KnowBe4 PhishER vs. ReliaQuest GreyMatter

Highly recommended if you're using the other KnowBe4 tools as this really can save staff all kinds of time. Would recommend this to anyone using the automated phishing plugin for their users. If you can fit it into the security budget its totally worth its asking price. The company has a deep background of email security and the like.

Incentivized

Our company generates more than a terrabyte of log a day and it can easily go above 2 TB a day. We were using out of the box SOC Solution from splunk to manage our SOC. We lacked the know how of using splunk and also lacked the staff to keep the product up to date to help us tackle the latest threats. We outsourced our SIEM/SOAR service to RQ and they helped us with creating new use cases which addressed the latest threat to our organization. RQ has people who research the latest threats and helps us keep up to date on the day-to-day security operations. RQ also helps with data onboarding if required. So we would recommend RQ to customers who are short-staffed and who lack personnel who could research security threats to keep your organization safe from threat actors.

Incentivized

• PhishER's connection to our O365 environment is good, it allows users to click the Phish Alert button to report a phish and this kicks off a back-end action that scans all users' inboxes and quarantines similar phishing emails it finds.
• The KnowBe4 security awareness training, the Phish Alert Button, and simulated phishing are all tightly integrated, it's a "system" rather than ad hoc solutions.

Incentivized

• SOC service.
• Managed services.
• Correlation searches.

Incentivized

• consistency within reporting - reports are not always consistent or accurate. ie reporting in PhishER (reported emails) is not consisted with reported phishes in core knowbe4 product.
• training modules are stale, clunky and most of the content is given to diamond members - need more content at platinum 247 vs 1439 modules is significant - especially when compliance+ is another offering

Incentivized

• Some Analysts are relatively fresh to SOC. They sometimes get put into supporting large infrastructures.
• RQ has a ton of correlation searches that they use to provide end-to-end visibility. Most of them can be restructured to get the same results and this can reduce the number of correlation searches.

Incentivized

Much easier interface to use, great support. Very easy to set up and works out of the box. Great content and new videos are constantly being added. Themed phishing around holidays is a great idea and has made users far more aware. Phishing based on current events in the news is a great idea.

Incentivized

Reliaquest is vendor agnostic. They have a lot of correlation searches that they use to provide security for your organizations. Compared to other products we have tried we felt that they are the only company that is doing proper market research on the latest and greatest threat to our vertical and coming out with the latest methods to keep up to date. RQ also has a good leadership structure that we could rely on if we run into any escalations. Compared to other products that we tried they try to work with you holding hands trying to resolve your problems.

Incentivized

• Can't put a value on the time saved examining user submitted emails that the system now handles on its own
• In the long run this is all meant to save us from some malware or ransomware. So ROI may not be able to be calculated on the cost but security is priceless
• Getting users educated on being careful opening message they dont recognize is the first step. Giving them tools to submit and have automatic scanning of suspected phishing is the next local step.

Incentivized

• RQ's Greymatter content has enriched our SOC experience because we always felt Splunk's out-of-the-box use cases were not sufficient enough to provide end-to-end coverage.
• RQ specializes in a lot of big data solutions so that we can rely on them to help us troubleshoot tasks and also make sure our security solutions are working accurately.

Incentivized