Odebrecht Engenharia & Construção

KnowBe4 Delivers High-Quality Security Awareness Training

Before implementing KnowBe4 training, Odebrecht deployed training campaigns with in-house developed content about information security via email. “The material was available in Portuguese for 30 days. We then translated it into a second language—Spanish—and only after another 30 days were we able to publish the content in a third language—English. This meant a delay of 60 days between delivery training from the first and last group of users,” says Renato Sobral, Information Security Manager at Odebrecht.

Odebrecht spent two years trying out security awareness training and simulated phishing platforms—paid and open source—but none of them met the organization’s demands for technical support and specific resources.

“None of them had the quantity and quality of content and resources like the KnowBe4 Platform. Additionally, these other platforms were not strong in terms of data reporting and analysis, and did not support email being sent to a large number of domains automatically,” Sobral says.

In January 2023, Odebrecht began the implementation of the KnowBe4 Platform and planning the training campaigns with the support of AK Networks, one of KnowBe4’s partners in Brazil.

In April, Odebrecht’s IT security department ran the baseline simulated phishing test, which got a significantly high rate of users clicking on the phishing test email. Three months later, during the second simulated phishing test, this rate dropped over 80%.

“It took three months to implement the KnowBe4 Platform, which is very user-friendly, and set up the training sessions,” says Sobral, adding that “no doubt, the KnowBe4 training and simulated phishing platform had a significant impact on improving the rates and general awareness of our users in terms of security culture.”

Sobral emphasizes that the quantity and quality of content available in the KnowBe4 Platform are differentiators. “As soon as we launched the first training, we started to receive great feedback from our users, praising the materials for being intuitive and pleasant to deal with,” Sobral says. “I believe that the quality of the content engages users to complete their training.”

Security Awareness Training Tied with Onboarding Yields Greater IT Productivity

Odebrecht deploys training on the KnowBe4 Platform to comply with annual training requirements and to ensure new hires get the needed training when they start at the organization.

“In addition to the four security awareness training modules that we have established as a standard for all users, we also use the Policy Management feature within the KnowBe4 Platform. When a new employee starts working at Odebrecht, we use the platform to distribute our internal security policies and track our users’ acknowledgments, which they are required to read and accept within 30 days. If that does not happen, the manager is automatically notified,” Sobral says.

The KnowBe4 Platform also enables Odebrecht to automate dynamic user groups to receive security awareness training, which helps manage the high turnover rate inherent in construction projects.

“People come and go as construction projects start and end. The KnowBe4 Platform allows us to deactivate users in a very simple way, in addition to establishing settings associated with languages, worker release dates, leaves and vacations to determine which users should or should not receive each type of training,” Sobral says.

Among the many features offered by KnowBe4, Sobral highlights the Phish Alert Button (PAB), which allows users to quickly report a suspicious email to the information security department.

Sobral stresses that the PAB is extremely helpful in the IT team’s productivity.

“Early on, we installed the PAB plug-in in every user’s Outlook,” Sobral says. “We ran an internal awareness campaign, and today, with one click, they can report the suspected phishing email, which is then deleted from the user’s inbox, avoiding the risk of accidental opening at a later time.”

Odebrecht’s information security department is currently made up of a reduced team, Sobral says. Only a few of them are in charge of security awareness campaigns, and even then, they are not required to dedicate 100% of their time to it. The team’s small size makes the KnowBe4 Platform’s automated features crucial for success, Sobral says.

“The effort to conduct an awareness program without automation would require at least four dedicated people,” Sobral says.