/reporting

name: "KnowBe4 Reporting"
description: >
  KnowBe4 security awareness reporting: phishing summary statistics, training
  completion rates, risk score overviews, trend analysis, organizational
  benchmarks, and executive dashboards, including how to interpret metrics and
  communicate posture to stakeholders.
when_to_use: >-
  When generating or interpreting KnowBe4 security awareness reports. Use when:
  knowbe4 report, knowbe4 reporting, security awareness report, phishing summary, training
  completion rate, risk overview, trend analysis, knowbe4 metrics, knowbe4 dashboard, security
  posture report, awareness metrics, executive report knowbe4, or compliance report.

KnowBe4 Security Awareness Reporting

Overview

KnowBe4 reporting provides visibility into an organization's security awareness posture through phishing simulation metrics, training completion data, and risk scores. Effective reporting translates raw data into actionable insights for security teams, management, and compliance stakeholders. This skill covers how to retrieve, interpret, and present KnowBe4 metrics.

Anti-triggers

• **An "email security report" covering threats actually blocked** —

every metric here measures simulations and training, not real attacks. Threats stopped in production are `proofpoint-tap`, `avanan-threats`, or `abnormal-security-threats`.

• **One campaign's results or one person's risk score** — this skill

returns account-, department-, and trend-level aggregates; the per-object detail sits in `knowbe4-phishing`, `knowbe4-training`, or `knowbe4-users`.

Key Concepts

Core Metrics

| Metric | Definition | Target | |--------|-----------|--------| | **Phish-Prone Percentage (PPP)** | % of users who failed phishing tests | Below 5% after 12 months | | **Training Completion Rate** | % of enrolled users who completed training | Above 95% | | **Average Risk Score** | Mean risk score across all active users | Below 30 | | **Reporting Rate** | % of phishing tests reported via PAB | Above 70% | | **Click-to-Report Ratio** | Ratio of clicks to reports | Below 0.5:1 | | **Time to First Click** | Average time from delivery to first click | Increasing over time |

Metric Interpretation Guide

**Phish-Prone Percentage (PPP):**

PPP = (Users who failed / Users who received test) * 100

Interpretation:
- Decreasing PPP = Training is working
- Flat PPP = Need to change training approach
- Increasing PPP = New threats, new employees, or stale training
- Sudden spike = Especially effective phishing template

**Training Completion Rate:**

Completion Rate = (Completed enrollments / Total enrollments) * 100

Interpretation:
- Below 80% = Enforcement issue, need manager involvement
- 80-95% = Normal range, follow up on stragglers
- Above 95% = Excellent compliance
- 100% = Verify data -- may indicate auto-completion

**Risk Score Trends:**

Risk Trend = Current avg risk score - Previous period avg risk score

Interpretation:
- Negative trend = Improving (good)
- Flat trend = Plateau, consider changing approach
- Positive trend = Degrading, investigate cause

Reporting Timeframes

| Timeframe | Use Case | Audience | |-----------|----------|----------| | **Weekly** | Operational monitoring, active campaign tracking | Security team | | **Monthly** | Trend analysis, department comparisons | Security manager | | **Quarterly** | Executive summary, compliance reporting | Leadership, auditors | | **Annual** | Year-over-year progress, program justification | Board, C-suite |

Industry Benchmarks (2024)

| Metric | Small (<250) | Medium (250-1000) | Large (1000+) | |--------|-------------|-------------------|---------------| | Initial PPP | 32.4% | 30.1% | 31.5% | | PPP after 90 days training | 17.6% | 16.4% | 15.2% | | PPP after 12 months | 5.4% | 4.8% | 4.5% | | Training completion | 87% | 91% | 93% | | PAB reporting rate | 45% | 52% | 58% |

Field Reference

Account-Level Summary Fields

| Field | Type | Description | |-------|------|-------------| | `total_users` | int | Total active users | | `current_risk_score` | float | Organization-wide average risk score | | `phish_prone_percentage` | float | Organization-wide PPP | | `total_phishing_campaigns` | int | Total phishing campaigns run | | `total_training_campaigns` | int | Total training campaigns run |

Phishing Summary Fields

| Field | Type | Description | |-------|------|-------------| | `total_campaigns` | int | Number of phishing campaigns | | `total_tests_sent` | int | Total phishing emails delivered | | `total_clicked` | int | Total clicks across all campaigns | | `total_reported` | int | Total reports via PAB | | `overall_ppp` | float | Overall phish-prone percentage | | `ppp_by_department` | object | PPP broken down by department | | `ppp_by_location` | object | PPP broken down by location | | `ppp_trend` | array | PPP over time (monthly) |

Training Summary Fields

| Field | Type | Description | |-------|------|-------------| | `total_campaigns` | int | Number of training campaigns | | `total_enrollments` | int | Total user enrollments | | `completed` | int | Number completed | | `in_progress` | int | Number in progress | | `not_started` | int | Number not started | | `past_due` | int | Number past due | | `completion_rate` | float | Overall completion percentage | | `average_time_spent` | int | Average seconds spent on training | | `completion_by_department` | object | Completion broken down by department |

MCP Tools

| Tool | Description | Parameters | |------|-------------|----------------| | `knowbe4_account_get` | Account-level summary: subscription level, seats, admin details, current risk score | none | | `knowbe4_account_risk_score_history` | Account risk score over time | `page`, `per_page` | | `knowbe4_reporting_phishing_summary` | Aggregate phishing stats: total tests, delivered/opened/clicked/reported, average PPP, click and report rates | `page`, `per_page` | | `