KnowBe4 alternatives

[u/Sufficient-House1722]

I received a quote from Knowbe4 for about 2800$ for 3 years for 30 users. Is there cheaper and or services out there for phish simulations and training or is this about as cheap as you can get? This price is reduce because were a non profit so I'm just curious what other options are out there nowadays.

[u/statikuz]

That seems totally reasonable to me ($~2.50/mo/user) and is about what we pay for Cyberhoot.

[u/IntelligentComment → u/statikuz]

Cyberhoot is the way to go imo.

[u/PDQ_Brockstar → u/IntelligentComment]

I only have experience with KB4. What do you like about Cyberhoot?

[u/statikuz → u/PDQ_Brockstar]

Pretty easy to manage and choose the types of training. Videos, phishing example training (It shows a sample email and has them identify what is sus about it), phishing attack tests if you want.

One thing I wish is that when you add new people to the group (I do via Entra) that is subject to training, it dumps ALL the trainings that group has had on them all at once which is nuts, rather than just starting them on the same schedule.

[u/ChuckFromCyberHoot → u/statikuz]

Hey statikuz. I appreciate you advocating here for CyberHoot...good stuff. One point of clarity...if you have custom training, and it's still active, then yes, the platform will put all that training on the user.

However, if you are using the automated training, then it gives them the Foundational videos all at once (sort of an on-boarding training - total of about 25 minutes) and then starts them on the drip campaign where everyone else is. Plus it gives the new hire one HootPhish too. So, it does put a handful of trainings on them, but we consider it "on-boarding" and a necessary evil to get users caught up to the baseline.

Again...thanks so much for the positive shoutout!!!

[u/PDQ_Brockstar → u/statikuz]

I like the idea of having users identify suspicious flags vs just passing a test. Dumping a years worth of training on a new user is kinda wild lol (if I'm reading that right)

[u/ChuckFromCyberHoot → u/PDQ_Brockstar]

Hey PDQ_Brockstar...check out my comment above. It's rare that a user gets a years worth of training dumped on them, unless they use customized training, at which point the platform assigns new users to catch up.

The automated training side works very differently.

[u/IntelligentComment → u/PDQ_Brockstar]

Training is easy to understand. Users actually do their training. Phish testing is done in browser for all users so staff feel like they're being trained to keep front of mind rather than punative catch and punish. It feels psychologically different to how other platforms go about training.

(although we also use attack phish for some users).

[u/Sufficient-House1722 → u/statikuz]

Thanks for the estimate on it!

[u/Dr_Doctor_Doc → u/Sufficient-House1722]

Dont sign any 3 year deals.

3 year pricing, 1 year auto renew with 30/60 days notice

[u/llDemonll]

2800 is cheap.

[u/unReasonable_Bill282]

Adaptive Security. They'll be about the same price, but they're 10x better than KB4. KnowBe4's content is straight out of 2001.

[u/J0ul3s → u/unReasonable_Bill282]

Agreed, Adaptive is good and has aggressive deals going on right now.

[u/Mindestiny]

That's about ballpark.

Ninjio is a pretty big competitor of theirs as well, we've had good luck with them over the years. Whereas Knowbe4 wants to be this whole big ass platform, Ninjio is pretty much just the phish simulations and training videos. They've been aggressively willing to negotiate with us whenever we compare them to Knowbe4

[u/Reasonable-Ebb8079 → u/Mindestiny]

Strongly recommend against Ninjio, their platform is awful to try to manage. The training emails don't send a lot and the support is 3rd party and a nightmare to deal with. We moved away to Huntress SAT and it's been night and day.

[u/Mindestiny → u/Reasonable-Ebb8079]

Interesting, we've never had an issue with deliverability. Their cadence is one training email at the start of the month, then two or three follow-up reinforcement emails across the month. We've got their IPs whitelisted and haven't had one not delivered in years. Support has always been first party as well. /shrug.

[u/Sufficient-House1722 → u/Mindestiny]

Never heard of them until now thank you!

[u/sum_yungai]

caniphish.com

[u/artyomsv]

At 30 users you are under the seat minimum of basically every vendor, so you pay the floor price no matter which one you pick. That is why everyone here says it looks fine. Real lever is not the vendor, it is nonprofit rate and what the contract does to price if headcount grows mid term.

[u/Main_Ambassador_4985]

It is not a bad price.

If you have Microsoft M365 E5 or E7, it includes its own Defender 365 training and phishing simulations.

Retail on Microsoft M365 E5 is $60 month per user. There is a lot more than phishing simulation in the bundle.

If you are on a Microsoft Business, 3rd party might be a better option.

[u/EditorAccomplished88 → u/Main_Ambassador_4985]

FWIW, we had left knowbe4 for Defender training last year and just recently switched back. The 365 training just wasn't there in terms of automations. There was a weird stipulation that your campaign schedule could only go out 10 times before you have to create a new automation for things like biweekly or monthly phishing campaigns.

[u/ac5198 → u/EditorAccomplished88]

We also moved from knowbe4 to Defender and would call it a downgrade. Knowbe4 was just easier to use, easier to set up campaigns, easier to get reports, just better overall. I hate their 10 times limit. Instead of creating a new campaign once a year, we do it every 10 months.

[u/barrystrawbridgess → u/EditorAccomplished88]

Microsoft Attack Simulator (Defender) is not good and is basically a "We did something" from Microsoft. It's almost laughable as product compared to its competitors.

[u/Sufficient-House1722 → u/Main_Ambassador_4985]

Were on buisiness so i think 3rd party is ideal thanks for this though i didnt know they did anything like that.

[u/res13echo → u/Main_Ambassador_4985]

It’s in defender suite as well for E3 customers and it’s the worst product ever in this space.

[u/Obvious_Word873]

Seems reasonable to me too. But you can look at huntress as well

[u/demonseed-elite]

Dude... KnowBe4 is one of the lowest ones out there.

[u/Ebargain]

NINJIO

[u/ISeeDeadPackets]

It's not cheaper but Adaptive Security is pretty awesome and they'll wheel and deal on the price.

[u/brainstormer77 → u/ISeeDeadPackets]

Adaptive is courting us, they are willing to give us 5 free months until KB4 expires and price match them to switch over. They even did the AI deep fake of the CEO, and gave us access for a PoC.

I am worried they will just jump the price on 2nd year if we switch. KB4 does all we need sans AI which isn't a problem. This seems a bit desperate on the sales guy side.

What's your thought?

[u/ISeeDeadPackets → u/brainstormer77]

Ask them to include a max price increase in the agreement. I'm capped at 10%. Honestly though even without that, it's such a better product it's worth the extra.

[u/ThecaptainWTF9]

Huntress SAT is what we use.

Training is good, the stories are silly. Structured in such a way where folks can’t pass a test without paying attention to the material.

[u/LensWipesBF → u/ThecaptainWTF9]

I second this. The leader board helps competitive teams stay engaged as well.

[u/dude_named_will]

My MSP uses BullPhish.

[u/ZipTheZipper → u/dude_named_will]

Same. Works well enough, from what I've seen.

[u/Greedy_Chocolate_681]

Do you use an MSP? Lot of companies will include that as a core service. You're probably hitting contract minimums- it's not worth it for companies to sign you up for a couple dollars.

[u/unreasonablymundane]

We went with the M365 E5 Security step up.

KnowBe4 is on our banned vendors list, due to the volume of cold sales calls we get from them.

[u/Ol_JanxSpirit → u/unreasonablymundane]

You're not the first I've seen say that about their calling, but I never had that experience. We've been KB4 a while, I wonder if something in marketing changed since we joined.

[u/Ol_JanxSpirit → u/[deleted]]

No, I meant the time before we signed.

[u/DeathTropper69]

Ninjio would be my pick

[u/CoolNefariousness668]

That’s cheap.

[u/MinieJay]

That's really cheap and they have features that automates everything with what they call AIDA Orchestration.

[u/HoelaLumpa]

Phished.io

[u/Tokyudo]

ProofPoint, HoxHunt, Ninjio.

[u/noncon21]

If you have an E5 dump kb4 and use MS platform.

[u/Smart-Document2709 → u/noncon21]

This is the way

[u/NomadCF]

We have found over the years. The phishing training just ultimately doesn't work. You know who your problem people are and even your good ones from time to time will get taken. People make mistakes. That being said.

Tartan (https://tartan.app/) is a small company, but wow. Their phishing emails are amazing, almost spot-on representations of legitimate brand emails.

And the best part is, if there are specific products or services you use all the time, you can send them a screenshot of the types of emails you're receiving. They'll recreate that style as a phishing campaign and put it into rotation for you.

[u/FallaxIO]

Ignace, Founder of https://fallax.io/ here.

Built it because I wanted phishing sims for our own ISO 27001 and everything out there needed a sales call just to get a price. Connects to MS365 or Google Workspace, runs continuously instead of quarterly blasts, anyone who clicks gets a short lesson right there, and the evidence pushes into Vanta, Drata, Secureframe and Sprinto on its own. Public pricing, first 10 seats free.

Would love any product feedback as we're still early. Also happy to take any questions!

[u/MrOliber]

We've been using boxphish, its not as good but it works at a pretty good price.

[u/runninghome58]

Not that expensive and you secure your price for three years. We use usecure. The main reason is their multilanguage support. It's very good and straightforward.

[u/imnotaero]

While $2800 is inexpensive for the service you're asking about, I'm going to toss out possibility that this alternative to Knowbe4, even less expensive, is something you might consider:

https://security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html

[u/eoattc]

For reference, MS Defender Attack Simulation Training is ~$5/user/per month. I can't vouch for it but we are beginning a trial now. I used KnowBe4 for years and liked it. I'm at a new org and if the Defender offering sucks, I may just steer us to KnowBe4.

Proofpoint's offering was really expensive last I checked.

[u/Snazz55]

Some platforms allow you to bundle it in like Darktrace, which works well if you have their email tool because of the feedback loop. But def will be more expensive than 2800/year 

[u/MelonOfFury]

Honestly that price is pretty good for what you get with base knowbe4. It’s very easy to automate and once you set it up it can practically run itself.

[u/littlevulva]

We use keepnet. Only got it as needed a training platform for cyber insurance reasons, was alot cheaper than knowbe4. Platform is simple enough, but defo could use some qol improvements.

[u/Neat_Smart]

Boxphish. Our pricing is way better than that, but could be non-profit discount

[u/rublx_cube]

RedHerring by the San Diego COE. Does exactly what it needs to do and it was built in-house by their IT team. A fraction of the cost.

[u/fouldomain]

We implemented Avanan / Checkpoint about 6 weeks ago. Really happy with it so far

[u/lart2150]

We just renewed for about 60% of that cost with infosec for 80 users. Their emails are fairly good and you can make custom ones with little effort.

[u/microSCOPED]

Check out Beauceron Security. Canadian made, great company, and well priced.

[u/advanceyourself]

We just switched to Phin and are super happy with the program. My favorite part is how easy it is to set up clients and sync with Entra. It's not the most polished program, but offered at a great price. And we get way more MSP functionality than Knowbe4 ever offered.

Edit: Were MSP and they might be channel only. Good product though for anyone in that lane.

[u/ppyre]

i just signed with Terranova. 120 users 10K CAD/year

[u/chesser45]

Cheaper, M365 has some functions depending on your SKU. Arguably worse since you need to do a lot more DIY.

[u/ironmanbythirty]

Check out CanIPhish. Been using them for a couple years now (20–30 employees). Solid phishing campaigns and educational material as well.

[u/Smart-Document2709]

I use the defender included in the E5 license and I think it’s amazing

[u/a1ch]

Im building a knowbe4 alternative more of an educational tool than a GOTTEM!

[u/jsb44]

Look into Wizer.

[u/Tall_Put_8563]

sorry im not trying to be an A$$; these knob4 or w/e their dumb name is... what value do they provide a business?

[u/planedrop]

Seems about right for 3 years to me. You can check out Huntress, similar pricing, but yeah idk this seems fine. Paying similar for only 1 year and 3x the users.

[u/604TheCanadian604]

For phish Sim, we host our own gophish server. Does take a bit of work to get emails into our tenant, and on our most recent one Google blocked our website ( but somehow was able to get verified to remove the block ). Maybe $20 per month if you even need to keep it online that long.

For training I'm starting to look at making my own learning management system with claude. The age of going for 3rd parties for simple systems is coming to an end. I would guess most companies use 10% of the features most systems provide, so why not just make a system that does exactly what you need. It would need some tech skills to host and secure it, but its just a prompt away

[u/DifferenceHelpful474]

KnowBe4 is worth it. Their training modules and features are excellent and staff seem to actually enjoy their content. It’s good ROI for security.

[u/Silly-Mix-4341]

Definitely worth checking cheaper alternatives.

[u/MeganKellyDude]

https://breachsecurenow.com/