The antivirus was doing its job. The trouble tickets kept arriving anyway. At Sunbelt Software, Stu Sjouwerman and his colleagues had built defenses against malicious code, yet customers still ended up with infected workstations. The explanation led away from the software and toward the person sitting in front of it. An attacker who could persuade an employee to open an attachment had found another entrance.
For someone who sold computer security, this was an uncomfortable discovery. A product could work and the customer could still lose. Sjouwerman carried that problem into KnowBe4, which he founded in August 2010. It would sell organizations a way to train employees to recognize deception, then let them rehearse with simulated phishing emails. The ordinary act of clicking became a subject worthy of a company.
The computer was protected. The person was persuadable.
Sunbelt had been acquired by GFI Software that June. Sjouwerman tried retirement. In his telling, the experiment was brief enough to fit between two working weeks. He recalled the five-day interval in a 2017 interview. Leisure had made a poor first impression.
“I tried that when we sold Sunbelt back in 2010 but it only lasted five days.”
Stu Sjouwerman, recalling retirement
His new business initially concentrated on small and medium-sized organizations. Large corporations already attracted attention from security-training vendors. Smaller employers had the same capacity to receive a fraudulent email and fewer resources to build a response. An apparent request from the boss could land on any desk. Company size offered little protection against the desire to be helpful.
The attraction of the problem was its familiarity. Social engineering takes advantage of normal working behavior: responding to authority, dealing with an urgent request, opening something that appears relevant. Security training has to interrupt that behavior without making ordinary work impossible. The employee still needs to answer emails. Suspicion, taken as a full-time occupation, would produce a very inefficient accounts department.
KnowBe4’s approach put practice beside instruction. A simulated attack could make a lesson specific, showing how an apparently routine message demanded a consequential decision. The company’s first security-awareness training product arrived in April 2011, alongside a free phishing test. The question was something an employer could try to measure: what happens when the message reaches the inbox?
Security awareness training + simulated phishing. An explanatory diagram, not a performance claim.
A teacher hiding in a software career
There was an educational thread in Sjouwerman’s life well before KnowBe4. Born in Amsterdam, he studied educational sciences at the University of Amsterdam, then turned toward computing in 1979. One early venture made audio tapes for first-time computer users. Long before a phishing simulation appeared in an employee’s inbox, he had been working on the problem of explaining a machine to its operator.
Publishing became another route to that operator. He co-authored Windows administration books and edited WServer News for an audience of IT system administrators. His later book Cyberheist addressed the financial threat of cybercrime to businesses. These were practical subjects, written for readers expected to do something after closing the book or the email.
The newsletter habit continued at KnowBe4. CyberheistNews launched in March 2011; Sjouwerman became its editor-in-chief. The rhythm suited a field where yesterday’s example could quickly need a replacement. A static warning has a short working life when the people creating fraudulent requests keep revising their material.
His writing also gave the business a recognizable voice. KnowBe4’s entry in the Shorty Awards described his Twitter account, @StuAllard, as a way to share cybersecurity reporting, statistics and a recurring scam of the week. The name of the company was a compressed instruction. Much of the publishing effort supplied the details that instruction required.
The hacker on the other side of the lectern
Kevin Mitnick helped bring the attacker’s perspective into KnowBe4’s training. As chief hacking officer, he contributed experience in social engineering to material intended to help employees recognize it. For the company, the collaboration supplied an unusually direct answer to a reasonable audience question: how would somebody actually try to fool me?
In 2017, Sjouwerman and Mitnick shared the keynote at the Cyber Investing Summit at the New York Stock Exchange. Their presentation included hacking demonstrations, including proximity-card cloning and phishing. The setting put an everyday security problem in front of an audience concerned with investment and business risk. A familiar object or message could become the starting point for an intrusion.
A demonstration has an advantage over a warning. It gives the audience a sequence to follow. The request seems plausible, the target responds, and the consequences become visible. For a training company, that sequence is useful material. It allows the lesson to begin with a situation someone recognizes rather than a list of prohibited behaviors.
A small room, then a public company
KnowBe4 began in a rented Clearwater office measuring ten feet by ten feet. By 2019, its footprint had spread across downtown office buildings. The physical expansion made the business legible to the city around it: a small software operation had become an employer occupying floors, rather than a room.
Ransomware helped change the commercial conversation. In his March 2025 Florida Funders interview, Sjouwerman identified the attacks of 2013 as a turning point for growth. A category that once required explanation was acquiring visible consequences. The interview described KnowBe4 as having passed $500 million in annual recurring revenue. That is a dated account of company scale, rather than a number to treat as permanently current.
- 2010KnowBe4 founded in Clearwater
- 2019$300 million funding round; $1 billion valuation
- 2021Nasdaq IPO in April
- 2023Vista acquisition completed February 1
- 2025Founder becomes executive chairman
Outside capital followed. A KKR-led round brought in $300 million in June 2019 and valued KnowBe4 at $1 billion. In April 2021, it went public on Nasdaq. Sjouwerman had talked about wanting an IPO back in 2017. The ambition became a date on the calendar.
At the time of the listing, he was discussing automation and AI as ways to develop the human side of cybersecurity. The subject already extended beyond a training video. An organization needed to understand who was encountering risk, how people responded and what intervention might help them. A lesson was one part of a larger working process.
Vista Equity Partners completed its acquisition of KnowBe4 on February 1, 2023, paying $24.90 a share in cash. Trading stopped and the company left Nasdaq. Public ownership had been one stage in its development. The recurring work remained: helping organizations deal with people being manipulated, even as their technical defenses evolved.
An orange tie in Washington
In April 2024, Sjouwerman stood at the Dutch ambassador’s residence in Washington, wearing an orange tie, to accept the Holland on the Hill Freddy Heineken Award. The recognition honored contributions to economic ties between the Netherlands and the United States. His career had crossed that Atlantic route in 1994, when he moved to America to pursue technology entrepreneurship.
He described himself at the time as a longtime U.S. citizen with continuing roots in the Netherlands. “I build companies,” he said. It was an economical account of the work that had taken him between countries, through Sunbelt and into KnowBe4. The award connected that personal route with a relationship between two economies.
His local commitments have also produced something tangible. In 2019, Stu and Rebecca Sjouwerman donated $4 million toward a new adoption center for the Humane Society of Pinellas. A business story usually measures expansion in customers and revenue. Here, part of the result was intended to give people a place to meet an animal they might take home.
The next conversation
In May 2025, Bryan Palma became KnowBe4’s president and CEO. Sjouwerman moved to executive chairman, with a continuing focus on AI innovation. The title change gave formal shape to a future he had discussed years earlier: remaining involved from the chairman’s seat.
He also became co-founder and CEO of ReadingMinds.ai. The new venture uses an AI interviewer called Emma to conduct customer conversations. Its premise is that conventional survey responses leave useful information behind. The company aims to analyze spoken answers and vocal cues, and connects findings to the underlying interview material. Those are the platform’s stated aims and features; understanding a customer remains work that a business must judge for itself.
His 2026 book, Agent-Powered Growth, takes the interest in AI into marketing operations, from content and campaigns to research. His August 2026 writing adds a condition to the enthusiasm: organizations should be able to trace an AI agent’s decisions back to the inputs that produced them. Confidence in an answer is more useful when someone can inspect its basis.
Read across the companies and a recurring concern comes into view. At Sunbelt, it was the gap between protecting a computer and protecting its user. At KnowBe4, it became the moment a persuasive request met a busy employee. At ReadingMinds, it is the distance between a customer’s answer and a company’s interpretation. Sjouwerman keeps returning to the person using the technology. There is usually another question waiting there.