KnowBe4

• Defend deploys as a gateway in front of Microsoft 365 or as a layer on the Microsoft Graph API and sends its detections into Microsoft Defender XDR and Sentinel, and Prevent authorises through a single Microsoft 365 grant, so the email half of the platform depends on interfaces Microsoft controls. The reviewed sources do not establish what Microsoft includes in its own subscriptions.
• Every efficacy figure KnowBe4 publishes, from the fall in phish-prone percentage to the share of reported mail categorised without a human, is published by KnowBe4. The sources reviewed for the 2026-09-04 profile carry no independent measurement of what the training changes.
• The entity that acquired KnowBe4 entered a $1 billion term loan facility and a $125 million revolving facility on the closing date in February 2023. The last cash figure on the public record is $30.5 million of free cash flow in the quarter ending September 2022, and no reviewed source reports what the business has generated since.
• Dollar-based net retention was 108.4 percent in 2021 by the company's own measure, which is modest expansion inside the base it already had. The reviewed sources do not establish what that rate is now, after the acquisition of the Egress email security business.
• Agent Risk Manager, the AI agent governance line KnowBe4's own history page dates to April 2026, is described on its product page as a technical preview asking for early adopters. The reviewed sources record no generally available AI agent security product.

KnowBe4 sells against the employee who clicks. Its 10-K for 2021 frames social engineering as a risk aimed at the people in an organisation rather than at its infrastructure, and argues that years of spending on infrastructure-centric tools have not stopped breaches from being reported with increasing frequency. The buyer is the security team that owns what is left over.

The scale of that pain is stated by KnowBe4 rather than measured independently in the reviewed sources. Its training page carries figures for how much training is forgotten, what share of breaches involve employees, and what share of phishing is now written with AI. Each is credited either to KnowBe4's own research or to a third-party report the reviewed sources do not include.

The company's own 2024 hiring incident is the most concrete instance of the problem in this record, and the account of it is KnowBe4's own. CyberScoop reported that the company disclosed in a blog post that a remote software engineer it had hired for its internal IT team was a persona run by a North Korean threat actor, who cleared background checks, verified references and four video interviews on a stolen US identity and a photograph altered with AI. KnowBe4 said no data was lost or exfiltrated, and the reviewed sources carry no independent account of what the operative reached. [s13, s5, s21]

The platform is four buying decisions. Security Awareness Training pairs a content library with simulated phishing and a per-employee risk score that KnowBe4 says is computed from 316 indicators. Defend inspects inbound mail and Microsoft Teams. Prevent inspects outbound mail. PhishER Plus handles what users report.

The deployment detail is specific. Defend runs either as an inline SMTP gateway or as a post-delivery layer on the Microsoft Graph API, starts in a report-only mode before an administrator turns on blocking, and sends its detections into Microsoft Defender XDR and Sentinel. Prevent authorises through a single Microsoft 365 grant and ingests twelve months of historical email so it can learn who each sender normally writes to.

PhishER Plus closes the reporting loop. It categorises reported mail, blocks matching patterns across the tenant, pulls similar messages out of other inboxes, and turns a real attack into a template for the next simulation. KnowBe4 says it draws on more than 13 million users worldwide and a blocklist built from what they report.

Every efficacy figure attached to all of this is published by KnowBe4. The company says its training takes an organisation from an average phish-prone percentage of 33.1 to 4.1 within a year, that PhishER Plus categorises 90 percent of reported mail without a human, and that its return in year one is 650 percent. The sources reviewed for the 2026-09-04 profile carry no independent check of any of them. [s4, s5, s6, s7, s8]

KnowBe4's own filing named its competition. The 10-K for 2021 says that Proofpoint, Mimecast and Cofense are larger enterprise providers that address human risk inside an offering tied to other products rather than as a singular focus. It was filed in 2022, when KnowBe4 sold training and simulation, and before it acquired an email security business.

The company then bought the other half. A SecurityWeek article from April 2024 states that KnowBe4 agreed to acquire Egress, a London cloud email security business that had raised $48 million, on terms neither side disclosed. The same article records that the plan was to combine Egress email security technology with KnowBe4's training and simulated phishing products. That added an email security business to the training and simulation products the filing had described.

Its category label and its positioning have separated. Articles SecurityWeek and CyberScoop published in 2024 still describe it as a security awareness training company, and its homepage now leads with securing a workforce of people and AI agents. The two halves meet on Microsoft's rails, where the product pages describe Defend as a partner in the Microsoft Defender ecosystem for integrated cloud email security. [s13, s20, s18, s21, s1, s6]

The traction record rests on regulatory filings to a point and on the company's own statements after it. The 10-K for 2021 recorded 47,174 customers, up from 36,753 a year earlier, carrying $285.4 million of annual recurring revenue. The last quarter KnowBe4 reported as a public company, ending September 2022, recorded more than 54,200 customers and $347.2 million of annual recurring revenue growing 32.4 percent.

Everything after February 2023 rests on the company's own count. KnowBe4 says today that it serves 70,000 organisations and that one in three full-time United States workers has been trained by it. No source in the reviewed record outside the company checks either figure.

Expansion inside the existing base was modest in the years the filings cover. The 10-K put the dollar- based net retention rate at 108.4 percent for 2021 and at 102.8 percent for 2020, and recorded that 22.1 percent of customers subscribed to more than one product. Revenue over 2021 grew 40.8 percent. Whether the email security lines acquired since have moved either number is not established in the reviewed sources. [s13, s14, s1]

Stu Sjouwerman started KnowBe4 in August 2010, after co-founding Sunbelt Software, which GFI Software acquired earlier that year. He took the company public in 2021 and agreed its sale to Vista Equity Partners in 2022. CRN Australia records that he led it through multiple venture rounds, several acquisitions and a public offering.

Bryan Palma has run the company since May 2025, with Sjouwerman moving to executive chairman. CRN Australia records that Palma was previously chief executive of Trellix, the company formed from the merger of FireEye and McAfee Enterprise, and before that held roles at Cisco, Boeing, EDS, PepsiCo and the US Secret Service.

Below those two the bench is published but thinly corroborated. KnowBe4's leadership page names a full executive team including a chief product officer, a chief technology officer, a chief scientist and a chief information security officer. Independent detail in the reviewed sources reaches Palma, Sjouwerman and the chief information security officer, whom a CyberScoop article quotes.

Kevin Mitnick appears in the company's history. KnowBe4's own timeline records that he joined in 2011 as chief hacking officer and part owner, and the 10-K's platform description still carried his name on the training product a decade later. [s2, s22, s3, s13, s15]

KnowBe4 publishes a long list of security credentials. Its security statement records a FedRAMP Moderate authorisation to operate for the training and PhishER platform held since 14 November 2023, SOC 2 Type 2 across all products covering all five trust services criteria, and ISO 27001, 27701, 27017, 27018 and 42001 certifications.

Two of those reach past the usual enterprise set. The 42001 certification covers AI management systems rather than information security, and the same page records UK Cyber Essentials certification and an accreditation from ACN, the Italian national cybersecurity agency, for the training and PhishER products.

Its own client software has been on the receiving end. The National Vulnerability Database records CVE-2024-29209, a flaw scored 6.0 in the update mechanism of KnowBe4's Phish Alert Button for Outlook that allowed remote code execution on a host, found by Ceri Coburn at Pen Test Partners. The remediation note on that record says automated updates would be pushed and that users of affected versions should verify the latest version is applied. [s11, s23]

Add analyzed competitors to compare them side by side with KnowBe4.

The published price list reaches down to small buyers. KnowBe4 publishes seat prices in bands beginning at 25 seats and stopping at 1,000, above which the page asks for a quote. Its 10-K for 2021 said the platform is designed to scale from small businesses to large enterprises.

The figures reported for 2021 give an average per customer. At the end of 2021 KnowBe4 had 47,174 customers carrying $285.4 million of annual recurring revenue, which the profile calculates as a little over $6,000 of subscription a year for each of them. Nothing in the filing breaks that base down by customer size, so the shape behind the average is not established.

Cross-selling into that base was still early when the record closed. The same filing recorded that 22.1 percent of customers held more than one product at the end of 2021, and that customer growth had slowed as the company put more weight on enterprise accounts and managed service providers, which it said carry longer sales cycles.

The regulated credentials cover part of the platform. The FedRAMP Moderate authorisation and the Italian ACN accreditation each cover the training product and PhishER, and neither reaches the two email security lines.

KnowBe4 dates its AI work further back than the current wave. Its own AIDA timeline puts a first use of AI in security awareness training at 2016 and a first AIDA patent at 2018, when it also launched a risk-scoring function it called the Virtual Risk Officer.

What the agents do is administrative before it is defensive. KnowBe4 describes AIDA as a suite of agents that continuously automates administration and content personalisation so security teams can focus on strategic risk decisions rather than operational tasks. Its own timeline dates an eighth agent, which runs phishing simulations end to end, to 2026.

The scoring engine is what the rest hangs on. KnowBe4 says a risk score is produced for every employee from 316 indicators drawn across the organisation's security tooling, and that the score decides which content each person receives. AIDA ships inside the higher training tier, KnowBe4 SAT Advanced.

Agent Risk Manager is the line that defends AI rather than uses it, and it is not generally available. Its page promises discovery of every agent in a customer's tenant with no configuration, and says the product is in technical preview.

Free diagnostic tools sit at the top of the funnel. KnowBe4's free tools section lists an attack simulation test, a Phish Alert Button, a program maturity assessment, a weak password test, a domain spoof test, an email exposure check, a ransomware simulator and a breach simulator, all of them reachable without a purchase.

Named references are published rather than merely counted. The homepage carries case studies on Crawford, Anglo-Eastern Ship Management, Publix Employees Federal Credit Union and Well Pharmacy, two of which name the email security products in their titles rather than the training.

The partner motion is built out and its size is not disclosed. The site runs a channel partner programme, a technology alliances track, a risk and insurance track, a partner portal and a public partner directory. The 10-K for 2021 recorded that customer growth had slowed partly because the company was leaning harder on enterprise accounts and managed service providers.

KnowBe4 publishes its training price rather than quoting it. The pricing page shows two content tiers, Foundation and Advanced, priced per seat per month on a three-year term, in eight currencies, and dated May 2026.

The bands fall as the seat count rises. In US dollars, Foundation runs from $2.40 a seat a month in the 25 to 50 band down to $1.63 in the 501 to 1,000 band, and Advanced from $3.75 down to $2.79 across the same bands. Above 1,000 seats the page stops publishing a number and asks for a quote.

Of the other three lines, only PhishER Plus carries a published price, as an add-on on the same page: $1.50 per seat per month for 101 to 500 seats and $1.15 for 501 to 1,000 seats on a three-year term, with a quote above 1,000. Defend and Prevent are not priced in the reviewed sources.

Time to value is what KnowBe4 measures on its own pages. Prevent claims an average deployment of six minutes with no configuration or rules to write, through a four-step setup that syncs Microsoft 365 domains, defines which groups get nudged, ingests twelve months of mail history and routes outbound mail through a KnowBe4 gateway.

Defend lets a team turn the volume up gradually. It can run in a report-only mode while administrators check what it would have caught, and only then move to automated blocking. It also groups related phishing and graymail waves into one investigative view rather than leaving an analyst to triage message by message.

Defend's output lands where the security team already looks. Quarantine, detection timelines and threat-hunting data flow into Microsoft Defender XDR and Sentinel, and one allow-and- deny list covers email and Microsoft Teams together. PhishER Plus closes its own loop by turning a real reported attack into a template for the next simulation.

The authorisation boundary is narrower than the platform. The security statement puts the FedRAMP Moderate authorisation on what it calls the KnowBe4 Platform, defined there as the training product plus PhishER, and puts the ACN accreditation on the same two products. The reviewed sources place neither email security line inside a federal authorisation.

Some evidence is published and some is gated. The ISO certificates and a SOC 3 report are linked from the page, while a reader wanting the full SOC 2 Type 2 report is directed to a sales representative or a customer success manager, and the trust centre is where access to security documentation is requested.

One certification covers a different domain. KnowBe4 lists ISO 42001, which covers AI management systems rather than information security, alongside the 27001, 27701, 27017 and 27018 certifications an enterprise buyer expects.

Microsoft is the ecosystem that matters most. Defend describes itself as a partner in the Microsoft Defender ecosystem for integrated cloud email security, it works against Microsoft 365 and Microsoft Teams, and its quarantine, detection timelines and threat-hunting data flow into Microsoft Defender XDR and Sentinel. Prevent takes a single Microsoft 365 authorisation to route outbound mail.

The reporting side is a network rather than an integration. PhishER Plus draws on what KnowBe4 says are more than 13 million users worldwide, and both its global blocklist and its mailbox-clearing function work from what those users report, so a message one customer flags can produce a block for others.

Everything else is a programme rather than a catalogue. The site runs technology alliances alongside its channel and managed service partners, and the reviewed sources do not enumerate the integrations available through it.

The reviewed sources carry one headcount figure, in a filing. The 10-K for 2021 recorded 1,366 full-time employees at the end of 2021, of whom 264 worked outside the United States, alongside 71 issued United States patents and 62 more pending. No later headcount appears in the reviewed sources.

The company's own security function is unusually visible. Its chief information security officer is named on the leadership page, and CyberScoop quoted him saying that little had changed in the company's controls after the 2024 hiring incident, because those controls were what detected it.

That incident says something about the hiring process as well as about the attacker. CyberScoop reported that the person cleared background checks, verified references and four video interviews before a laptop was shipped, and that detection came only once the machine reached the operative's hands.