One of the best security investments we've made so far!

We set up and change campaigns regularly to phish our own users to see where our security vulnerabilities lie within our user group. In the beginning, many users fell for the phishing attempts and were required to go through remedial training. Over time, they learn from their previous mistakes and the failure percentage has dropped drastically. We have had several months of 0% failures. Many times users have asked about an e-mail they suspected to be a phishing test only for it to be an actual phish message that they did not activate. I believe using Knowbe4's phishing program has very likely saved our organization from getting hit with ransomware through user training. It has been well worth its cost.

The constantly evolving content helps keep employees on their toes and not get used to the same phishing formats. Each time I've mixed up the content with new ones I catch a few more people but they are quick to adapt. The content creators are very creative and quick to use tricky news-worthy bait just like a real phisher would use. The advanced ones are really tricky and hard to catch... which is a good thing.

We have Active Directory integration on our network that updates the users' list at Knowbe4 on a schedule. While that is a great feature, it doesn't seem to stay working and needs to be restarted periodically. It's not really a problem since our user-base doesn't change very often. It's not difficult, it's just remembering to do it. There is a good chance that it's not a flaw in the KnowBe4 platform, it very well could be the system ours is set up on in our network that syncs the changes. I just haven't bothered with it since it isn't a big issue for me. If you don't have a large user base, you can just add and remove them individually.

By far the phishing summary at the end of each campaign showing how many and which users failed the tests is the most important for me. It helps you follow up with those users to make sure they understand why they failed the test and how to avoid failing it in the future by looking for the red flags.