The dashboard breaks down the dangerous, suspicious, and graymail, then Spam, and you can click into each category without having to load an entire list then filter afterwards. The allow/Deny list it has built in is also very useful and can be added with a click, along with the URL rewriting - however I would suggest you also manually add the allow/deny rules for addresses and domains that you put into KB4 defend, in your exchange in case you ever switch security tools so that you dont lose them. I also like that it has the ability to insert the colorful banners to alert users of what kind of topics or dangers are present in the email. Another great feature is that when you first roll it out, it can be to just a target group, or everyone, and you can enable silent mode so that it doesnt start putting banners into all your emails until its ready and has learned your environment better. There is an investigate function of the review emails section, where on each email you can see where in the users mailbox the email currently sits, whether or not the user has clicked any links or replied, and you can view the email in the defend dashboard too, really make the tool extremely useful for troubleshooting and review.
March 18, 2026
1) The Defend Portal confuses the resolution and the remediation. I can manually set the resolution, but not the remediation. I can search on remediation, but not resolution. 2) Defend sends me an email every time it sees something to remediate; however, the majority of them are automatically remediated and quarantined. I don't need to be notified of those, only the ones they didn't automatically remediate, i.e. the ones I need to take action on. 3) The connection between Defend and the KnowBe4 platform is not mature. I knew that going in and expect them to resolve it. The sooner the better. 4) PhishER is difficult to resolve issues in. The Queries take a long time and the result is not clear. I'll query off of a particular reported email and ask that all emails found be quarantined. The query will return 0 of 0. Did it not include the original email? Did that original email get quarantined? 5) The products are so new to the KnowBe4 team that the training has not been smooth. And the people trying to step me through the issues don't always know what the product can and can't do and don't know best practices in using the products, especially Defend and PhishER together.
March 18, 2026