Security operations teams face a constant balancing act: stopping sophisticated email threats, maintaining visibility across their attack surface and keeping administrative workflows running smoothly. When security tools operate in silos or rely on rigid, manual processes, friction builds up quickly. This friction consumes valuable time that analysts could spend on higher-priority initiatives.

At KnowBe4, we believe enterprise security should work for you, without the enterprise-grade costs. That’s why we’re introducing three major enhancements across Defend: automated Security Awareness Training (SAT) integration, redesigned Dashboard Intelligence and Natural Language Search.

Together, these updates deliver an ecosystem that automatically aligns awareness training with threat defense, elevates executive-level threat reporting and simplifies incident triage using AI.

1. Seamless Security Awareness and Email Defense

Managing phishing simulations and inbound email defense used to require constant administrative maintenance. Security teams spent valuable hours manually configuring allow/deny lists to ensure simulation emails reached inboxes without triggering security banners or accidental quarantine.

The Automated SAT-Defend Ecosystem

We’ve built a direct, automated connection between KnowBe4 SAT and Defend. When a phishing simulation campaign launches, SAT automatically signals Defend with the necessary metadata, including enrolled users, simulation indicators and campaign timelines.

Key Capabilities:

• Zero Manual Allow/Deny Lists: Defend automatically identifies active simulation campaigns and configures handling rules for enrolled users on the fly.
• Granular Handling Tiers: Admins can select exactly how Defend treats simulation emails during an active campaign, ranging from suppressing all banners to displaying benign or educational Teachable Moment alerts.
• Automatic Expiration and Cleanup: As soon as the simulation window closes, Defend automatically reverts handling logic back to default policies.
• User-Scoped Application: Rules apply exclusively to active campaign participants rather than affecting the entire tenant.

By connecting awareness training directly to real-time defense mechanisms, organizations ensure a precise, frictionless training experience without administrative overhead.

2. Defend Dashboard Intelligence: Actionable Context at a Glance

Threat volume metrics alone don't tell the whole story. Security leaders need clear context on who is targeting the organization, how authentication mechanisms are performing and what assets are at risk.

Our redesigned Dashboard Intelligence connects the dots across your entire email surface, revealing deep threat context in a visually streamlined console ready for executive review.

What's New:

• Authentication Health Monitoring: Instant visibility into SPF, DKIM, and DMARC alignment to identify vector gaps before bad actors exploit them.
• Geographic Attack Origins: Visual mapping of inbound attack sources and infrastructure trends.
• Top Impersonated Brands: Clear telemetry showing which trusted brand identities attackers are leveraging to deceive end users.
• Malicious File Type Trends: Breakdown of payload formats being actively stopped by Defend's behavioral AI engines.

Instead of spending hours manually compiling logs into slide decks, admins gain a polished, boardroom-ready display that highlights security ROI and operational posture in real time.

3. AI-Native Investigation with Natural Language Search

As email volume and attack complexity scale, speed is the key metric for effective incident response. Traditional investigation workflows often force analysts through complex, nested filtering menus to find a single message or threat pattern.

Defend now features an AI-native Natural Language Search interface, bringing conversational flexibility directly to your threat investigation workflows.

Why Natural Language Search Changes the Workflow:

• Instant Filter Translation: Type queries naturally, such as "Show me all dangerous emails containing PDFs sent to Executives this week", and Defend automatically parses, formats and applies the precise search criteria.
• Eliminated Cognitive Friction: Move seamlessly from detection to triage without navigating space-heavy dropdowns or manual logic toggles.
• Faster Incident Response: Drastically reduces Mean Time to Triage (MTTT), enabling security teams to pinpoint, analyze and remediate threats in seconds.

The Unified Advantage

These updates reflect our ongoing commitment to building an intelligent, interconnected security ecosystem. By automating administrative tasks between training and defense, expanding visual threat intelligence, and streamlining investigations with AI-driven search, KnowBe4 Defend empowers your security team to stay ahead of evolving threats while operating at peak efficiency.

All three capabilities are rolling out to the KnowBe4 console this week. Contact your representative or explore the console today to see how these features transform your security operations.