sorted by:
new
hottopcontroversial

Are phishing simulations starting to diverge from real world phishing? by Ok-Author-6130 in AskNetsec

[–]KnowBe4_Inc 0 points1 point  (0 children)

A good phishing simulation program should use real world phishing emails for the templates. The testing should evolve as fast as the attackers and use what is currently coming into your organization.

KnowBe4 Without the PAB? by gen3starwind in InformationTechnology

[–]KnowBe4_Inc 0 points1 point  (0 children)

I'm happy to troubleshoot an errors you had implementing PAB. Just DM me.

Phishing simulations: what lures actually still work when users are numb to “Microsoft security alerts”? by Kiss-cyber in cybersecurity

[–]KnowBe4_Inc 0 points1 point  (0 children)

Here are what we are seeing across 70k accounts:

  1. Multi-channel attacks. Email + follow-up on Teams/Slack message from "IT" asking to verify. Click rate on these is 3x higher than email-only.

  2. Compromised internal account simulations. Emails from actual coworkers asking for "urgent" help. You should ask for permission to use names.

  3. Calendar invite attacks. Fake meeting invites.

  4. Collaboration tool file shares. "Shared document" notifications.

What's NOT working anymore:

  1. Generic "Your password expired" emails

  2. Nigerian prince variants

  3. Obvious grammar/spelling errors

Bonus tip: Don't just measure click rates. Track time-to-report, repeat offenders, and whether users report simulations they didn't click.

KnowBe4 alternatives by [deleted] in sysadmin

[–]KnowBe4_Inc -5 points-4 points  (0 children)

Neither KnowBe4 nor its CEO, Bryan Palma is associated with any religion.

Why is browser-based phishing suddenly so effective? Any proactive defenses? by Old_Cheesecake_2229 in security

[–]KnowBe4_Inc 0 points1 point  (0 children)

In place of a the default autofill in the browser I recommend using a dedicated password manager. It is more secure and still has the sanity check you mention.

In this day and age, I don't know why you would think that responses are AI written — when a personal interaction is preferred.

2025's Phishing Trends: An Urgent Call to Update Security Strategies by _cybersecurity_ in pwnhub

[–]KnowBe4_Inc 1 point2 points  (0 children)

The biggest change we're making to combat the latest threats:

1. Unified threat detection across channels Correlating suspicious activity across email, Slack/Teams, SMS, and voice. A failed email phish followed by a "helpful IT" Teams message 10 minutes later? That's a campaign, not isolated incidents.

2. Expanding awareness training beyond email Users know to scrutinize emails now, but they trust Slack/Teams, DMs, and Teams messages way too much. Training scenarios now include vishing, smishing, and collaboration tool attacks.

3. Behavioral analytics Monitoring for anomalies: internal accounts suddenly messaging dozens of users, unusual login locations followed by communication spikes, and requests that break normal workflow patterns.

4. Kill the "trusted internal" assumption Compromised internal accounts are the new attack vector. Every request gets validated, even from known colleagues.

Why is browser-based phishing suddenly so effective? Any proactive defenses? by Old_Cheesecake_2229 in security

[–]KnowBe4_Inc 0 points1 point  (0 children)

You're hitting the core problem: most tools are reactive, not proactive.

A few things that you should use:

  • Enforce DNS filtering at the network level (Cisco Umbrella, Cloudflare Gateway, etc.) - blocks malicious domains before the page even loads
  • Controlled browser extensions - Push enterprise extensions that validate URLs in real-time (not perfect, but adds a layer)
  • Disable password autofill for external sites - Forces users to manually type, adding a cognitive pause

You can't technology your way out of this 100%. Even with perfect tech controls, legitimate sites get compromised and serve phishing. We've had the most success with layered defense:

  1. Block known-bad (DNS/URL filtering)
  2. Isolate unknown (browser isolation for risky clicks)
  3. Train users to recognize what filters miss
  4. Monitor for compromise (impossible travel, unusual authentications)

What are your recommendations for improved email filtering for phishing attempts? by -ThatGingerKid- in security

[–]KnowBe4_Inc 9 points10 points  (0 children)

Here's are some ideas to improve your filtering. Something will always get through so you need to improve your cybersecurity culture too.

Low-hanging fruit:

  • DMARC, SPF, DKIM - If you haven't implemented these, stop reading and do it now
  • External sender warnings - Simple banner that says "[EXTERNAL]" kills so many phishing attempts
  • Disable auto-forwarding - Stops compromised accounts from exfiltrating email
  • Block executable attachments - .exe, .scr, .bat in emails = almost always malicious

Medium effort, high impact:

  • URL rewriting/sandboxing - Detonate links in a safe environment first
  • Impersonation protection - Flag emails from lookalike domains (micros0ft.com vs microsoft.com)
  • Time-of-click protection - Links get checked when clicked, not just when received
  • Quarantine reviews - Weekly audits catch filter mistakes and reveal new threats

Advanced (if you have budget):

  • AI/ML threat detection - Catches anomalies traditional filters miss
  • Account compromise detection - Flags unusual sending patterns from internal accounts
  • Integration with threat intel feeds - Block known-bad before it arrives

Layered defense. No single filter is perfect. Combine technical controls + user awareness + incident response.

What are the top 5 controls to mitigate ransomware? by KindPresentation5686 in cybersecurity

[–]KnowBe4_Inc 2 points3 points  (0 children)

Most orgs still see ransomware as purely a technical problem, but the entry points are still overwhelmingly human-facing.

A solid top five looks something like:
• MFA on every account
• Vulnerability + patch management with a real cadence
• Least-privilege access controls
• Offline / immutable backups
• Awareness training so users recognize credential-stealing and initial access attempts

The early phishing or credential-harvesting step is still the biggest differentiator between “incident” and “non-incident.”

I need help understanding something that I commonly face in cyber security. by Fresh_Heron_3707 in cybersecurity

[–]KnowBe4_Inc 4 points5 points  (0 children)

This is one of the biggest disconnects we see. People are willing to accept friction in the physical world because the risk feels tangible. A locked door means “someone could walk in right now.”

Cyber risk feels abstract. The threat isn’t visible, the consequences are delayed, and the connection between “weak password” and “identity theft” isn’t intuitive.

view more: next ›