Besides security awareness training, KnowBe4 sells several products under the same Terms of Service. PhishER Plus triages emails that users report. Defend and Prevent secure inbound and outbound email. Protect and Workspace provide secure messaging and collaboration and came with the Egress acquisition. KCM GRC is a compliance and risk management platform, and Agent Risk Manager monitors AI agents. PhishER Plus, Defend and Prevent use the same per-seat User metric and 3-year price terms as SAT.[1][2][3] KCM GRC, Workspace and Protect each count licences differently, as the knowledge base documents.[5][6][7] Egress subscriptions entered into from 2025-01-01 are on the KnowBe4 Terms of Service.[8]
Editions
PhishER Plus
PhishER Plus prioritizes the messages users report and quarantines malicious email across the organization. PhishRIP (email quarantine for Microsoft 365 or Google Workspace) and PhishFlip (turning reported attacks into simulated phishing campaigns) are included with a PhishER subscription. PhishFlip works together with a KnowBe4 training and phishing subscription. PhishER Plus adds a global blocklist and global PhishRIP for Microsoft 365, fed by crowdsourced threats validated by KnowBe4’s Threat Research Lab.[1] It is sold stand-alone or as an add-on for SAT customers.[12]
Defend
Defend is inbound email security. It uses AI-based phishing detection, contextual warning banners, link rewriting, QR code detection and integration with Microsoft 365 and Microsoft Defender for Office 365.[2] Some Defend features depend on the customer’s Microsoft licences, which KnowBe4 does not supply. Messaging Security accepts a range of Microsoft 365, Office 365, Teams and Dynamics 365 licences. The Messaging Security Posture Check requires Microsoft Entra ID P1. Unified Quarantine requires Microsoft Defender for Office 365 Plan 2 or an equivalent E5, A5 or G5 licence.[4] An estate licensing Defend should therefore check its Microsoft entitlements before counting on those features.
Prevent and Prevent Enterprise
Prevent is outbound email security. It warns users about misdirected email, mistyped addresses, missing BCC, first-time recipients and similar risks. Prevent Enterprise adds misdirected content detection, custom DLP policies and Microsoft Purview integration. Its custom features “require Professional Services to implement”.[3] Professional Services are ordered on a Quote or statement of work and do not auto-renew.[13] Catalog proof: Prevent Enterprise custom features require Professional Services.
Protect and Workspace
Protect (secure email) and Workspace (secure collaboration) are the Egress products referred to in the knowledge base. Protect is also sold through an online store to individual users.[6] Workspace licences are managed by the customer’s administrators in the Workspace console.[5]
KCM GRC
KCM GRC includes the Compliance Management and Policy Management modules. Risk Management and Vendor Risk Management are modules that can be added to a KCM GRC subscription. Which modules a customer can use depends on its subscription level.[7]
Agent Risk Manager
Agent Risk Manager monitors AI agents and how users interact with them, and is described as being in technical preview.[11] Early Access is limited to direct customers on US instances with SAT Advanced subscriptions.[10] No commercial metric is published. Catalog proof: Agent Risk Manager early access is limited to SAT Advanced direct customers.
Metrics
| Product | Metric | Catalog row | What KnowBe4 says |
|---|---|---|---|
| PhishER Plus, Defend, Prevent | Seat (User) | User (seat) | “MSRP USD Monthly Pricing Per Seat 3 Year Term”.[1][2][3] |
| KCM GRC | User count of counted roles | KCM GRC user count | Account, Scope, Policy, Campaign, Risk and Vendor Administrators and Contributors are counted.[7] |
| Workspace | Active account on an internally mapped domain | Workspace licence | “Only active accounts will consume licenses on Workspace.”[5] |
| Protect (online) | One-year paid licence; credits for free accounts | Protect licence and credits | “A paid license provides unlimited secure email for one year.”[6] |
Counting / floors
Per-seat products
| Product | 25-50 | 51-100 | 101-500 | 501-1000 | 1001+ |
|---|---|---|---|---|---|
| PhishER Plus | n/a | n/a | $1.50 | $1.15 | Quote |
| Defend | $5.30 | $4.90 | $4.60 | $4.00 | Quote |
| Prevent | $9.58 | $7.92 | $6.25 | $4.58 | Quote |
| Prevent Enterprise | $12.92 | $10.42 | $8.33 | $6.25 | Quote |
USD monthly MSRP per seat on a 3-year term, North America.[1][2][3] The PhishER Plus band starts at 101 seats, so no price is published for smaller organizations. Catalog SKUs: PhishER Plus (101-500 seats), Defend (25-50 seats), Prevent (25-50 seats), Prevent Enterprise (25-50 seats).
The seat rules of the Terms of Service apply to these products as to SAT. Users are capped at the purchased seats, reassignment is limited to workforce attrition, and quantities cannot be reduced during the term.[13] The price pages do not say which mailboxes a Defend or Prevent seat covers, for example shared or service mailboxes. The User definition, an individual with a unique organizational email address, is the only contractual guide (commentary).[13]
KCM GRC
KCM GRC counts only people with administrative or contributor roles. A user with several counted roles is counted once. Auditors, Vendor Users and Policy Management end users are not counted.[7] An organization can therefore distribute policies for acknowledgment to its whole workforce, or give external auditors and vendors access, without adding to the count. Catalog proof: KCM GRC counts administrative and contributor roles once per user.
Workspace
Workspace licences are calculated from the internally mapped domains and the account status, and only active accounts consume licences. The internally mapped domain is confirmed at deployment and can be changed through the Account Manager or support.[5] To count licences in use, the knowledge base says to export users, filter for active accounts on internal domains, and count them. Deactivating a user removes the licence. If there are not enough licences, the customer must buy more through the account manager.[14] External participants on other domains do not consume licences under this method. Catalog proof: Workspace licences are consumed only by active accounts on internal domains.
Protect (online store)
Sending secure email to, or receiving it from, a paid user is free and unlimited. A free account gets 25 credits for communicating with other free users. One credit is used per secure message, per large file transfer, or per recipient. When the credits run out, the user needs a paid licence, which gives unlimited secure email for one year.[6] Catalog proof: Protect free accounts get 25 credits; a paid licence gives one year of unlimited secure email.
Virtualization & partitioning
Not applicable: all of these products are hosted services licensed per person or per account.[13]
Cloud / BYOL
The FedRAMP Moderate authorization covers PhishER and PhishER Plus as well as KSAT. It does not cover KnowBe4 Cloud Email Security (Defend and Prevent), Protect, Workspace or Webform. A PhishER-only customer can buy the FedRAMP option. A customer with both KSAT and PhishER covers PhishER by buying FedRAMP for its KSAT licences.[9] Organizations that need FedRAMP for email security therefore cannot rely on these KnowBe4 products for it. Catalog proof: FedRAMP authorization applies to the whole account and is charged from renewal.
Programs
- Online store licence (Protect). The store does not auto-renew; KnowBe4 sends a reminder 30 days before expiry. Licences added later are pro-rated to a single renewal date. Online purchases can be refunded within 14 days, and App Store purchases through Apple.[6] This differs from business subscriptions under the Terms of Service, which renew automatically.[13] Catalog proof: Online store licences do not auto-renew and additions are pro-rated.
- FedRAMP-authorized environment for PhishER Plus, described above.
- Partner programs (MSP, reseller) apply as for SAT. See KnowBe4 Terms of Service, seats and renewal.
Contract terms
The Egress subscription archive lists the Egress Master Subscription Agreement versions by subscription start date. The KnowBe4 Terms of Service apply to subscriptions entered into from January 1, 2025. A customer that has renewed since its first subscription is on the latest terms unless otherwise agreed in writing.[8] In practice, an Egress contract from before 2025 moves onto the KnowBe4 Terms at renewal. After that, the KnowBe4 rules on seat caps, auto-renewal and termination apply.[13] Catalog proof: Egress subscriptions from 2025-01-01 are on the KnowBe4 Terms of Service.
Out of scope
- Quoted prices for KCM GRC and Workspace, which are not published.
- The full text of earlier Egress Master Subscription Agreement versions, which are linked from the archive page.[8]
- Microsoft licensing itself; see the Microsoft articles on this wiki for Defender for Office 365 and Entra ID.