Skip to main content

Is knowbe4.com a Scam? Security Check Results - KnowBe4 Reviews

knowbe4.com favicon

Is knowbe4.com Safe? Security Analysis for KnowBe4

Check if knowbe4.com is a scam or legitimate. Free security scan and reviews.

TechnologyUnited Statesenterprise
HubSpot CMSjQuery 3.7.1Google Fonts (Sora)HubSpot AnalyticsGoogle Tag Manager+3 more
Analyzed 9/6/2025Completed 10:11:36 AM
71
Security Score
MEDIUM RISK

AI Summary

KnowBe4 is a leading cybersecurity company specializing in human risk management and security awareness training. Their platform offers a comprehensive suite of services including phishing simulations, cloud email security, compliance training, and AI-driven defense agents. The company targets enterprises and organizations seeking to strengthen their cybersecurity posture through user education and risk mitigation. The website reflects a mature digital presence with professional design, multi-language support, and extensive resources, positioning KnowBe4 as a market leader in its domain. Technically, the website is built on the HubSpot CMS platform, leveraging modern web technologies such as jQuery, Google Fonts, and cloud-based content delivery networks. The site demonstrates good performance, mobile optimization, and accessibility features. Integration with marketing and analytics tools like HubSpot Analytics, Google Tag Manager, and Facebook Pixel indicates a sophisticated approach to user engagement and data collection. From a security perspective, the site enforces HTTPS and employs cookie consent mechanisms aligned with GDPR requirements. While explicit security headers are not fully visible in the HTML, the overall security posture is strong with no evident vulnerabilities or exposed sensitive data. However, the absence of a public security policy or vulnerability disclosure page suggests room for improvement in transparency and incident response readiness. The WHOIS data for the domain is unavailable, which is unusual for a large enterprise but may be due to privacy protections or registry policies. Despite this, the website's content, branding, and external references strongly support its legitimacy. Overall, KnowBe4's website is professional, secure, and compliant, reflecting a robust cybersecurity business with a strong market position.

Detected Technologies

HubSpot CMSjQuery 3.7.1Google Fonts (Sora)HubSpot AnalyticsGoogle Tag ManagerQualified chat widgetFacebook Ads PixelCloudfront CDN

🧠AI Business Intelligence

Technology stack, business insights, and market analysis powered by AI.

Business Intelligence

Market & Strategic Analysis

KnowBe4 operates in the cybersecurity technology sector, focusing on human risk management and security awareness training. The company leverages a SaaS business model, providing subscription-based access to its platform and tools. Its market position is strong, trusted by many top cybersecurity firms, indicating competitive advantages in content breadth and platform capabilities. Revenue streams likely include training subscriptions, cloud email security services, and partner programs. The target customers are enterprises and organizations concerned with cybersecurity culture and compliance. The company maintains a broad partnership ecosystem and offers localized portals for different regions, supporting global reach and growth. Strategic observations include a focus on continuous innovation (e.g., AI Defense Agents) and comprehensive resource offerings to support customer success and retention.

Extracted Contact Information

Marketing Intelligence Data

Email Addresses (2)

S*****@KnowBe4.com
S*****@KnowBe4.com

Security Posture Analysis

Comprehensive Security Assessment

KnowBe4 demonstrates a mature security posture with enforced HTTPS, cookie consent aligned with GDPR, and use of reputable third-party analytics and marketing services. No exposed sensitive data or vulnerable libraries were detected in the website content. However, the absence of a dedicated security policy, incident response contact, or vulnerability disclosure mechanism limits transparency and may impact incident handling effectiveness. The site could benefit from publishing explicit security headers and a security.txt file to enhance trust and readiness. Overall, the security culture appears strong, supported by the company's core business focus on cybersecurity awareness and training.

Strategic Recommendations

Priority Actions for Security Improvement

1

Publish a dedicated security policy and incident response page to improve transparency.

Observations

AI-powered comprehensive website and business analysis.

AI-Enhanced Website Analysis

Business Insights

Company:

KnowBe4

Description:

KnowBe4 HRM+ is your all-in-one platform for security awareness training, cloud email protection, & more. Trusted by 47 of the top 50 cybersecurity firms.

Key Services:
Security Awareness TrainingCloud Email SecurityPhishER PlusSecurityCoachCompliance PlusAI Defense Agents
Content Quality:

excellent

Branding:

consistent

Technical Stack

Technologies:
HubSpot CMSjQuery 3.7.1Google Fonts (Sora)HubSpot AnalyticsGoogle Tag ManagerQualified chat widgetFacebook Ads PixelCloudfront CDN
Frameworks:
HubSpot
Platforms:
HubSpot
Performance:

fast

Mobile:

excellent

Accessibility:

good

SEO:

good

Security Assessment

Security Score:
85/100
Best Practices:
  • HTTPS enforced
  • Cookie consent banner with opt-in/out
  • No exposed sensitive data in HTML
  • Use of reputable third-party analytics and marketing scripts

Analytics & Tracking

Services:
HubSpot AnalyticsGoogle Tag ManagerQualified
Tracking Level:moderate
Privacy Compliance:good

Advertising & Marketing

Ad Networks:
Facebook Ads
Tracking Pixels:
Facebook PixelHubSpot AnalyticsQualified
Marketing Tools:
HubSpotQualified
Transparency Level:good

Website Quality Assessment

Design Quality:excellent
User Experience:excellent
Content Relevance:excellent
Navigation Clarity:excellent
Professionalism:excellent
Trustworthiness:high

Key Observations

1

Website is fully accessible with rich content and navigation

🛡️Security Headers

HTTP security headers analysis and recommendations.

Security Headers

HTTP security headers analysis

45/100
Score

Missing X-Frame-Options header

HIGH

Prevents clickjacking attacks

Missing X-Content-Type-Options header

MEDIUM

Prevents MIME type sniffing

Missing X-XSS-Protection header

MEDIUM

Legacy XSS protection (deprecated but still recommended)

Weak Referrer-Policy configuration

LOW

Current value: "no-referrer-when-downgrade"

Missing Permissions-Policy header

MEDIUM

Controls browser features and APIs

Sensitive data may be cached

LOW

Cache-Control header should include "no-store" for sensitive pages

👤GDPR Compliance

Privacy and data protection assessment under GDPR regulations.

GDPR Compliance

Privacy and data protection assessment

68/100
Score

No Cookie Policy found

HIGH

GDPR requires clear information about cookie usage

No Data Protection Officer mentioned

LOW

Large organizations may need to designate a DPO under GDPR

Privacy policy may not be GDPR compliant

MEDIUM

Privacy policy lacks explicit GDPR compliance elements

GDPR Compliance Analysis

Privacy Policy85% confidence
Cookie Policy0% confidence
Contact Information Found90% confidence
emailphone

🛡️NIS2 Compliance

Network & Information Security Directive compliance assessment.

NIS2 Compliance

Network & Information Security Directive

55/100
Score

No vulnerability disclosure policy

MEDIUM

NIS2 encourages coordinated vulnerability disclosure

No incident response procedures found

HIGH

NIS2 requires documented incident response and business continuity plans

No security contact information

HIGH

NIS2 requires clear incident reporting channels

No vulnerability reporting mechanism

MEDIUM

Clear vulnerability reporting supports coordinated disclosure

No NIS2 reference found

LOW

Consider explicitly mentioning NIS2 compliance efforts

📧Email Security

SPF, DKIM, and DMARC validation and email security assessment.

Email Security

SPF, DKIM, and DMARC validation

85/100
Score

No BIMI Record

LOW

BIMI displays brand logos in email clients

No MTA-STS Policy

MEDIUM

MTA-STS enforces TLS for email delivery

No TLS-RPT Record

LOW

TLS-RPT provides reporting for email TLS issues

SPF
Sender Policy Framework
DKIM
DomainKeys Identified Mail
DMARC
Domain-based Message Authentication
MX Records
Mail Exchange Records
BIMI
Brand Indicators
MTA-STS
Mail Transfer Agent Security
TLS-RPT
TLS Reporting
DNSSEC
DNS Security
SPF Details
Record:
v=spf1 include:mailsenders.netsuite.com include:_spf.google.com include:mail.zendesk.com include:stspg-customer.com ip4:23.21.109.212 ip4:23.21.109.197 ip4:52.49.201.246 ip4:52.49.235.189 ip4:54.172.84.90 ip4:147.160.167.0/24 ip4:168.235.226.71 ip4:168.235.226.72 ip4:168.235.226.73 ip4:168.235.226.74 ip4:168.235.233.211 ip4:168.235.233.212 ip4:168.235.233.213 ip4:192.254.121.248 ip4:167.89.63.53 ip4:167.89.111.118 exists:%{i}._spf.mta.salesforce.com -all
DNS Lookups:5/10
Policy:-all
DKIM Selectors Found
Selector:default(1296-bit rsa)
Selector:google(1296-bit rsa)
Selector:selector1(1296-bit rsa)
Selector:s1(1440-bit rsa)
DMARC Details
Policy:quarantine
Aggregate Reports:fcf8c5bdac@rua.easydmarc.us
Forensic Reports:fcf8c5bdac@ruf.easydmarc.us

🏆SSL/TLS Security

Certificate validity and encryption analysis.

SSL/TLS Security

Certificate validity and encryption analysis

65/100
Score

SSL Certificate Expires Within 90 Days

MEDIUM

SSL certificate expires in 77 days

Weak SSL Key Length

HIGH

SSL certificate uses 256-bit key, which is considered weak

Mixed Content Detected

MEDIUM

6 resources loaded over insecure HTTP

Partial SSL/TLS Assessment

LOW

Completed 2 of 4 security checks due to time constraints

Certificate Details

Subject:www.knowbe4.com
Issuer:WE1
Valid Until:11/22/2025 (77 days)
SANs:www.knowbe4.com

OCSP Status

OCSP Stapling Disabled

📊DNS Health

DNS configuration and security assessment.

DNS Health

DNS configuration and security assessment

65/100
Score

DNSSEC Not Enabled

MEDIUM

DNSSEC is not configured for this domain

CAA Records Not Configured

LOW

Certificate Authority Authorization (CAA) records not found

Potential Subdomain Takeover

HIGH

Subdomain staging.knowbe4.com points to unregistered service kmsat-webapp-staging-998164134.us-east-1.elb.amazonaws.com

Domain Registration Details

Domain Age
15 years(mature)
Expiry Risk
low(350 days)
Protection Level
strongDNSSEC OFF

DNS Records

A Records:13.33.235.15, 13.33.235.76, 13.33.235.74, 13.33.235.78
Name Servers:
ns-1036.awsdns-01.org
ns-1882.awsdns-43.co.uk
ns-38.awsdns-04.com
ns-853.awsdns-42.net
MX Records:
5: alt2.aspmx.l.google.com
10: aspmx4.googlemail.com
5: alt1.aspmx.l.google.com
10: aspmx3.googlemail.com
10: aspmx5.googlemail.com
1: aspmx.l.google.com
10: aspmx2.googlemail.com
SOA:Serial: 1, TTL: 86400s

DNSSEC Status

DNSSEC Not Enabled

DNS Performance

Resolution Time:62ms

SPF Analysis

SPF Record:
v=spf1 include:mailsenders.netsuite.com include:_spf.google.com include:mail.zendesk.com include:stspg-customer.com ip4:23.21.109.212 ip4:23.21.109.197 ip4:52.49.201.246 ip4:52.49.235.189 ip4:54.172.84.90 ip4:147.160.167.0/24 ip4:168.235.226.71 ip4:168.235.226.72 ip4:168.235.226.73 ip4:168.235.226.74 ip4:168.235.233.211 ip4:168.235.233.212 ip4:168.235.233.213 ip4:192.254.121.248 ip4:167.89.63.53 ip4:167.89.111.118 exists:%{i}._spf.mta.salesforce.com -all

Network Security

Port scanning and network exposure analysis.

Network Security

Port scanning and network exposure analysis

100/100
Score

Good Network Security Posture

LOW

No unnecessary services detected on common risky ports

🔧Technical Analysis

Detailed technical findings and analysis from AI assessment.

Technical Analysis

Comprehensive security assessment findings

Additional Findings

The website is built on the HubSpot CMS platform, utilizing modern web technologies including jQuery 3.7.1 and Google Fonts. It integrates multiple marketing and analytics tools such as HubSpot Analytics, Google Tag Manager, Facebook Pixel, and Qualified chat widget. Hosting is supported by Amazon Cloudfront CDN, contributing to fast load times and global content delivery. The site is mobile-optimized with responsive design and accessibility considerations. Technical debt appears minimal with no broken elements or errors detected. Opportunities exist to enhance security header implementation and to publish more detailed technical and security documentation to further reduce operational risks.
Analyze Another Website