KnowBe4 is the world's largest security awareness training and phishing simulation platform — used by Australian businesses to train staff to recognise phishing emails, social engineering attacks, and business email compromise attempts. Mycelium 365 deploys and manages KnowBe4 for Australian businesses as part of a managed Security Operations Centre, combining automated phishing simulations with human-led threat monitoring powered by Huntress.
What is KnowBe4 and how does it work?
KnowBe4 is a cloud-based platform that delivers two things — simulated phishing campaigns (sending realistic fake phishing emails to staff to test who clicks) and security awareness training modules (short video-based courses covering phishing recognition, password hygiene, social engineering, and safe browsing). The platform tracks which staff click simulated phishing emails, complete training modules, and pass knowledge checks.
Over time, organisations using KnowBe4 see their phish-prone percentage (the percentage of staff who click phishing emails) drop significantly — KnowBe4's own research shows organisations reduce their phish-prone percentage from an average of 34% to under 5% within 12 months of consistent training.
The ASD's Annual Cyber Threat Report identifies phishing as the most common initial access vector for cyberattacks against Australian businesses, which is why staff training remains one of the highest-return cyber controls a small or mid-sized business can invest in.
What phishing simulation features does KnowBe4 include?
KnowBe4's phishing simulation library contains over 30,000 templates — covering email phishing, SMS phishing (smishing), vishing (voice phishing), and QR code phishing. Templates are updated weekly to reflect current phishing campaigns — including ATO impersonation, myGov phishing, Microsoft 365 credential harvesting, and Australian bank impersonation emails that are actively being used against Australian businesses.
The platform allows administrators to target specific departments or seniority levels, schedule campaigns at randomised intervals to prevent staff from anticipating tests, and automatically enrol staff who click simulated phishing emails into remedial training.
For Australian businesses in regulated industries (legal, accounting, defence, financial services), phishing simulation reports provide documented evidence of staff security training for compliance and cyber insurance requirements.
Want to know how susceptible your team is to phishing? Book a discovery call → and we'll walk you through a KnowBe4 baseline phishing simulation for your business.
What KnowBe4 includes for Australian businesses
Phishing simulation campaigns. Automated simulated phishing emails are sent to all staff on a rolling schedule, with click rates tracked per user and per department so you can see exactly where the risk sits rather than relying on an organisation-wide average.
Security awareness training library. Over 2,000 training modules covering phishing, ransomware, social engineering, and password security, plus Australian-specific compliance topics including Privacy Act obligations and Essential Eight controls.
Compliance management. Training is assigned automatically against the framework you are working to — Essential Eight, ISO 27001, or the Australian Government PSPF — so evidence accumulates continuously instead of being assembled before an audit.
Smart groups. Users who click a phishing simulation are automatically enrolled in additional targeted training. Remediation lands on the people who need it rather than forcing blanket retraining on the whole business.
Reporting. An executive dashboard shows organisation-wide phishing susceptibility score, department-level breakdowns, and compliance completion rates — presentable to a board or an insurer without reformatting.
Ongoing controls alignment is covered in our guide to Essential Eight compliance for Melbourne businesses.
KnowBe4 and Microsoft 365 integration
KnowBe4 integrates directly with Microsoft 365 through Entra ID (Azure AD) for user provisioning. New Microsoft 365 users are automatically enrolled in KnowBe4 training and departing users are automatically decommissioned, so training coverage tracks your actual staff list without manual reconciliation each month.
The Microsoft Outlook add-in — the Phish Alert Button — lets staff report a suspected phishing email to the security team with one click, turning your users into a reporting channel rather than only a risk surface.
KnowBe4 phishing simulations should also be allowlisted in Microsoft Defender for Office 365 so simulation emails are not quarantined before they reach the inbox, which otherwise skews click-rate data and makes campaign results meaningless.
Mycelium 365 configures KnowBe4 as part of every Complete Security managed IT engagement, alongside the identity controls described in our Zero Trust security for Microsoft 365 guide and the wider managed Microsoft 365 service.
KnowBe4 vs Microsoft Defender security awareness training
Microsoft Defender for Office 365 Plan 2 includes Attack Simulator, a basic phishing simulation tool. KnowBe4 is meaningfully more capable across four dimensions: a 2,000+ module training library versus Microsoft's comparatively basic set; dedicated compliance management versus Defender's largely manual assignment process; AI-driven personalised training through AIDA versus Defender's static campaigns; and detailed susceptibility scoring versus Defender's basic reporting.
For Australian businesses on Microsoft 365 Business Premium — which includes Defender for Office 365 Plan 1 and therefore no Attack Simulator — KnowBe4 is the recommended standalone security awareness platform. For businesses on E5 with Defender Plan 2, Attack Simulator will cover the compliance box, but KnowBe4 still provides substantially better training depth and behaviour change over a 12-month cycle.
KnowBe4 pricing in Australia — what does it cost?
KnowBe4 is licensed per user per year across tiers. Silver covers core phishing simulation and the basic training library at approximately AUD $18–25/user/year. Gold adds advanced phishing, the full training library, and compliance campaigns at approximately AUD $28–38/user/year. Platinum adds advanced reporting and AIDA AI-driven training at approximately AUD $38–52/user/year.
For a 50-user Australian business, Silver tier runs approximately AUD $1,100–1,250/year — less than the cost of a single ransomware incident response engagement.
Mycelium 365 procures KnowBe4 as a licensed partner and manages the platform as part of Complete Security engagements, so campaign scheduling, allowlisting, remediation, and reporting are handled rather than handed to you as an admin console login. Talk to us about managed KnowBe4.
KnowBe4 is typically purchased through an Australian MSP partner like Mycelium 365, which includes deployment, configuration, campaign management, and reporting in the managed service fee.
Most Australian businesses on Mycelium 365's managed SOC plan have KnowBe4 included — the training and simulation platform works alongside the Huntress-powered endpoint monitoring to cover both human and technical cyber risk in a single monthly per-user price.
KnowBe4 and the Essential Eight — does security awareness training count?
The ASD Essential Eight includes user application hardening and restricting macro execution — but does not explicitly mandate security awareness training at Maturity Level 1 or 2. However, the Essential Eight Maturity Model does require that staff understand their security responsibilities, and cyber insurance providers increasingly require documented security awareness training as a policy condition.
For Australian businesses working toward DISP compliance or ISO 27001, documented security awareness training is a mandatory control. KnowBe4 provides the audit trail — completion reports, phish-prone percentage trends, and training certificates — that satisfy these compliance requirements.
Mycelium 365 configures KnowBe4 reporting specifically to align with the documentation requirements of Australian cyber insurance questionnaires, so renewal evidence is available on demand rather than assembled reactively. For broader compliance framing, see governance and compliance readiness.
How Mycelium 365 deploys KnowBe4 for Australian businesses
Mycelium 365 delivers KnowBe4 as a fully managed service — initial tenant configuration, allowlisting through Exchange Online and Defender, baseline phishing campaign, ongoing monthly simulation scheduling, and monthly reporting on phish-prone percentage and training completion. Campaigns are tuned to the Australian threat landscape (ATO, myGov, Microsoft 365, big four banks) rather than generic US templates.
KnowBe4 integrates with our Huntress-powered managed SOC so a click on a real phishing email is investigated by human analysts, not just logged. For more on the combined training + monitoring model, see our guide to security awareness training and managed SOC and what a managed Microsoft 365 service includes.
KnowBe4 Australia Pricing
Searching for "knowb4" or KnowBe4 Australia? You're in the right place.
KnowBe4 is priced per seat per year and varies by tier — Silver, Gold, Platinum, and Diamond. Australian businesses typically pay USD $20–$35 per user per year depending on tier and seat count.
Mycelium 365 manages KnowBe4 licensing and administration as part of its managed security service — deployment, campaign management, and monthly reporting are included rather than billed separately. Contact Mycelium 365 for an AU-dollar quote including GST.
KnowBe4 vs competitors — how it compares to Proofpoint Security Awareness and Mimecast Awareness Training
For Australian organisations comparing security awareness platforms, the practical differences usually come down to content quality, phishing simulation flexibility, reporting depth, and how easily the platform fits into an existing Microsoft security stack. KnowBe4, Proofpoint Security Awareness Training, and Mimecast Awareness Training all cover the core use case: training staff to recognise phishing, password attacks, business email compromise, and other common user-targeted threats. The differences appear in day-to-day administration.
KnowBe4 is typically strongest where organisations want a large content library, frequent campaign scheduling options, and granular phishing simulation controls. It supports broad user segmentation, automated enrolment in remedial training, and a range of landing pages and templates that can be tuned for different departments or risk groups. For businesses running ongoing monthly or quarterly awareness programs, that flexibility matters because security teams can avoid repeating the same content and can tailor campaigns for finance, executives, or frontline staff.
Proofpoint Security Awareness is often considered where an organisation already uses other Proofpoint email security products and wants closer vendor alignment. Its phishing and threat intelligence heritage can be attractive, especially for teams already familiar with the Proofpoint ecosystem. In practice, the suitability depends on whether the business values an integrated Proofpoint stack more than the breadth and usability of training administration. Some organisations find the reporting and campaign setup sufficient; others prefer KnowBe4’s stronger focus on awareness-specific workflows.
Mimecast Awareness Training is commonly assessed by organisations already invested in Mimecast for email security and continuity. It can be a logical extension if procurement simplicity is a priority. However, businesses should check how much depth they need in content variety, simulation realism, and automation before standardising on it. For smaller environments, Mimecast may cover the basics. For more mature programs, KnowBe4 often provides more room to build repeatable, role-based campaigns.
In Microsoft-centric environments, the decision should also consider downstream integration and operational handling. If the broader security program already includes Microsoft 365 services, managed Microsoft Defender, and a wider security managed service, KnowBe4 can sit cleanly alongside those controls without forcing a broader platform change. That makes it useful for organisations that want awareness training to complement Microsoft’s identity, endpoint, and email protections rather than replace them.
A sensible comparison checklist includes:
- Content library relevance for Australian users
- Ease of recurring campaign administration
- Phishing template customisation
- Automated remedial training workflows
- Reporting for executives and auditors
- Fit with an existing Microsoft-led security environment
How Mycelium 365 deploys KnowBe4 — campaign setup, reporting, and integration with Microsoft 365 Defender
A workable KnowBe4 deployment starts with structure rather than volume. Sending high volumes of phishing tests too early can reduce trust in the program and create noise in reporting. The better approach is to baseline user behaviour, segment the audience, and establish a cadence that reflects the organisation’s risk profile and staff makeup.
Campaign setup usually begins with a few practical steps:
-
Define user groups
Staff are grouped by department, role, location, or risk category. Finance, executives, IT administrators, and customer-facing teams often receive different simulations because the threats targeting them differ. -
Set a realistic schedule
Most organisations benefit from a regular monthly cadence rather than ad hoc testing. That gives enough frequency to reinforce behaviour without making simulations predictable. -
Select content by role and maturity
Short modules generally work better than long annual courses. New starters may need foundational content, while repeat clickers may need targeted remedial training. -
Tune phishing templates
Templates should reflect realistic attacks seen in Microsoft 365 environments, such as credential harvesting pages, MFA prompts, file-sharing lures, and invoice scams. -
Establish exception handling
Shared mailboxes, service accounts, and frontline operational accounts should be reviewed so reporting remains meaningful.
Reporting is most useful when it serves more than one audience. Managers need simple metrics such as completion rates, click rates, and repeat failures by business unit. Security teams need more context: trendlines over time, user risk segmentation, and whether training results align with actual incidents. Audit and compliance stakeholders often need evidence that the organisation can show a repeatable awareness program, assigned training, and tracked completion.
The Microsoft 365 Defender side matters because awareness data should not sit in isolation. In a mature setup, phishing simulation outcomes inform wider protective actions. For example:
- High-risk users may receive additional monitoring in managed Microsoft Defender
- Device and access policies may be reviewed alongside managed Intune
- Security operations can compare simulated phishing behaviour with real incident patterns
This deployment model works best in organisations already standardised on Microsoft for identity, endpoint, email, and collaboration. In those environments, KnowBe4 fills the user-awareness layer while Defender handles detection, response, and hardening. That gives businesses a practical way to connect training outcomes with operational security controls delivered through broader Microsoft security services and ongoing advisory.
KnowBe4 for Australian compliance — how it supports Essential Eight Maturity Level 1 and 2
KnowBe4 is not, by itself, an Essential Eight control. It does not replace patching, application control, MFA, or restricted administrative privileges. What it does provide is structured support for the human side of cyber risk, which is relevant when organisations are building processes around Essential Eight Maturity Level 1 and 2 and need to demonstrate that users are being trained, tested, and measured.
At Maturity Level 1 and 2, one of the recurring challenges is that technical controls can be weakened by user behaviour. Staff still click credential harvesting links, approve fraudulent MFA prompts, reuse passwords, and open malicious attachments. A security awareness platform helps reduce that exposure by creating a documented program of education and reinforcement. For Australian businesses working through Essential Eight uplift, this supports a more complete operating model around Microsoft 365, endpoints, and identity.
In practical terms, KnowBe4 can assist in several compliance-adjacent areas:
-
User education on phishing and malicious content
This supports the intent behind reducing successful compromises delivered through email and web channels. -
Training records and completion tracking
Organisations can show that staff received assigned training, including remedial content for users who repeatedly fail simulations. -
Phishing simulation evidence
Simulated attacks help demonstrate that the organisation is actively testing awareness rather than relying on one-off induction material. -
Role-based training
Higher-risk groups such as finance teams or administrators can receive targeted content aligned to their exposure. -
Repeatable governance process
Scheduled campaigns, reporting cycles, and manager visibility help establish consistency expected in more mature control environments.
For businesses aiming at Essential Eight Level 1 or 2, awareness training is most useful when mapped to the Microsoft controls already in place. For example, users should understand why MFA matters, how conditional access affects sign-in behaviour, and how to recognise fake Microsoft login pages. They should also know how to report suspicious emails and what to do after an accidental click.
That is why awareness work is typically paired with services covering Microsoft 365 configuration, endpoint management, and security monitoring. In a Microsoft-only environment, organisations often combine training with Microsoft 365, security operations, and, where relevant, broader infrastructure and identity planning through Azure services. For Australian organisations with multiple offices, including teams in Melbourne and other major cities, a centralised awareness platform also makes it easier to apply consistent policy and reporting across the business.