KnowBe4 platform promises up to 400% return on investment

A new independent study by Hobson & Company has found that organisations using KnowBe4's Human Risk Management (HRM+) platform achieve a significant return on investment (ROI) in cybersecurity, with payback occurring in just 3.5 months.

The report, titled From Risk to Return: How KnowBe4 Helps Deliver Measurable ROI, highlights the financial and operational benefits of investing in security awareness training and phishing simulation programmes.

It found that for a typical organisation with 2,000 employees, KnowBe4 delivered over $537,000 in operational savings and reduced risk exposure worth $415,500 over three years.

"In today's evolving threat landscape, organisations cannot afford to overlook the human element of cybersecurity," said Stu Sjouwerman, CEO of KnowBe4. "This new research shows that organisations implementing comprehensive security awareness training and phishing simulation programmes are seeing dramatic returns on their investment. With cyber threats becoming more sophisticated through AI-driven social engineering, the ability to transform employees from a potential vulnerability into a strong human firewall has never been more critical."

Key findings from the study

The study, based on in-depth interviews with KnowBe4 customers, identified several major benefits of using the HRM+ platform:

• 80% reduction in time spent delivering security awareness training.

• 95% reduction in time spent conducting phishing simulations.

• 85% reduction in time investigating and remediating malicious emails.

• 25% decrease in the risk of data breaches and ransomware attacks.

• $19,000 in monthly costs associated with delaying the implementation of KnowBe4.

• 20% decrease in cyber insurance premiums and potential compliance fines.

The report noted that despite multiple layers of security protection, breaches remain costly. IBM's 2024 report found that the average cost of a data breach had risen by 10% to $4.88 million. The study suggests that a proactive approach to human risk management, including regular security training and phishing simulations, is key to reducing an organisation's overall risk.

Operational efficiencies and financial savings

According to KnowBe4 customers interviewed for the study, the HRM+ platform not only strengthens an organisation's security posture but also drives efficiency by reducing the burden on IT and security teams.

One cybersecurity infrastructure engineer said: "It would take at least two full-time employees to create security awareness training content, make it engaging, translate it, deliver it to all users, track progress, and send simulated phishing emails. Now, we don't have to worry about any of this."

"We spend a few hours at the beginning of the year setting up the training and phishing simulations, and we're done for the year."

A security analyst highlighted the reduction in security risks, stating: "The reduction in our Phish-prone Percentage is directly related to the reduction in risk from a data breach or ransomware attack."

KnowBe4's automated phishing simulations were also found to significantly ease the administrative burden on IT teams. An information security officer commented: "Previously I could only send one test every two months because it was a manual process. And the same email was sent to everyone. In three years with KnowBe4, I have only spent 20-30 minutes total setting up the phishing simulation emails."

Growing importance of human risk management

The findings reinforce the growing importance of human risk management as part of a holistic cybersecurity strategy.

The report highlights that organisations leveraging AI-driven security awareness tools can achieve not only improved security outcomes but also substantial financial savings.

One IT security analyst called KnowBe4's PhishER platform a "life-saving tool" for reducing the time spent investigating and remediating malicious emails. "Previously, we needed to manually check headers, links, etc., which could take up to two hours per email. Now, we spend less than 15 minutes reviewing suspicious emails, and there are far fewer of them since PhishER automatically identifies the spam and removes them."

As cyber threats become increasingly sophisticated, organisations are expected to continue investing in platforms that help employees recognise and respond to threats effectively. The Hobson & Company study suggests that implementing KnowBe4's HRM+ platform is not just a security measure but a financially sound business decision.