Item: KnowBe4 PhishER/PhishER Plus
Rating: 8
Author: Amber Li

Overall Satisfaction with KnowBe4 PhishER/PhishER Plus

Use Cases and Deployment Scope

We currently use PhishER to retroactively scan and block malicious emails that are reported by end users. Since we do not have a third party email gateway in place, KnowBe4's PhishER product is used to bridge the gap in our security posture. This product addresses the constant influx of phishing and spam emails that our users are inundated with on a daily basis.

Pros and Cons

Pros

Simple user interface
Automation
Third party integration
Reporting

Cons

Implementing the email blocklist into automated workflows
Consolidating reported emails in the inbox view by IP, attack type, subject
Scan function occasionally reports email as unknown, which requires manual remediation
More categories for threat emails (credential harvesting, social engineering, threat, phishing, malware, etc)

Return on Investment

Freed up incident response resources
Mitigating effects of phishing campaigns on our organization
Reduced manual work to identify and mitigate email threats on the admin side
Isolated email threats more quickly and accurately

Time Savings

KnowBe4 PhishER has saved our organization time on identifying, isolating, and responding to email threats that currently affect our end users on a daily basis. It has reduced manual work on the admin side and made it easier for admins to get a more accurate and holistic scope of the phishing campaigns that currently target our organization.

PhishER Capabilities

We are currently using KnowBe4 PhishML, PhishRIP, and PhishER Blocklist to automate remediation of known threats from end users' mailboxes. We make the most use out of PhishML and PhishER Blocklist. PhishRIP is used to a lesser extent, and typically that is because admins don't have the time to properly manage it.

These additional capabilities that KnowBe4 PhishER offers have made it easier to get actionable insights from reported emails and sync that information back to our Office 365 Defender platform for blocking future campaigns from the same sender.

Alternatives Considered

Arctic Wolf Managed Security Awareness

Arctic Wolf also offers a similar product to PhishER using their Phish Tell engine. However, it was severely lacking in terms of workflow automation. Switching to Arctic Wolf's email reporting and response product would have increased the number of manual hours spent on email security and ensuring that end users were informed of whether the email they reported was malicious or clean.

Key Insights

Do you think KnowBe4 PhishER/PhishER Plus delivers good value for the price?

Yes

Are you happy with KnowBe4 PhishER/PhishER Plus's feature set?

Yes

Did KnowBe4 PhishER/PhishER Plus live up to sales and marketing promises?

Yes

Did implementation of KnowBe4 PhishER/PhishER Plus go as expected?

Yes

Would you buy KnowBe4 PhishER/PhishER Plus again?

Yes

Other Software Used

KnowBe4 Security Awareness Training, CrowdStrike Falcon, Horizon3.ai, Lansweeper, IBM Security QRadar EDR, Microsoft Entra ID Protection

Likelihood to Recommend

KnowBe4 PhishER is well suited for businesses that already use KnowBe4 Security Awareness Training and are looking to increase engagement from users in reporting suspicious emails. It is a good product that helps fill the gaps in any existing email security products that businesses are using. However, it is not a solution that would stop malicious emails from reaching the end user. It does rely on end users being able to identify suspicious emails and reporting them for the product to obtain actionable insights.

KnowBe4 PhishER/PhishER Plus Feature Ratings

Comments

Please log in to join the conversation