KnowBe4
Measure The Human Risk
Before You Train It
KnowBe4 starts by finding out what proportion of your staff will actually click a phishing message, then trains against that number and measures it again. The programme is built around a figure you can put in front of a board rather than an attendance record.
A simulated campaign before any training establishes the starting phish-prone percentage, so improvement is measured against a real number rather than a hope.
Simulations continue throughout the year at varying difficulty, because a single annual session is forgotten long before the attack arrives.
Results are compared with organizations of similar size and sector, which turns an internal figure into a position you can defend or act on.
Compliance Training Changes Records, Not Behaviour
The version most organizations run exists to satisfy an auditor, and it succeeds at exactly that and nothing more.
Once A Year, Then Forgotten
An annual module completed in November has no measurable effect on a decision made the following June. Awareness behaves like any other trained skill: without reinforcement it fades, and the calendar does not care when the attack arrives.
Nothing Is Measured
A completion report proves people clicked through a course. It says nothing about whether they would recognise a well-built invoice fraud, which is the only question that matters and the only one most programmes never ask.
The Same Content For Everyone
A finance clerk who can move money faces a different threat from a warehouse operative. Uniform training under-serves the high-risk roles and wastes the time of everyone else, which is how it earns its reputation.
Test, Train, Test Again
The structure is deliberately a loop rather than a course, because the measurement is what makes the training defensible.
Baseline Simulation
A realistic phishing simulation is sent before any training, producing a phish-prone percentage for the organization and identifying which roles and individuals are most exposed. This number is frequently higher than management expects, and that surprise is itself useful.
Targeted Training
Training is assigned according to what the simulation revealed, drawing on a large library of modules in varying formats and lengths. People who fell for a payment fraud receive instruction on payment fraud rather than a general overview.
Ongoing Simulation
Campaigns continue at intervals using templates that reflect current attacker technique, so the exercise stays representative rather than becoming a recognisable internal test that staff learn to spot by format alone.
Reporting And Response
Staff are given a way to report suspicious mail, and those reports can be triaged rather than ignored. Training people to report and then discarding what they send is how an organization teaches them to stop bothering.
One Number, Tracked Over Time
The phish-prone percentage is the proportion of staff who interact with a simulated attack. It is the metric the programme is built around because it behaves like a real measurement: it has a baseline, it responds to intervention, and it can be compared against peers.
That makes it useful well beyond the security team. It answers an insurer's question about human risk controls, it gives a board something concrete in place of an assurance, and it identifies which departments need attention rather than treating the workforce as one undifferentiated group.
What This Does And Does Not Solve
| Expectation | Reality | What to do about it |
|---|---|---|
| Clicks will reach zero | They will not | Plan technical controls for the residual |
| Training replaces filtering | It does not | Run both, they fail differently |
| One campaign is enough | The effect decays | Budget for a continuing programme |
| Staff will resent it | Only if it is punitive | Frame results as organizational, not individual |
| It satisfies the auditor | Yes, and more | Use the metric for insurance questions too |
Find Out What Your Number Is
A baseline simulation takes very little time to arrange and answers the only question that matters: how many of your people would click today.
Run a Baseline SimulationGet in touch with Your Company
Questions about this solution? Reach us directly.