KnowBe4

1. Account Setup: After purchasing the software, the organization sets up an account on the KnowBe4 platform. This involves creating an administrator profile and configuring initial settings.
2. Baseline Phishing Test: The first step in the training process is conducting a baseline phishing test. This test helps establish the organization's initial "Phish-prone" percentage by sending a simulated phishing email to a sample of employees. The results of this test provide a benchmark for measuring the effectiveness of future training efforts.
3. Configuration and Customization: Administrators configure the platform to align with the organization's specific security policies and training goals. This includes customizing phishing simulation templates and scheduling training sessions. KnowBe4's platform is highly customizable, allowing organizations to tailor the training content and frequency to meet their specific needs.
4. Training Deployment: Once the platform is configured, the training modules are deployed to employees. KnowBe4 offers a wide range of interactive training content, including videos, quizzes, and games, which can be customized to focus on specific threats relevant to the organization.
5. Ongoing Simulated Phishing Attacks: After the initial training, the platform continues to send simulated phishing emails to employees at regular intervals. This ongoing testing helps reinforce the training and keeps employees vigilant against phishing threats.
6. Monitoring and Reporting: Administrators can monitor the progress of training and phishing simulations through the platform's reporting tools. These tools provide insights into employee performance and help identify areas where additional training may be needed.

The entire implementation process can vary in duration depending on the size and complexity of the organization, but KnowBe4 aims to make it as seamless as possible with the support of their Customer Success Team. Organizations can typically expect to have the platform up and running within a few days to a week, depending on their specific requirements and resources.

KnowBe4 software can be customized to fit specific business needs. Here are several ways in which the platform offers customization:

• Brandable Content: KnowBe4 allows organizations to customize training modules by adding branded content. This includes the ability to insert custom logos, graphics, and corporate brand colors at the beginning and end of training modules, helping to align the training with the company's visual identity.
• Custom Training Plans: The platform's Learner Experience (LX) offers customization capabilities that enable organizations to tailor their security awareness training plans. This includes the use of engaging gamification elements to make the training more interactive and relevant for users.
• Content Manager Feature: KnowBe4's Content Manager feature provides organizations with the ability to manage and customize their training content. This includes setting branded themes and personalizing the training experience to better fit organizational needs and culture.
• Integration with Existing Systems: KnowBe4 supports integration with existing systems, such as Learning Management Systems (LMS), allowing organizations to incorporate their own training materials or align KnowBe4's training with other educational initiatives.

These customization options ensure that KnowBe4's security awareness training can be tailored to meet the unique requirements and branding of different organizations, enhancing the relevance and effectiveness of the training.

KnowBe4's pricing structure is based on a Software as a Service (SaaS) subscription model, which is billed annually on a per-seat basis. The company offers different subscription levels—Silver, Gold, Platinum, and Diamond—to cater to varying organizational needs. Importantly, there are no additional setup fees, maintenance, or support charges. All telephone and web-based support is included in the cost of the subscription, ensuring that organizations do not incur extra expenses for these services

KnowBe4 provides comprehensive training and support to new users to ensure a smooth onboarding process. The platform includes:

• Training Campaigns: Users can create and manage training campaigns through the KnowBe4 console. This includes editing training notification templates and preparing policies for user acknowledgment, which helps tailor the training experience to specific organizational needs.
• Support Services: Standard support services are included with the subscription, providing users with access to both telephone and web-based support. This ensures that any issues or questions can be addressed promptly without additional costs

Data Access Restrictions : KnowBe4 restricts access to customer and confidential data on a need-to-know basis. Access is granted based on an employee's role within the organization.

Data Encryption : KnowBe4 leverages AWS for data encryption both in transit (using TLS 1.2 and higher) and at rest (using AES-GCM 256-bit encryption with AWS Key Management Service).

Data Backups and Retention : KnowBe4 maintains one year of database backups and three years of audit and application logs, stored in encrypted form.

Physical Security: KnowBe4 employs physical security measures at its data centers, though specific details are not provided.

Compliance : KnowBe4 maintains compliance with regulations such as GDPR, FedRAMP Moderate ATO, and SSAE 18.

Employee Training and Agreements : All KnowBe4 employees undergo mandatory security awareness and privacy training, sign confidentiality agreements, and are subject to simulated phishing tests.

Third-Party Management : KnowBe4 has measures in place to ensure third-party partners who process data adhere to security standards.

Business Continuity and Disaster Recovery : KnowBe4 has designed a highly scalable and resilient product architecture within AWS to withstand attacks and ensure continuity.

Continuous Updates: KnowBe4's security awareness training content is updated continuously. New content is added, and existing content is updated regularly to keep up with evolving threats and best practices.

Code Deployment Process: KnowBe4 leverages a Continuous Integration/Continuous Delivery (CI/CD) pipeline for managing code deployments. Code changes go through peer review, QA testing in a staging environment, and approval before being pushed to production.

Separation of Environments: The staging and production environments are logically separated, and no data is shared between them during the update process.

Quarterly Product Updates: KnowBe4 provides quarterly product update videos to inform customers about new features and content added to the platform.

Localization Updates: In addition to new content, KnowBe4 regularly releases fresh translations of existing content to support the language needs of its global customer base.

Data Ownership:

Customer Ownership: Customers retain ownership of their data. KnowBe4 does not claim any ownership rights over the data that customers upload or generate through the use of their services.

License to Use Data: Customers grant KnowBe4 a non-exclusive, worldwide, royalty-free license to use the data for the provision of subscription services, professional services, and support services. This includes using the data for improving and enhancing the services, but only in aggregate or de-identified forms that do not identify the customer or any individual user.

Data Portability:

Data Extraction: At the end of the contract, customers can extract their data via CSV or API. KnowBe4 provides the necessary tools and support for data extraction.

Data Deletion: Upon request, KnowBe4 will securely delete customer data. They maintain one year of database backups and three years of audit and application logs, which are stored encrypted.

Scalability:

Cloud-Based Infrastructure: KnowBe4's platform is built on Amazon Web Services (AWS), which allows for virtually infinite scalability. This means that the platform can handle a few hundred to several hundred thousand users by simply adjusting capacity as needed .

Auto Scaling: The platform uses auto-scaling to monitor application performance and automatically adjust capacity to maintain steady, predictable performance .

Adjusting Subscription Levels:

Flexible Subscription Plans: KnowBe4 offers various subscription plans (Silver, Gold, Platinum, Diamond) that cater to different levels of service and content access. Organizations can upgrade or downgrade their subscription level based on their needs .

Volume Discounts: For larger organizations, KnowBe4 offers tiered volume discounts, making it cost-effective to scale up the number of users .

Contract Terms: Longer contract commitments can lead to higher discounts. Organizations can negotiate terms that allow for flexibility in scaling up or down as their needs change .

Support for Scaling:

Customer Success Manager (CSM): Each customer is assigned a dedicated CSM who assists with scaling needs, providing guidance and support throughout the subscription period .

API Integration: KnowBe4's APIs allow for easy integration and management of user data, making it simpler to scale the number of users up or down .

Contract Renewal:

Automatic Renewal: KnowBe4 contracts typically include automatic renewal clauses unless explicitly terminated by either party. This means that the subscription will be renewed for an additional term unless notice of non-renewal is provided within a specified period before the end of the current term.

Notice Period: Customers are generally required to provide written notice of their intent not to renew the contract. The specific notice period can vary, but it is often 30 days before the end of the current term.

Negotiation for Renewal: Customers can negotiate terms and conditions, including pricing, for the renewal period. Longer-term commitments may result in discounts or other benefits.

Contract Cancellation:

Termination for Convenience: Either party may terminate the agreement for convenience upon 30 days' written notice to the other party. This allows for flexibility if the customer's needs change or if they are dissatisfied with the service.

Termination for Cause: Either party can terminate the agreement immediately if the other party materially breaches the agreement and fails to cure the breach within 30 days of receiving notice of the breach. This includes breaches related to the performance of subscription services or professional services.

Effects of Termination:

Cessation of Services: Upon termination, the reseller or customer must cease using the subscription services and stop providing or attempting to provide these services to others.

Payment Obligations: The customer must pay all fees for services ordered up to the date of termination without any right of deduction or offset.

Transitioning of Customers: In the case of reseller agreements, the reseller must provide contact information for each current customer to KnowBe4, which then has the right to contact these customers directly to ensure uninterrupted service.

KnowBe4 software meets several important compliance standards, ensuring that its security awareness training platform adheres to rigorous security and privacy protocols.

• SSAE18 SOC 2 Type 2 Certification: KnowBe4's products, including KMSAT, PhishER, and SecurityCoach, are certified under the SSAE18 SOC 2 Type 2 standard. This certification covers the Trust Services Criteria, which include security, availability, processing integrity, confidentiality, and privacy. This certification demonstrates that KnowBe4 has implemented effective controls to protect customer data.
• FedRAMP Moderate ATO: KnowBe4 has achieved FedRAMP Moderate Authorization to Operate (ATO), which is a federal government compliance standard that ensures cloud service providers have adequate security measures to protect government data. This compliance is crucial for serving government agencies and maintaining high-security standards.
• ISO Certifications: KnowBe4 holds several ISO certifications, including:
  • ISO 27001:2013: This standard covers information security management systems, ensuring that KnowBe4 has implemented a systematic approach to managing sensitive company information.
  • ISO 27017:2015: This standard provides guidelines for information security controls applicable to the provision and use of cloud services.
  • ISO 27018:2019: This standard focuses on the protection of personal data in the cloud, particularly for data processors.
  • ISO 27701:2019: This standard pertains to privacy information management, enhancing the existing ISO 27001 framework to include privacy-specific controls.

These compliance certifications underscore KnowBe4's commitment to maintaining high standards of security and privacy, providing customers with confidence in the platform's ability to protect their data and meet regulatory requirements.