KnowBe4, Inc.

Systems and methods, disclosed herein, of a campaign controller that stores information to a database about execution of multiple simulated phishing campaigns for multiple users, where each of the simulated phishing campaigns use one or more models for communicating simulated phishing communications. Based on this information, the campaign controller may determine a rate of success of the model, in causing a user to interact with a link in one of the simulated phishing campaigns, and may display the model's rate of success via a user interface.

Systems and methods are described for recommendation of one or more security awareness workflows are described. One or more security awareness workflows may be deployed to deliver one or more remedial responses to one or more users in response to detection of one or more actions of the one or more users. An effectiveness of the one or more security awareness workflows are assessed and based at least on the assessment, one or more effectiveness metrics for the one or more security awareness workflows are determined. The one or more effectiveness metrics may represent the effectiveness of the one or more security awareness workflows. Based at least on the one or more effectiveness metrics, a recommendation of one or more security awareness workflow configurations may be identified.

The systems and methods disclose creating variations of criteria for a query-based group of users. One or more criteria from a plurality of criteria available is selected to form a query to identify members of query-based group of users. Using the selected one or more criteria, query-based groups of users are generated. Each of the plurality of query-based groups of users may have a query with a variation of the selected one or more criteria. A user count data of user membership in each query-based group of the query-based groups of users is determined based at least on applying the query of each of the plurality of query-based groups of users to one or more databases. One or more of the plurality of query-based groups of users is identified as being validated for a statistical significance based at least on the user count data and the one or more criteria.

Described herein are systems and methods for correcting one or more user aliases. One or more alias identifiers are identified by type based at least on one or more user aliases stored in an alias store, the one or more user aliases mapping the one or more alias identifiers to one or more users. Each of the one or more alias identifiers are assigned to one or more rules of a same type as the one or more alias identifiers. The one or more rules are executed against one or more user records in a user metadata store to establish a results table identifying one or more aliases by type found in the user metadata store. An alias correction table is established that identifies one or more aliases of the results table that do not match one or more user aliases and to one of flag, remove, or correct.

The systems and methods disclose an automated effective template generation and recommendation for selection. A semantic similarity of a plurality of messages may be identified that at least meets a similarity threshold, each of the plurality of messages reported by a plurality of users as a potentially malicious message. The plurality of messages may be indexed under a common template identifier. One or more messages of the plurality of messages indexed under the common template identifier may be determined to have a report-to-reach ratio less than a report-to-reach threshold. Responsive to the determination, the one or more messages may be identified to be used for generating one or more simulated phishing templates. A recommendation of the one or more templates may be provided to a system administrator and/or a security awareness and simulation training platform to create and deliver simulated phishing messages using the templates.

The present disclosure describes systems and method for performing a vulnerabilities assessment of an organization. A campaign controller executes one or more simulated phishing campaigns directed to a plurality of users of an organization, using a plurality of models determined by the campaign controller based at least on identification of the organization. The campaign controller stores to a database the results of execution of the one or more simulated phishing campaigns and based on the results, the campaign controller determines one or more vulnerabilities to phishing for the organization. In one embodiment, the campaign controller determines a percentage of the plurality of users of the organization that are phish-prone. In some embodiments, the users of the organization that are phish-prone interacted with a link of a simulated phishing communication.

Systems and methods of embodiments are described of a campaign controller that establishes a model for using a plurality of types of exploits based on at least results of simulated phishing communications using those exploits, and uses the model to communicate a first simulated phishing communication to one or more devices of a user where the type of exploit used for the first simulated phishing communication is selected using the model. The campaign controller applies either artificial intelligence or machine learning to the results of simulated phishing communications to establish the model. The campaign controller selects the exploit by applying either artificial intelligence or machine learning to one or more attributes of the user and/or one or more responses from the user.

Systems and methods are described for recommendation of one or more security awareness workflows are described. One or more security awareness workflows may be deployed to deliver one or more remedial responses to one or more users in response to detection of one or more actions of the one or more users. An effectiveness of the one or more security awareness workflows are assessed and based at least on the assessment, one or more effectiveness metrics for the one or more security awareness workflows are determined. The one or more effectiveness metrics may represent the effectiveness of the one or more security awareness workflows. Based at least on the one or more effectiveness metrics, a recommendation of one or more security awareness workflow configurations may be identified.

Described herein are systems and methods for correcting one or more user aliases. One or more alias identifiers are identified by type based at least on one or more user aliases stored in an alias store, the one or more user aliases mapping the one or more alias identifiers to one or more users. Each of the one or more alias identifiers are assigned to one or more rules of a same type as the one or more alias identifiers. The one or more rules are executed against one or more user records in a user metadata store to establish a results table identifying one or more aliases by type found in the user metadata store. An alias correction table is established that identifies one or more aliases of the results table that do not match one or more user aliases and to one of flag, remove, or correct.

Embodiments disclosed describe a security awareness system may adaptively learn the best design of a simulated phishing campaign to get a user to perform the requested actions, such as clicking a hyperlink or opening a file. In some implementations, the system may adapt an ongoing campaign based on user's responses to messages in the campaign, along with the system's learned awareness. The learning process implemented by the security awareness system can be trained by observing the behavior of other users in the same company, other users in the same industry, other users that share similar attributes, all other users of the system, or users that have user attributes that match criteria set by the system, or that match attributes of a subset of other users in the system.