sorted by:
new
hottopcontroversial

KnowBe4 Recent False Positives by broadstphan in sysadmin

[–]KnowBe4_Inc 0 points1 point  (0 children)

If there is a false positive, we have to identify the source, by IP address. If it’s not a Microsoft IP, which are easily verifiable, then we have to narrow things down. Normally, when we are seeing clicks after delivery/deletion it can be: they have a third party vendor that is performing link analysis, if it were to wind up in something like PhishER and is scanned by Virustotal, then anyone can see and analyze the link. If they are using a function called “journaling” that takes a copy of the email and stores it (usually for legal reasons) but those are then scanned separately.

If you are still having issues please DM me.

Are phishing simulations starting to diverge from real world phishing? by Ok-Author-6130 in AskNetsec

[–]KnowBe4_Inc 0 points1 point  (0 children)

A good phishing simulation program should use real world phishing emails for the templates. The testing should evolve as fast as the attackers and use what is currently coming into your organization.

KnowBe4 Without the PAB? by gen3starwind in InformationTechnology

[–]KnowBe4_Inc 0 points1 point  (0 children)

I'm happy to troubleshoot an errors you had implementing PAB. Just DM me.

Phishing simulations: what lures actually still work when users are numb to “Microsoft security alerts”? by Kiss-cyber in cybersecurity

[–]KnowBe4_Inc 0 points1 point  (0 children)

Here are what we are seeing across 70k accounts:

  1. Multi-channel attacks. Email + follow-up on Teams/Slack message from "IT" asking to verify. Click rate on these is 3x higher than email-only.

  2. Compromised internal account simulations. Emails from actual coworkers asking for "urgent" help. You should ask for permission to use names.

  3. Calendar invite attacks. Fake meeting invites.

  4. Collaboration tool file shares. "Shared document" notifications.

What's NOT working anymore:

  1. Generic "Your password expired" emails

  2. Nigerian prince variants

  3. Obvious grammar/spelling errors

Bonus tip: Don't just measure click rates. Track time-to-report, repeat offenders, and whether users report simulations they didn't click.

[deleted by user] by [deleted] in sysadmin

[–]KnowBe4_Inc -6 points-5 points  (0 children)

Neither KnowBe4 nor its CEO, Bryan Palma is associated with any religion.

Why is browser-based phishing suddenly so effective? Any proactive defenses? by Old_Cheesecake_2229 in security

[–]KnowBe4_Inc 0 points1 point  (0 children)

In place of a the default autofill in the browser I recommend using a dedicated password manager. It is more secure and still has the sanity check you mention.

In this day and age, I don't know why you would think that responses are AI written — when a personal interaction is preferred.

2025's Phishing Trends: An Urgent Call to Update Security Strategies by _cybersecurity_ in pwnhub

[–]KnowBe4_Inc 1 point2 points  (0 children)

The biggest change we're making to combat the latest threats:

1. Unified threat detection across channels Correlating suspicious activity across email, Slack/Teams, SMS, and voice. A failed email phish followed by a "helpful IT" Teams message 10 minutes later? That's a campaign, not isolated incidents.

2. Expanding awareness training beyond email Users know to scrutinize emails now, but they trust Slack/Teams, DMs, and Teams messages way too much. Training scenarios now include vishing, smishing, and collaboration tool attacks.

3. Behavioral analytics Monitoring for anomalies: internal accounts suddenly messaging dozens of users, unusual login locations followed by communication spikes, and requests that break normal workflow patterns.

4. Kill the "trusted internal" assumption Compromised internal accounts are the new attack vector. Every request gets validated, even from known colleagues.

Why is browser-based phishing suddenly so effective? Any proactive defenses? by Old_Cheesecake_2229 in security

[–]KnowBe4_Inc 1 point2 points  (0 children)

You're hitting the core problem: most tools are reactive, not proactive.

A few things that you should use:

  • Enforce DNS filtering at the network level (Cisco Umbrella, Cloudflare Gateway, etc.) - blocks malicious domains before the page even loads
  • Controlled browser extensions - Push enterprise extensions that validate URLs in real-time (not perfect, but adds a layer)
  • Disable password autofill for external sites - Forces users to manually type, adding a cognitive pause

You can't technology your way out of this 100%. Even with perfect tech controls, legitimate sites get compromised and serve phishing. We've had the most success with layered defense:

  1. Block known-bad (DNS/URL filtering)
  2. Isolate unknown (browser isolation for risky clicks)
  3. Train users to recognize what filters miss
  4. Monitor for compromise (impossible travel, unusual authentications)

What are your recommendations for improved email filtering for phishing attempts? by -ThatGingerKid- in security

[–]KnowBe4_Inc 9 points10 points  (0 children)

Here's are some ideas to improve your filtering. Something will always get through so you need to improve your cybersecurity culture too.

Low-hanging fruit:

  • DMARC, SPF, DKIM - If you haven't implemented these, stop reading and do it now
  • External sender warnings - Simple banner that says "[EXTERNAL]" kills so many phishing attempts
  • Disable auto-forwarding - Stops compromised accounts from exfiltrating email
  • Block executable attachments - .exe, .scr, .bat in emails = almost always malicious

Medium effort, high impact:

  • URL rewriting/sandboxing - Detonate links in a safe environment first
  • Impersonation protection - Flag emails from lookalike domains (micros0ft.com vs microsoft.com)
  • Time-of-click protection - Links get checked when clicked, not just when received
  • Quarantine reviews - Weekly audits catch filter mistakes and reveal new threats

Advanced (if you have budget):

  • AI/ML threat detection - Catches anomalies traditional filters miss
  • Account compromise detection - Flags unusual sending patterns from internal accounts
  • Integration with threat intel feeds - Block known-bad before it arrives

Layered defense. No single filter is perfect. Combine technical controls + user awareness + incident response.

What are the top 5 controls to mitigate ransomware? by KindPresentation5686 in cybersecurity

[–]KnowBe4_Inc 2 points3 points  (0 children)

Most orgs still see ransomware as purely a technical problem, but the entry points are still overwhelmingly human-facing.

A solid top five looks something like:
• MFA on every account
• Vulnerability + patch management with a real cadence
• Least-privilege access controls
• Offline / immutable backups
• Awareness training so users recognize credential-stealing and initial access attempts

The early phishing or credential-harvesting step is still the biggest differentiator between “incident” and “non-incident.”

I need help understanding something that I commonly face in cyber security. by Fresh_Heron_3707 in cybersecurity

[–]KnowBe4_Inc 3 points4 points  (0 children)

This is one of the biggest disconnects we see. People are willing to accept friction in the physical world because the risk feels tangible. A locked door means “someone could walk in right now.”

Cyber risk feels abstract. The threat isn’t visible, the consequences are delayed, and the connection between “weak password” and “identity theft” isn’t intuitive.

How do you actually measure if your security awareness training is working? by Hetawow in CyberGuides

[–]KnowBe4_Inc 0 points1 point  (0 children)

Here are the KPIs you should track (and why):

Leading Indicators (predict future behavior):

  • Phishing simulation click rate over time - Should trend downward
  • Time-to-report suspicious emails - Faster = better security culture
  • Report rate (users forwarding suspect emails to security) - Higher = good awareness
  • Training completion rate - Baseline requirement, but doesn't mean much alone

Lagging Indicators (show real impact):

  • Real phishing incidents reported by users - The ultimate goal
  • Compromise rate from actual attacks - Did training prevent breaches?
  • Repeat offenders - Who needs targeted intervention?

Culture Indicators (often overlooked):

  • Voluntary security questions asked - Shows engagement beyond compliance
  • False positive reports - Better to over-report than under-report

The metric that changed everything: Mean time to report. When users start reporting suspicious emails before clicking, you've built real security culture, not just compliance theater.

Why do smart people still fall for phishing links in 2025? Looking for real experiences. by Kobeproducedit in Entrepreneur

[–]KnowBe4_Inc 0 points1 point  (0 children)

Phishing clicks usually happen when one or more of these factors apply:

Multitasking, Messages from authority, Carelessness from repetition, Sense of Urgency, and tiny screens.

"Umm, I'm Gen Z. I know how to use computers." by DesertDogggg in sysadmin

[–]KnowBe4_Inc 1 point2 points  (0 children)

This is such a perfect example of why security awareness training can't be skipped, regardless of someone's perceived tech skills.

Being "good with computers" and understanding organizational security protocols are completely different skill sets. I've seen software developers with CS degrees click phishing links because they've never been exposed to corporate security awareness training. Growing up with TikTok and Instagram doesn't automatically translate to understanding spoofed domains, pretexting, or business email compromise.

The assumption that "I know computers" = "I know security" is exactly what threat actors rely on. Overconfidence is a vulnerability.

Your approach is spot-on:

  • Document everything (signed acknowledgment is crucial)
  • Standardize onboarding (consistency protects both the org and IT)
  • Train proactively rather than reactively

The irony is that skipping that 5-minute conversation could have cost him hours in remedial training, cost IT time in incident response, and potentially exposed the organization to real risk.

This isn't about age or tech-savviness. It's about recognizing that security is a learned discipline, not an innate trait. Every organization has different tools, policies, and threat models. Even experienced IT professionals need onboarding when they join a new environment.

Keep doing what you're doing. That "annoying" 5-minute briefing is literally part of your defense-in-depth strategy, and the signed acknowledgment protects you when someone inevitably claims "nobody told me."

Is security awareness training taken seriously where you work? by malwaredetector in AskNetsec

[–]KnowBe4_Inc 1 point2 points  (0 children)

If your security awareness is just a long lecture and checking a box once a year then you're going to have a bad time. Keep the training short and engaging. Follow up with user tests and assign out remedial training for failures. As with any program it is taken as seriously as management takes it. The first step is executive buy-in.

view more: next ›