor and deliver advanced executive-level reports to help your organization make efficient data-driven decisions regarding your security program.
• Smart Groups put your phishing, training and reporting on autopilot.  With the powerful Smart Groups feature, you can use each employees’ behavior and user attributes to tailor phishing campaigns, training assignments, remedial learning and reporting. Best of all, Smart Groups is a powerful ad-hoc, real-time query tool that you use to get detailed reporting for management.
• Reporting APIs enable you to customize and obtain reports by integrating with other business systems that present data from your KnowBe4 Console. Here is the documentation.
• The User Event API allows you to easily integrate data from your users' security-related events or training activities that happen in other third-party platforms and push them into your KnowBe4 console. 
• Training reports for all users or a specific group (who started, completed, started but never finished) 
• Details on enrollment %, course started %, incomplete %, completed course, acknowledged security policy
• Filter campaigns on recipient, delivered, opened, clicked, attachment, data entered, bounced, in CSV
• Specify user needs to “Read and Attest” Security Policy for compliance
• Individual user "report cards" with their “open and click” history 
• Reports on browser / device used to open a phishing email and vulnerable browser plugins the user has installed
• Top 50 clickers report
• Print to PDF so reports can be sent to management
• Personal timeline overview for every individual user
• Phishing Reply Tracking reports with who answered and what they said
• Roll-up Reporting makes it easy to select reports and compare results in aggregate across managed KnowBe4 accounts or multi-location offices

Additional Features

• SecurityCoach is the first real-time security coaching product created to help IT and Security Operations teams further protect your organization’s largest attack surface — your employees. SecurityCoach is an add-on product to the KnowBe4 training platform that integrates with your existing security stack to deliver real-time coaching in response to risky end-user security behavior.
  
• PhishER is an add-on product that helps your team prioritize, triage and manage potentially malicious messages reported by your users. Identify and respond to email threats fast! PhishML, a new PhishER machine-learning module analyzes every message coming into the PhishER platform - giving you info to make your prioritization process easier, faster, and more accurate. PhishER now has a new feature called PhishRIP, the new email quarantine option that integrates with Microsoft 365 and Google Workspace to help you Remove, Inoculate, and Protect your organization against email threats so you can shut down active phishing attacks fast. 
• NEW! We are excited to announce the availability of PhishFlip™ as part of the PhishER product to all PhishER customers. The bad guys are always coming up with new, devious phishing techniques to trick your users. PhishFlip is a new PhishER feature that allows you to respond in real time and turn the tables on the bad guys. With PhishFlip, you can now immediately ‘flip’ a dangerous attack into an instant real-world training opportunity for your users. More.
• Automated Security Awareness Program (ASAP), allows you to create a customized Security Awareness Program for your organization that will help you to implement all the steps needed to create a fully mature training program in just a few minutes!
• Security Roles allows you to assign granular access control for users and groups within the KnowBe4, combined with delegated admin permissions - Here is the Support Article 
• Achieved FedRAMP Authorization from the U.S. federal government
• Automated user provisioning via KnowBe4 Active Directory Integration (datasheet) to populate and maintain your users within your KnowBe4 Console.
• Password-Less Logins
• Anonymous Console Data for European Data Protection compliance
• Upload users as flat text, or as CSV with Groups functionality
• Full time dedicated U.S.- and U.K.-based support through phone and email
• 2-Factor Authentication option for both users and admins
• Full and partially Managed Service options, we can run this program for you
• Phish Alert Button gives your users a way to report simulated and non-simulated phishing attacks, also available for Outlook Mobile 
• Bulk delete users using a CSV file (not needed with AD integration)
• Training and phishing history are archived even when users are deleted
• Supports single sign-on using Security Assertion Markup Language 2.0 SAML
• Support for OKTA identity management
• Support for Windows Azure Active Directory
• NEW! Diamond Feature. PasswordIQ continuously monitors your organization for any detected password vulnerabilities in your Active Directory. It checks to see if your users are currently using passwords that are shared, weak, or show up in publicly available data breaches so you can establish a baseline of password issues and better manage the ongoing problem of password risk across your users.