KnowBe4 Reporting

KnowBe4 Security Awareness Reporting

Overview

KnowBe4 reporting provides visibility into an organization's security awareness posture through phishing simulation metrics, training completion data, and risk scores. Effective reporting translates raw data into actionable insights for security teams, management, and compliance stakeholders. This skill covers how to retrieve, interpret, and present KnowBe4 metrics.

Anti-triggers

• An "email security report" covering threats actually blocked — every metric here measures simulations and training, not real attacks. Threats stopped in production are proofpoint-tap, avanan-threats, or abnormal-security-threats.
• One campaign's results or one person's risk score — this skill returns account-, department-, and trend-level aggregates; the per-object detail sits in knowbe4-phishing, knowbe4-training, or knowbe4-users.

Key Concepts

Core Metrics

Metric Interpretation Guide

Phish-Prone Percentage (PPP):

PPP = (Users who failed / Users who received test) * 100

Interpretation:
- Decreasing PPP = Training is working
- Flat PPP = Need to change training approach
- Increasing PPP = New threats, new employees, or stale training
- Sudden spike = Especially effective phishing template

Training Completion Rate:

Completion Rate = (Completed enrollments / Total enrollments) * 100

Interpretation:
- Below 80% = Enforcement issue, need manager involvement
- 80-95% = Normal range, follow up on stragglers
- Above 95% = Excellent compliance
- 100% = Verify data -- may indicate auto-completion

Risk Score Trends:

Risk Trend = Current avg risk score - Previous period avg risk score

Interpretation:
- Negative trend = Improving (good)
- Flat trend = Plateau, consider changing approach
- Positive trend = Degrading, investigate cause

Reporting Timeframes

Industry Benchmarks (2024)

Field Reference

Account-Level Summary Fields

Phishing Summary Fields

Training Summary Fields

MCP Tools

What the reporting surface will not do

These three constraints govern almost every report you will be asked for, and none of them are visible from the tool names.

No date filtering, anywhere. None of these tools takes a date range — knowbe4_reporting_risk_overview takes no arguments at all. "Phishing results for March" cannot be requested; it has to be reconstructed by reading Phishing Security Tests and filtering on their dates client-side.

The summaries are page-scoped, and they do not say so. knowbe4_reporting_phishing_summary reads a single page of PSTs (default per_page=500) and averages over it, then returns average_phish_prone_percentage with no marker that it covered part of the account. knowbe4_reporting_training_summary does the same over campaigns. Read back the page and per_page fields it echoes and state the coverage in the report, or paginate and aggregate yourself. Two summaries taken at different sizes are not comparable.

There is no PPP-trend tool and no department breakdown. Both are routinely asked for and neither exists:

• PPP over time has to be assembled from knowbe4_phishing_security_tests_list, taking each test's phish_prone_percentage and its date. Do not substitute knowbe4_account_risk_score_history — risk score and phish-prone percentage are different measures on different scales, and a risk-score trendline presented as a PPP trend is wrong in a way a client cannot catch.
• Department metrics have to be aggregated from knowbe4_users_list, grouping on each user's department field. knowbe4_groups_list is not a substitute: KnowBe4 groups are membership lists that may or may not correspond to departments, and reporting group risk scores under department headings misstates who the numbers describe.

Common Workflows

Monthly Security Awareness Report

1. Get account summary with knowbe4_account_get for top-level metrics
2. Pull the phishing aggregate with knowbe4_reporting_phishing_summary, and record the page/per_page it covered
3. Pull the training aggregate with knowbe4_reporting_training_summary
4. Scope to the month yourself — read knowbe4_phishing_security_tests_list and keep the tests whose dates fall in the reporting period; the summaries above are not date-filtered
5. Build the PPP trend from those per-test phish_prone_percentage values, bucketed by month
6. Aggregate by department from knowbe4_users_list, grouping on the department field
7. Compare to previous month for trend direction
8. Format report with key findings, recommendations, and an explicit note of what the figures cover

Quarterly Executive Report

1. Get 3-month summary across all metrics
2. Calculate quarter-over-quarter change for PPP, completion rate, risk score
3. Identify top 5 highest-risk departments
4. Highlight achievements (PPP improvements, 100% completion groups)
5. List recommendations for next quarter
6. Include industry benchmarks for context

Compliance Audit Report

1. List all training campaigns for the audit period
2. Get completion rates for each required training
3. Identify non-compliant users (past_due or not_started)
4. Document remediation actions taken for non-compliance
5. Export data with timestamps for audit evidence

Risk Trend Analysis

1. Pull risk score history for the organization over 12 months
2. Overlay with campaign dates -- phishing tests and training launches
3. Correlate risk changes with specific events
4. Identify which campaigns had the most impact on risk
5. Recommend optimization of campaign mix

New Client Baseline Report

1. Run baseline phishing test before any training
2. Record initial PPP as the starting point
3. Document initial risk score distribution
4. Set targets based on industry benchmarks
5. Schedule follow-up assessment at 90 days

Report Templates

Executive Summary Format

SECURITY AWARENESS REPORT - [Month/Quarter]
============================================

KEY METRICS
- Phish-Prone Percentage: XX.X% (change from last period)
- Training Completion Rate: XX.X%
- Average Risk Score: XX.X
- PAB Reporting Rate: XX.X%

HIGHLIGHTS
- [Notable achievement or concern]
- [Notable achievement or concern]

DEPARTMENT RANKING (by PPP, best to worst)
1. [Department] - X.X%
2. [Department] - X.X%
...

RECOMMENDATIONS
1. [Action item]
2. [Action item]

Department Comparison Format

DEPARTMENT SECURITY AWARENESS COMPARISON
=========================================

Department    | PPP    | Training | Risk Score | Trend
-------------|--------|----------|------------|------
IT           | 3.2%   | 98%      | 15.4       | ↓
Finance      | 8.1%   | 95%      | 28.7       | ↓
Sales        | 22.4%  | 82%      | 52.1       | →
HR           | 12.7%  | 91%      | 35.2       | ↓
Executive    | 15.3%  | 88%      | 41.0       | ↑

Error Handling

Common API Errors

Data Considerations

Best Practices

1. Report consistently -- Use the same metrics and format every period
2. Show trends, not snapshots -- A single PPP number is less useful than 6-month trend
3. Use benchmarks -- Compare against industry averages for context
4. Segment by audience -- Executives want summary; security team wants details
5. Include recommendations -- Every report should have actionable next steps
6. Track leading indicators -- PAB reporting rate predicts future PPP improvement
7. Celebrate successes -- Highlight departments and users who improve
8. Avoid vanity metrics -- Focus on metrics that drive security outcomes
9. Automate where possible -- Schedule recurring reports to reduce manual effort
10. Correlate with real incidents -- Connect awareness metrics to actual security events

Related Skills

• KnowBe4 Phishing - Phishing simulation campaigns
• KnowBe4 Training - Training campaign management
• KnowBe4 Users - User management and risk scores
• KnowBe4 API Patterns - Authentication, pagination, and rate limits