Security Statement

Overview

As a security company built and operated by security-minded individuals, we respect your privacy and make significant effort to protect your data. We would never do anything with your data that we wouldn’t want you to do with ours.

Keeping our customers' data secure is the most important thing we do. We go to considerable lengths to ensure that all data provided to KnowBe4 is done so securely; keeping KnowBe4 systems and your data secure is fundamental to our business. Use the Trust Center to learn about our Security posture and request access to our security documentation. Before you get started, we recommend you review our Terms of Service and Privacy Policy. 

Compliance

The KnowBe4 Platform (KSAT + PhishER) maintains FedRAMP Moderate ATO (Authorization To Operate) since 11/14/2023.

All KnowBe4 products are SSAE18 SOC 2 Type 2 certified. This includes KSAT, PhishER, and SecurityCoach. If you require a copy of the full SOC 2 Type 2 report, please work with your sales representative or customer success manager. View SOC 3 report

The KnowBe4 SOC 2 assessments include all of the Trust Services Criteria:

Security

Availability

Processing Integrity

Confidentiality

Privacy

The Egress SOC 2 assessments include the Security, Availability and Confidentiality Trust Services Criteria.

Should you require a bridge letter for compliance purposes, please work with your representative or customer success manager.

You can find a copy of our recently completed Consensus Assessment Initiative Questionnaire (CAIQ) on our Cloud Security Alliance (CSA) STAR Registry page

The International Organization for Standardization 27001 Standard (ISO 27001) is an information security standard that ensures office sites, development centers, support centers and data centers are securely managed. KnowBe4 is audited against a variety of standards in the International Organization for Standardization 27001 (ISO 27001) family by its independent third party ANSI-ASQ National Accreditation Board (ANAB) accredited certifier. These standards which KnowBe4 has successfully been audited against include:

• The International Organization for Standardization 27001:2022 Standard covering information security controls
• The International Organization for Standardization 27701:2019 Standard covering privacy information management
• The International Organization for Standardization 27017:2015 Standard covering information security controls for cloud computing
• The International Organization for Standardization 27018:2019 Standard covering protecting PII in the public cloud for data processors

ISO/IEC 27701:2019 Certificate of Registration

ISO/IEC 27001:2022 Certificate of Registration

Information Security and Data Privacy Team

KnowBe4’s dedicated Information Security and Data Privacy teams hold relevant industry certifications detailed below.

Data Backups and Retention

KnowBe4 maintains one year of database backups and three years of audit and application logs. These backups are stored encrypted in accordance with the Data Encryption section listed above. To submit a data deletion request, please work with your sales representative or customer success manager.

Awareness and Training

All KnowBe4 employees complete mandatory security awareness and privacy training upon hire and at least once annually. We conduct simulated phishing and social engineering tests on an ongoing basis at least once a month. All KnowBe4 employees and contractors sign confidentiality and non-disclosure agreements upon hire and before access to company or customer data.

Business Continuity / Disaster Recovery

KnowBe4 engineers have designed highly scalable and resilient product architecture within AWS and Azure. Our products withstand sophisticated attacks and are highly adaptable. Our systems’ performance within our products’ architecture is monitored for key metrics, ensuring the load on any one system is within an acceptable range. Should any components become overloaded or experience a fault, automated processes will be executed to bring online additional temporary systems or to cycle out existing systems for new ones. Automation is built into the KnowBe4 architecture, so system monitoring, updates, and corrective actions can take place as needed with no downtime. Status and uptime monitoring

KnowBe4’s Risk Management Program is reviewed as part of KnowBe4’s annual third-party audits (FedRAMP, ISO 27001, and SOC2). View full overview of KnowBe4's Risk Management Program

Code Security and Code Updates

The KnowBe4 Research and Development (R&D) department leverages a Continuous Integration / Continuous Delivery (CI/CD) pipeline for managing code deployments. Code changes are peer reviewed, approved by separate QA staff, and tested in a staging environment before they are pushed into production. The staging and production environments are logically separated, and no data is shared between them.

Logging and Monitoring:

KnowBe4 collects audit and application logs from all systems. These logs are stored encrypted in a centralized logging facility separate from the system generating the logs. The log entries are in line with industry standards for audit trails. KnowBe4 maintains these logs for a period of three years for the business purpose of investigating past system activity.

Vulnerability Management

The KnowBe4 information security team performs the following scans at least monthly:

• Authenticated web application vulnerability scans
• OS and container scans
• Infrastructure as Code (IAC) scans
• Package/Dependency scans

In addition to the above scans, KnowBe4 maintains continuous monitoring of all systems and applications using various security tools.

All vulnerabilities found are added to a vulnerability tracking system where they are verified, triaged, and evaluated for actual risk.

CVSS and priority scores serve as our foundational metric to assess risk. KnowBe4 also leverages additional factors such as the OWASP risk rating methodology, reachability-based analysis, and exploitability to determine a more accurate likelihood and impact. This enables effective utilization of our engineering resources to focus on the security issues that represent the highest overall risk to customers.

The below SLA for remediation is applied when a vulnerability is confirmed to be reachable and exploitable:

Information relating to past and current vulnerabilities as well as their remediation status can be found in the KnowBe4 Trust Portal which is updated monthly.

Penetration Testing / Bug Bounty / Report Security Vulnerabilities

KnowBe4 participates in a paid, private bug bounty program where vetted third-party researchers conduct ongoing penetration testing of our products. If you feel you have discovered a security flaw in our system, you can sign up for the program, and we will invite you to participate. You can submit any vulnerabilities through the bug bounty program or by contacting the KnowBe4 security team directly at infosec@knowbe4.com. We encourage you to test, and we encourage you to share what you find. Security testing outside of this private program is not permitted. We do not permit any automated scanning as part of this program; the researchers are instructed to perform manual testing so as to not be disruptive.