The email from Human Resources looks ordinary. The logo is right. The tone is bland. There is a link about revised vacation policy. Click it and, instead of losing a password to a criminal, you discover your employer hired KnowBe4 to test you. Congratulations: you have become a data point.
That tiny moment of embarrassment is the engine of a large software business. KnowBe4 gives security teams a safe way to attack their own workforce, records who opens, clicks, replies or reports, and assigns training to the people who need it. The pitch is almost offensively easy to understand: hardware and software defenses matter, but a convincing message can walk around both. So rehearse the mistake before it costs real money.
Founder Stu Sjouwerman started the company in Clearwater, Florida, in 2010 after building and selling security-software businesses. KnowBe4 arrived when corporate awareness training was often an annual video treated like a fire drill conducted by spreadsheet. It replaced the ritual with a loop: establish a baseline, send simulated attacks, teach in small doses, measure again. By 2021, the company was public. In February 2023, Vista Equity Partners took it private for $24.90 a share, an equity value of roughly $4.6 billion.
The product was a scoreboard disguised as a prank
The clever bit was not inventing the fake phishing email. Security teams had been testing employees for years. KnowBe4 packaged the work, filled a library with templates and lessons, automated the campaign calendar and gave management a metric called the Phish-prone Percentage. A fuzzy concern - “our people might click” - became a line that could move down and to the right.
KnowBe4's 2023 benchmark covered 12.5 million users at 35,681 organizations. The company reported an average baseline Phish-prone Percentage of 33.2 percent, falling to 18.5 percent after 90 days and 5.4 percent after a year or more of training. This was KnowBe4's own customer analysis, not a randomized trial, and simulation performance is not the same as preventing a breach. Still, the before-and-after graph does what good enterprise software must: it gives a buyer evidence that the subscription is doing something.
Customers range from small companies without a dedicated awareness specialist to global employers trying to train workers in many languages. IT, security, compliance and risk teams administer the software; everyone else receives the phish. Maritime manager Anglo-Eastern says it cut its simulated-click rate from roughly 60 percent to 5 percent. When a real campaign later arrived, about 200 suspicious messages were reported in a day. That second number may matter more: a worker who reports a threat is no longer merely an attack surface. The worker is a sensor.
Then KnowBe4 got caught by the oldest product in the book: a convincing person
In July 2024, KnowBe4 disclosed an incident almost too on-brand to invent. Its recruiters hired a remote software engineer who appeared to be in the United States. The candidate had used a stolen identity, passed a background check and appeared in four video interviews. The company shipped a laptop to a U.S. address. The person was, KnowBe4 concluded with help from investigators, a North Korean IT operative working through an American “laptop farm.”
Recruiting failed first. Identity documents and interviews created the feeling of verification without establishing the applicant's physical identity. Once the laptop came online, however, endpoint tooling noticed suspicious attempts to manipulate session files and run unauthorized software. The security operations team contained the device within about 25 minutes of the alert. KnowBe4 says the account had limited onboarding permissions, accessed only its own email and never reached customer data or the production platform.
The important change was procedural. KnowBe4 recommended stronger identity verification, checking that a shipping address matches the applicant's residence, using cameras throughout remote interviews, watching for location inconsistencies and treating new devices as untrusted. The company could have kept the episode quiet. Instead, Sjouwerman wrote that it had “egg on our face” and published a detailed FAQ. Disclosure turned a reputational bruise into useful training material - and made a point its marketing could never make as cleanly: sophisticated social engineering can beat a process that looks thorough.
A training company eats the inbox
KnowBe4 no longer wants to be described as the place that sends fake emails. Its platform now covers three adjacent jobs: attack simulation and training; email and collaboration security; and agent security. SecurityCoach can nudge an employee in Teams, Slack, Google Chat or email when integrated security tools detect risky behavior. PhishER triages messages reported through the Phish Alert Button. Its delightfully blunt features can “rip” matching malicious email from inboxes and “flip” a live attack into a future test.
The 2024 acquisition of London-based Egress pushed the company deeper into the message stream. Egress brought adaptive inbound protection, encryption and outbound data-loss controls, now sold as Defend and Prevent. The strategic logic is strong: KnowBe4 already knows which employees are risky, what they report and which simulations fool them. Email defenses add live threat data. Join those pieces and a training calendar can become a feedback system.
This breadth is also where the competitive map gets messy. In awareness training, buyers compare KnowBe4 with Hoxhunt, Proofpoint ZenGuide, Infosec IQ, NINJIO, Cofense and SoSafe. In email defense it meets Proofpoint, Mimecast, Abnormal Security and others with mature detection stacks. KnowBe4's differentiation is the bridge: a large content library, configurable simulations, reported-email response, real-time coaching and risk scoring in one commercial relationship. The tradeoff is that smaller teams may not use enough of the machinery to justify a broad, tiered contract.
What it costs - and what buyers are really buying
The basic model is per seat, per year. Training comes in subscription tiers; products such as PhishER Plus and Compliance Plus can be added. Pricing falls with volume and multiyear commitments, while larger deployments go through sales. One public North American list for PhishER Plus, dated January 2025, put a three-year term at $1.50 per user per month for 101 to 500 seats and $1.15 for 501 to 1,000. Core training quotes vary by tier, seat count, geography and discount, so a tidy universal sticker price would mislead.
Customers are buying more than videos. They are buying administration: automatic enrollment, campaign scheduling, localization, reporting and audit evidence. They are buying a reason for employees to practice. And they are buying a common language for risk. “Our completion rate is 98 percent” mostly proves that people found the play button. “Our baseline click rate was 31 percent and is now 11 percent” begins a more useful conversation.
There are limits. Simulated phishing can sour a culture when it is punitive, humiliating or designed only to catch people. Employees may learn the test's quirks instead of general judgment. Click rates can fall while attackers move to phone calls, messaging apps, QR codes and fake job candidates. And training cannot compensate for weak identity controls, excessive privileges or unpatched systems. The method works best when failure creates an immediate lesson rather than a public shaming, and when behavioral data triggers technical controls instead of substituting for them.
The part worth copying
- Measure a baseline before announcing the program.
- Practice frequently with varied, realistic scenarios.
- Teach immediately after the mistake, while curiosity is high.
- Make reporting easier than forwarding or deleting.
- Track both failure and positive behavior, then tighten technical controls around the result.
The next employee may be software
In May 2025, former Trellix chief Bryan Palma became president and CEO while Sjouwerman shifted to executive chairman. The handoff came as KnowBe4 was turning “human risk management” into something wider. Its AIDA software agents automate template generation, training recommendations, knowledge refreshers and assessments. In 2026, the company added orchestration for automated phishing programs and introduced Agent Risk Manager, pitched as a governance layer for the autonomous AI tools entering company workflows.
This sounds like a fashionable leap until you follow the trust problem. An AI agent can read email, call software, move information and act with a user's authority. It can be manipulated through prompt injection or an unsafe integration just as a person can be manipulated through pretext and urgency. KnowBe4's wager is that fifteen years of modeling people - who is risky, what happened and which intervention followed - can be extended to digital coworkers.
Whether that becomes a real category or an ambitious label will depend on integrations and proof. Training a person changes judgment. Governing an agent requires inventory, permissions, observability and enforceable controls. The two problems touch, but they are not identical. KnowBe4 has earned permission to try because it sits where security teams, employees and suspicious messages already meet.
The company's original insight remains cleaner than the new vocabulary. People do risky things. A good system does not merely complain about that fact; it creates a safe rehearsal, watches what happens, responds quickly and learns. KnowBe4's own hiring scare supplied the uncomfortable footnote. Its recruiting controls were fooled. Its endpoint controls were not. Then the company did the rarest thing in corporate security: it showed everyone the trick.