/phishing

name: "KnowBe4 Phishing"
description: >
  KnowBe4 phishing simulations: campaign creation and lifecycle, security test
  management, recipient interaction tracking (sent, opened, clicked, reported),
  phish-prone percentage calculation, template selection, landing pages, and
  click tracking.
when_to_use: >-
  When creating, managing, or analyzing KnowBe4 phishing simulation campaigns. Use when:
  knowbe4 phishing, phishing campaign, phishing simulation, phish-prone percentage, security test
  knowbe4, phishing template, click tracking, phishing results, simulated phishing, phishing
  report, recipient tracking, phishing landing page, or phishing test.

KnowBe4 Phishing Simulation Management

Overview

KnowBe4 phishing simulations are the core mechanism for testing and improving an organization's resilience to social engineering attacks. Campaigns deliver simulated phishing emails to users and track their interactions -- whether they opened the email, clicked the link, submitted data on the landing page, reported it via the Phish Alert Button, or took no action. The phish-prone percentage is the key metric derived from these campaigns.

Anti-triggers

• **A real phishing email that reached a user** — every campaign,

click, and "failure" here is a simulation the MSP sent on purpose. Genuine inbound phishing is detected by the mail-security vendor: `proofpoint-tap`, `avanan-threats`, or `abnormal-security-threats`.

• **Finding, releasing, or pulling a message out of a mailbox** —

KnowBe4 never touches production mail flow. Use `proofpoint-quarantine` or `avanan-quarantine` to release, and `proofpoint-forensics` to remove delivered mail.

• **"Phish Alert Button" reports as a threat-intake queue** — this

skill counts PAB reports as a pass/fail signal on a simulation; the real user-reported phishing triage queue is `ironscales-incidents`.

• **Enrolling the users who failed into remedial training** — the

enrollment side is `knowbe4-training`.

• **Organization-wide phish-prone percentage or department

breakdowns** — per-campaign results are here; rolled-up metrics and benchmarks are `knowbe4-reporting`.

Key Concepts

Campaign Lifecycle

CREATED ──> SCHEDULED ──> IN_PROGRESS ──> COMPLETED
                │                              │
                └──── CANCELLED                └──> ARCHIVED

• **Created**: Campaign configured but not yet scheduled
• **Scheduled**: Campaign queued for delivery at a specific date/time
• **In Progress**: Emails are being sent and interactions tracked
• **Completed**: Campaign delivery finished, final results available
• **Cancelled**: Campaign aborted before completion
• **Archived**: Completed campaign moved to archive

Security Test Types

| Type | Description | Use Case | |------|-------------|----------| | **Phishing** | Standard email with link to landing page | Most common, baseline testing | | **Vishing** | Voice-based social engineering simulation | Phone-based attack awareness | | **Smishing** | SMS-based phishing simulation | Mobile threat awareness | | **USB** | Physical USB drop test | Physical security awareness | | **QR Code** | QR code-based phishing | Emerging threat vector |

Recipient Interaction States

Each recipient in a campaign progresses through trackable states:

| State | Description | Indicates | |-------|-------------|-----------| | **Delivered** | Email successfully delivered | Baseline count | | **Opened** | Recipient opened the email | Curiosity/engagement | | **Clicked** | Recipient clicked the phishing link | Failed the test | | **Replied** | Recipient replied to the email | Failed the test (data leakage risk) | | **Attachment Opened** | Recipient opened an attachment | Failed the test | | **Macro Enabled** | Recipient enabled macros in attachment | Critical failure | | **Data Entered** | Recipient submitted data on landing page | Critical failure | | **Reported** | Recipient reported via Phish Alert Button | Passed the test | | **No Action** | No interaction recorded | Neutral (may not have seen it) |

Phish-Prone Percentage Calculation

The phish-prone percentage (PPP) is the primary metric for organizational risk:

function calculatePhishPronePercentage(campaign) {
  const totalDelivered = campaign.recipients.filter(r => r.delivered).length;
  const totalFailed = campaign.recipients.filter(r =>
    r.clicked || r.replied || r.attachmentOpened || r.macroEnabled || r.dataEntered
  ).length;

  if (totalDelivered === 0) return 0;
  return ((totalFailed / totalDelivered) * 100).toFixed(1);
}

**Industry Benchmarks:** | PPP Range | Rating | Context | |-----------|--------|---------| | 0-5% | Excellent | Well-trained organization | | 5-15% | Good | Regular training in place | | 15-30% | Average | Industry baseline for new programs | | 30-50% | Poor | Needs immediate attention | | 50%+ | Critical | High-risk organization |

Field Reference

Campaign Fields

| Field | Type | Description | |-------|------|-------------| | `campaign_id` | int | Unique campaign identifier | | `name` | string | Campaign name | | `status` | string | Current status (created, scheduled, in_progress, completed) | | `create_date` | datetime | When campaign was created | | `start_date` | datetime | Scheduled start date | | `end_date` | datetime | Campaign end date | | `duration_type` | string | How long the campaign runs (e.g., one_week, two_weeks) | | `send_duration` | string | Email delivery spread period | | `track_duration` | string | How long to track interactions after delivery | | `frequency_type` | string | One-time, weekly, bi-weekly, monthly | | `phishing_template_id` | int | Template used for the phishing email | | `landing_page_id` | int | Landing page shown after click | | `groups` | array | Target groups for the campaign |

Phishing Security Test (PST) Fields

| Field | Type | Description | |-------|------|-------------| | `pst_id` | int | Unique se