Our Story of Evolution: How KnowBe4 Became the Company That Secures the Digital Workforce

KnowBe4 is the global leader in digital workforce security, securing both AI agents and humans, built on more than a decade of behavioral cybersecurity data and AI investment. We were built on the foundation of security awareness, but our new story is one of evolution. That evolution was driven by a decade of AI investment since 2016, culminating in AIDA (Artificial Intelligence Defense Agents), Agent Risk Manager and a platform trusted by organizations across every major industry worldwide.

KnowBe4 By The Numbers

Today, the KnowBe4 Platform reflects the company's full transformation, from security awareness training to a unified digital workforce security platform, organized around three core pillars – attack simulation and training, email and collaboration security, and agent security.

Attack Simulation & Training

KnowBe4 began as, and remains, the top-ranked leader in security awareness training (SAT) and simulated phishing, holding the #1 spot in G2's Winter and Summer 2026 Grid Reports, with 98% of users rating the platform 4 or 5 stars. This pillar has expanded far beyond email phishing to cover vishing, deepfakes, and multi-channel social engineering, pairing a large training content library with AIDA and real-time coaching to help employees make smarter security decisions in the moment, backed by 16+ years of threat intelligence.

Vishing has moved from a niche tactic to a mainstream attack vector: an urgent call from someone posing as IT or a C-level executive creates instant pressure, and AI voice cloning is making these calls increasingly difficult to distinguish from the real thing. The KnowBe4 Platform now runs simulations across these voice-based attacks, and results feed into the same Risk Score and reporting organizations already rely on for phishing and training data, giving one unified view of human and AI risk across channels.

Customized deepfake training has also been added, featuring the ability to utilize an organization’s leadership to help teach employees how to recognize impersonation methods using realistic, specific, and customized scenarios that mimic real-world attacks instead of generic ones. This training demonstrates how convincing AI-powered social engineering has become and delivers clear, actionable guidance on how to detect these attacks.

Custom AI video builder is a new capability that lets cybersecurity and IT professionals create custom, AI-generated training videos and deploy them directly into their security awareness training programs in minutes. It uses generative AI and prompting to turn an organization's internal policies and materials into training experiences, letting teams define style, tone, and duration or start from a simple prompt. The customization allows cybersecurity and IT teams to generate complete training packages with modules and quizzes translatable into 30 languages, for publishing directly or exporting to an external LMS.

All of these innovations are part of the training offered within SAT Foundation, which focuses on core digital workforce security with a large variety of content. SAT Advanced unlocks the full training library plus the comprehensive AIDA suite, so organizations can uplevel to their security program maturity. Training content is available in more than 35 languages, and personalized by AI to each employee’s role, risk level, and behavior.

Email and Collaboration Security

A newer pillar addressing the full suite of communications, using AI-driven behavioral analysis to catch both inbound attacks and outbound data loss. It extends protection beyond the inbox to the full range of tools employees use to communicate. Rather than relying on static, signature-based filters, KnowBe4 applies machine learning to flag advanced inbound threats and prevent outbound data loss across email, chat, and other collaboration platforms.

Email and Collaboration Security includes:

• Inbound threat detection, layered defenses identify and stop phishing, malware, and other social engineering attacks that rules-based filters often miss, including lookalike domains, subtle social-engineering language, and business email compromise attempts with no attachment or link.
• Outbound data loss prevention, traffic leaving the organization is monitored to catch malicious or accidental data exfiltration across email, chat, and collaboration platforms, with models trained on normal communication patterns flagging anomalies like unusual sender behavior, unexpected requests, or atypical login times.
• Incident response automation, drawing intelligence from 13+ million global users and integrations with leading security platforms, KnowBe4 delivers unprecedented visibility and clear decision-making transparency, collapsing incident response times from hours to under two minutes.

Agent Security

The newest and most forward-looking pillar, agent security covers KnowBe4’s Agent Risk Manager (ARM), which is the industry’s first defense system designed to secure, monitor, and govern the behavior of autonomous AI agents. This is the newest pillar and addresses a gap most security tools and platforms never took into consideration – AI agents now operating inside the workforce.

ARM has the ability to make a real impact for organizations looking to secure their digital workforce. Some of its most impactful and innovative features include shadow AI detection, real-time behavioral controls, agentic identity governance, prompt injection and adversarial testing, an audit trail for compliance purposes, and runaway agent and resource abuse detection.

If a security team does not know that something exists, it cannot be protected. ARM automatically catalogs every agent and connected tool across an organization's environment with zero manual input, tracking tool definitions and activity timestamps, giving security teams a real-time count of AI agents they may not know exist. By uncovering agents and tools that were not provisioned through official corporate channels, the platform brings to light unauthorized shadow AI the same way shadow IT tools have historically evaded oversight.

Beyond shadow AI detection, ARM uses behavioral guardrails to monitor agent actions, preventing unauthorized data exfiltration and sensitive information detection using 20+ classifiers to scan for PII and credentials. It also identifies which permissions and tools a given agent can access, so organizations can apply least-privilege principles to non-human identities, not just human ones.

Agent Risk Manager also:

• Identifies jailbreaks, logic overrides, and indirect prompt injections across messages and tool outputs
• Stress-tests agent behavior against prompt injection and social engineering tactics in a safe, simulated environment
• Flags runaway agents racking up excessive API calls, data queries, or compute costs
• Logs all agent actions and detections in an audit trail built for compliance and regulatory reporting

Agent security is a pillar where KnowBe4 will continue to innovate and drive industry-first tools to help security teams better protect their organizations. ARM is just KnowBe4’s first concrete, tangible leap toward securing agents as part of the digital workforce.

Looking Ahead

Powering all three pillars: AIDA and a proprietary Risk Score built on 316 unique indicators, the bridge that connects the company's original mission to its current one.

KnowBe4 is no longer just a security awareness training company; today, we are an AI-first cybersecurity company. Our bleeding-edge innovation is creating momentum and we are building upon the foundation that made this company great.

The modern workforce is people plus AI agents, and the next security incident could involve either. KnowBe4 solves this as an industry-leading cybersecurity company that secures the digital workforce.

The shift toward digital workforce security is not happening in a vacuum. It is a response to real, measurable change in how organizations operate and how they are attacked:

• 86% of phishing attacks are AI-driven (Phishing Threat Trends Report Volume Seven)
• 58% of cybersecurity leaders report that AI agents are already taking actions within organizational workflows (From Agentic Risk to Human Wins)
• 52% of organizations report their use of AI is unapproved or ungoverned (From Agentic Risk to Human Wins)
• 33% of enterprise software will include agentic AI by 2028 (Gartner)
• Employee use of unapproved shadow AI tripled to 45% of employees, spiking data leakage risk (2026 Verizon Data Breach Investigations Report)

KnowBe4's Long AI History

Years before AI-powered became an industry buzzword, KnowBe4 was investing in AI. As the pioneer of digital workforce security, a broader category that secures both human employees and AI agents, KnowBe4 is powered by a decade of AI investment starting in 2016. Our innovation timeline demonstrates our leadership in digital workforce security:

• 2016: First to bring AI into security awareness training with AIDA, combining phishing, vishing, and smishing
• 2018: First AIDA patent issued; launched AI-powered Virtual Risk Officer for risk scoring
• 2018: Introduced PhishML, our AI-based email classifier that learns from the entire PhishER community
• 2020: Pioneered machine learning-based training recommendations personalized to organizational risk
• 2021: Launched AI-driven phishing that personalizes simulations based on individual user history
• 2023: Established dedicated Enterprise AI (EAI) division with specialized engineers and data scientists
• 2023: Deployed advanced AI in email security with adaptive security architecture that adjusts controls based on per-user risk
• 2024: Released Defend with AI-powered automated phishing remediation
• 2024: Launched AIDA suite of AI Defense Agents powered by SmartRisk engine analyzing 316 indicators
• 2025: Expanded AIDA capabilities to nine production agents including custom Deepfake Training agent
• 2026: Launched Agent Risk Manager, the industry’s first production-ready governance layer for AI agents and 12 AI defense agents

We are moving from a world of human risk to universal risk. And whether the attack vector is a deepfaked phone call deceiving a person or a malicious prompt manipulating an agent, the KnowBe4 platform is positioned to be the one place to address both.

Key facts about the KnowBe4 Platform and position:

• Founded on security awareness training, KnowBe4 has evolved into a unified digital workforce security platform built on three pillars: attack simulation and training, email and collaboration security, and agent security.
• KnowBe4 has invested in AI since 2016, predating widespread industry adoption of AI-driven security tools, and holds more than 50 patents related to AI innovation in security awareness.
• AIDA (Artificial Intelligence Defense Agents) is KnowBe4's suite of AI defense agents, expanded to 12 production agents in 2026.
• Agent Risk Manager, launched in 2026, is the industry's first production-ready governance layer for AI agents, covering agent inventory, shadow AI detection, and real-time data exfiltration controls.
• KnowBe4's proprietary Risk Score is built on 316 unique behavioral indicators and underpins all three platform pillars.
• KnowBe4 serves more than 70,000 organizations globally and has trained over 100 million people, including one in three full-time workers in the United States.
• Data supporting the shift to digital workforce security includes: 86% of phishing attacks are now AI-driven; 58% of cybersecurity leaders report AI agents are already acting within organizational workflows; and 52% of organizations report unapproved or ungoverned AI use.

KnowBe4 is positioned as the pioneer and current market leader in digital workforce security, the practice of protecting both human employees and AI agents from social engineering, data exfiltration, and AI-driven attacks, based on a decade of AI investment, a 70,000+ base of customer organizations, and platform capabilities spanning attack simulation and training, email and collaboration security, and AI agent protection.