Review · Awareness training · Not scored
KnowBe4 review: security awareness training, and why we do not score it here
KnowBe4 trains the whole workforce to spot and report threats, with a library of 1,000+ modules, videos and games and simulated phishing. That is a different job from exercising the incident response team, so it is listed but not scored. Most organizations buy both kinds of product.
Editorial assessment · Assessed from vendor sites, product pages and published pricing, September 2026
Not scored
Our readiness score measures how well a platform exercises the people who respond to an incident. KnowBe4 trains everyone else to avoid causing one and to report it early. Scoring it on realism of a breach exercise or technical depth would be unfair to it and useless to you.
Editorial verdict
Buy it for employee behaviour. Do not expect it to rehearse your incident commander, counsel or board.
| Fact | Detail | Source |
|---|---|---|
| Category | Security awareness training, simulated phishing, human risk management | knowbe4.com |
| Library (vendor-stated) | 1,000+ modules, videos and games | knowbe4.com |
| Customers (vendor-stated) | 70,000+ | knowbe4.com |
| Other products | Email security, real-time coaching, compliance training, AI Defense Agents | knowbe4.com |
| Price | Not published on the pages we reviewed | knowbe4.com |
6-1What does KnowBe4 do?
KnowBe4 sells security awareness training and simulated phishing to organizations of every size, with email security and AI-driven coaching alongside. The vendor states it has more than 70,000 customers.
6-2How is awareness training different from incident response training?
Awareness training targets every employee and aims to change everyday behaviour: fewer clicks, faster reports. Incident response training and exercises target a small group, the people who run an incident, and aim to make their decisions faster and better. The two sit in different cells of the exercise matrix and are usually bought from different vendors.
6-3When does a CISO need both?
Almost always. An awareness program reduces how often the response team is called; an exercise program improves what happens when it is. Budget them separately.