KnowBe4 in Australia — Security Awareness Training and Phishing Simulation

KnowBe4 is the world's largest security awareness training and phishing simulation platform — used by Australian businesses to train staff to recognise phishing emails, social engineering attacks, and business email compromise attempts. Mycelium 365 deploys and manages KnowBe4 for Australian businesses as part of a managed Security Operations Centre, combining automated phishing simulations with human-led threat monitoring powered by Huntress.

What is KnowBe4 and how does it work?

KnowBe4 is a cloud-based platform that delivers two things — simulated phishing campaigns (sending realistic fake phishing emails to staff to test who clicks) and security awareness training modules (short video-based courses covering phishing recognition, password hygiene, social engineering, and safe browsing). The platform tracks which staff click simulated phishing emails, complete training modules, and pass knowledge checks.

Over time, organisations using KnowBe4 see their phish-prone percentage (the percentage of staff who click phishing emails) drop significantly — KnowBe4's own research shows organisations reduce their phish-prone percentage from an average of 34% to under 5% within 12 months of consistent training.

The ASD's Annual Cyber Threat Report identifies phishing as the most common initial access vector for cyberattacks against Australian businesses, which is why staff training remains one of the highest-return cyber controls a small or mid-sized business can invest in.

What phishing simulation features does KnowBe4 include?

KnowBe4's phishing simulation library contains over 30,000 templates — covering email phishing, SMS phishing (smishing), vishing (voice phishing), and QR code phishing. Templates are updated weekly to reflect current phishing campaigns — including ATO impersonation, myGov phishing, Microsoft 365 credential harvesting, and Australian bank impersonation emails that are actively being used against Australian businesses.

The platform allows administrators to target specific departments or seniority levels, schedule campaigns at randomised intervals to prevent staff from anticipating tests, and automatically enrol staff who click simulated phishing emails into remedial training.

For Australian businesses in regulated industries (legal, accounting, defence, financial services), phishing simulation reports provide documented evidence of staff security training for compliance and cyber insurance requirements.

Want to know how susceptible your team is to phishing? Book a discovery call → and we'll walk you through a KnowBe4 baseline phishing simulation for your business.

What KnowBe4 includes for Australian businesses

Phishing simulation campaigns. Automated simulated phishing emails are sent to all staff on a rolling schedule, with click rates tracked per user and per department so you can see exactly where the risk sits rather than relying on an organisation-wide average.

Security awareness training library. Over 2,000 training modules covering phishing, ransomware, social engineering, and password security, plus Australian-specific compliance topics including Privacy Act obligations and Essential Eight controls.

Compliance management. Training is assigned automatically against the framework you are working to — Essential Eight, ISO 27001, or the Australian Government PSPF — so evidence accumulates continuously instead of being assembled before an audit.

Smart groups. Users who click a phishing simulation are automatically enrolled in additional targeted training. Remediation lands on the people who need it rather than forcing blanket retraining on the whole business.

Reporting. An executive dashboard shows organisation-wide phishing susceptibility score, department-level breakdowns, and compliance completion rates — presentable to a board or an insurer without reformatting.

Ongoing controls alignment is covered in our guide to Essential Eight compliance for Melbourne businesses.

KnowBe4 and Microsoft 365 integration

KnowBe4 integrates directly with Microsoft 365 through Entra ID (Azure AD) for user provisioning. New Microsoft 365 users are automatically enrolled in KnowBe4 training and departing users are automatically decommissioned, so training coverage tracks your actual staff list without manual reconciliation each month.

The Microsoft Outlook add-in — the Phish Alert Button — lets staff report a suspected phishing email to the security team with one click, turning your users into a reporting channel rather than only a risk surface.

KnowBe4 phishing simulations should also be allowlisted in Microsoft Defender for Office 365 so simulation emails are not quarantined before they reach the inbox, which otherwise skews click-rate data and makes campaign results meaningless.

Mycelium 365 configures KnowBe4 as part of every Complete Security managed IT engagement, alongside the identity controls described in our Zero Trust security for Microsoft 365 guide and the wider managed Microsoft 365 service.

KnowBe4 vs Microsoft Defender security awareness training

Microsoft Defender for Office 365 Plan 2 includes Attack Simulator, a basic phishing simulation tool. KnowBe4 is meaningfully more capable across four dimensions: a 2,000+ module training library versus Microsoft's comparatively basic set; dedicated compliance management versus Defender's largely manual assignment process; AI-driven personalised training through AIDA versus Defender's static campaigns; and detailed susceptibility scoring versus Defender's basic reporting.

For Australian businesses on Microsoft 365 Business Premium — which includes Defender for Office 365 Plan 1 and therefore no Attack Simulator — KnowBe4 is the recommended standalone security awareness platform. For businesses on E5 with Defender Plan 2, Attack Simulator will cover the compliance box, but KnowBe4 still provides substantially better training depth and behaviour change over a 12-month cycle.

KnowBe4 pricing in Australia — what does it cost?

KnowBe4 is licensed per user per year across tiers. Silver covers core phishing simulation and the basic training library at approximately AUD $18–25/user/year. Gold adds advanced phishing, the full training library, and compliance campaigns at approximately AUD $28–38/user/year. Platinum adds advanced reporting and AIDA AI-driven training at approximately AUD $38–52/user/year.

For a 50-user Australian business, Silver tier runs approximately AUD $1,100–1,250/year — less than the cost of a single ransomware incident response engagement.

Mycelium 365 procures KnowBe4 as a licensed partner and manages the platform as part of Complete Security engagements, so campaign scheduling, allowlisting, remediation, and reporting are handled rather than handed to you as an admin console login. Talk to us about managed KnowBe4.

KnowBe4 is typically purchased through an Australian MSP partner like Mycelium 365, which includes deployment, configuration, campaign management, and reporting in the managed service fee.

Most Australian businesses on Mycelium 365's managed SOC plan have KnowBe4 included — the training and simulation platform works alongside the Huntress-powered endpoint monitoring to cover both human and technical cyber risk in a single monthly per-user price.

KnowBe4 and the Essential Eight — does security awareness training count?

The ASD Essential Eight includes user application hardening and restricting macro execution — but does not explicitly mandate security awareness training at Maturity Level 1 or 2. However, the Essential Eight Maturity Model does require that staff understand their security responsibilities, and cyber insurance providers increasingly require documented security awareness training as a policy condition.

For Australian businesses working toward DISP compliance or ISO 27001, documented security awareness training is a mandatory control. KnowBe4 provides the audit trail — completion reports, phish-prone percentage trends, and training certificates — that satisfy these compliance requirements.

Mycelium 365 configures KnowBe4 reporting specifically to align with the documentation requirements of Australian cyber insurance questionnaires, so renewal evidence is available on demand rather than assembled reactively. For broader compliance framing, see governance and compliance readiness.

How Mycelium 365 deploys KnowBe4 for Australian businesses

Mycelium 365 delivers KnowBe4 as a fully managed service — initial tenant configuration, allowlisting through Exchange Online and Defender, baseline phishing campaign, ongoing monthly simulation scheduling, and monthly reporting on phish-prone percentage and training completion. Campaigns are tuned to the Australian threat landscape (ATO, myGov, Microsoft 365, big four banks) rather than generic US templates.

KnowBe4 integrates with our Huntress-powered managed SOC so a click on a real phishing email is investigated by human analysts, not just logged. For more on the combined training + monitoring model, see our guide to security awareness training and managed SOC and what a managed Microsoft 365 service includes.