Securing the human and AI workforce

Dr. Martin Kraemer, CISO Advisor at KnowBe4, discusses the company’s evolution beyond security awareness training into workforce security, the growing risks associated with AI agents and the importance of maintaining human oversight as enterprises embrace agentic AI.

How has KnowBe4 evolved in terms of its focus areas and cybersecurity offerings?

KnowBe4 is a cybersecurity company founded about 16 years ago in the Tampa Bay area in the US. We now have operations globally, with offices in Australia, Japan, Dubai, Europe and other locations.

We started out as a security awareness company. Sixteen years ago, security awareness was very different. Most organisations conducted training only once a year, primarily for compliance reasons. We introduced an online platform with a new approach to training, including regular short sessions, drama series-style video content and gamification. We revolutionised the space at the time.

Today, the industry has come a long way, and so have organisations. We have evolved into a workforce security company, recognising that AI agents now work alongside humans. When we say we protect the workforce, we need to have the same metrics, measurements, and tools for AI agents as well. Of course, that requires a very different approach. We have also expanded into email security, protecting against one of the most significant attack vectors.

What are the key pillars of KnowBe4’s workforce security offering?

There are three pillars. The first is security awareness and training, including phishing simulations and the tools required to support security operations teams.

The second pillar is collaboration security. Attacks today come through email, Microsoft Teams, Slack and other communication channels. You need detection across all these channels. We use machine learning and natural language processing-based detection algorithms to identify threats such as business email compromise and voice phishing, where the only payload might be a phone number. At the technical level, detection is based on understanding the content of the email and the sender’s intent rather than relying on static signatures. It is a dynamic approach.

The third pillar is Agent Security, or Agent Risk Manager. This solution automatically creates an inventory of AI agents within an organisation, identifies the systems they connect to and assesses which users interact with them. We also monitor the agents’ internal reasoning and behaviour to identify potentially malicious intent.

Just as a good employee can become an insider risk, a good AI agent can also become an insider risk. You need to understand the intent behind its actions. That requires monitoring software, real-time behaviour tracking and incident response capabilities.

Does the KnowBe4 platform provide a unified view of risks associated with humans and AI agents?

Yes, it is one platform with one risk model that aggregates both. We are firmly convinced that organisations need to remain in control. You don’t want an AI agent to run the organisation.

That is why the risks associated with AI agents are incorporated into a model that ultimately leads back to a human. You need to understand how effectively that individual is controlling the agents, whether they are properly configured and whether they are behaving as expected. It always starts with the human and ends with the human.

How recently was this unified platform introduced?

The security awareness training and phishing simulation capabilities have been around for 16 years. The email security capabilities also have a long history and came through an acquisition. The third pillar, Agent Risk Manager, is brand new.

Bringing all these capabilities together into one platform is a recent development. It is not simply a new AI solution sitting on top of the existing offerings. Everything has been rebuilt into one platform, which became generally available a couple of months ago.

How extensively is AI being used within the platform itself?

We have more than 15 AI agents running within our own platform. Consider a large enterprise with 100,000 employees and potentially many more AI agents. How do you maintain oversight and monitoring across all of them? You need AI.

For the human workforce, AI helps deliver the right training material at the right time. It supports real-time coaching, content creation, delivery, progress monitoring, and reporting through a unified dashboard.

We also use AI to create highly customised training content. For example, through our partnership with Synthesia, organisations can generate training videos featuring their CEO, which can make the content more engaging for employees.

Another area is policy management. Organisations can upload and manage their policies within the platform, and employees can acknowledge them. But simply reading a policy is not enough. We can feed those policies into AI to generate training modules or short quizzes that assess employees’ understanding. We have also been using AI in phishing simulations for around 12 years.

With AI agents monitoring other agents, how do organisations address the risk of those monitoring agents themselves becoming compromised?

That is an important question. How do you maintain oversight and control over agents operating at machine speed? An agent could delete a database in a split second or infiltrate a network within minutes. You need AI or another machine-powered capability to respond at that speed.

When organisations buy or develop AI agents, the information security team does not necessarily have complete visibility into how they operate. They can be something of a black box. Safeguards are built into these systems, but model drift and data leakage remain concerns.

With a monitoring system, you have greater control. You can version agents, track their behaviour and identify when something goes wrong. The moment an agent learns, there is a possibility that it could go off track or become malicious. If that happens, you can reset it to an earlier version when it was behaving correctly. This requires stricter controls over the agent.

We also need to recognise that perfection is not the objective. As with anything in cybersecurity, it is about defence in depth. We do not expect any single technological layer to be absolutely perfect. We still train people to understand the normal behaviour of AI agents and how to interact with them safely and securely. When they make mistakes, they receive refresher training. These different layers must always work together.

Is Agent Risk Manager also designed for security operations centres?

Yes. The email security component already supports SOC operations, including the bulk processing of malicious emails and removing identified threats from multiple inboxes.

Agent Risk Manager is also a SOC tool. It provides capabilities for information security and SecOps teams to monitor AI agents, assess risks and respond to potential threats. It becomes another part of their responsibility to keep the organisation secure.

What is KnowBe4’s go-to-market strategy in the Middle East?

We have an office in Dubai with around 25 people, including our sales team, and we are looking to expand further across the region and into other major markets.

We engage with customers directly through events and other activities, but distributors, resellers and partners are central to our go-to-market strategy. RAS Infotech has been our main distributor from the beginning and has provided tremendous support. We also have partners working through the distributor, and approximately 99% of our business comes through that channel.

Are there particular industries or enterprise segments you are targeting?

We are targeting all sectors. It is not limited to organisations deploying agentic AI. Any organisation handling data must comply with data protection laws, financial regulations and other requirements.

That makes workforce security and risk governance relevant across industries, including financial services and other regulated sectors. Essentially, any organisation concerned with protecting its people, data and AI-enabled operations is a potential customer.

How does KnowBe4 position itself in industry assessments, particularly as agent security is still an emerging category?

We are recognised across different categories for different parts of our portfolio. In security awareness, we have consistently been positioned as a leader, and similarly in email security.

Agent risk management is still a very new area, so it is too early for the same level of established industry assessment. We are represented in industry research and review platforms, including Gartner and G2.

Does KnowBe4 also provide professional cybersecurity certifications through its training programmes?

Our focus is on helping organisations train their entire workforce rather than providing specialist cybersecurity qualifications. We do issue completion certificates as an acknowledgement of participation, but there is no formal professional certification process involved. The objective is to shape and create a security culture in which employees behave in the interests of their organisation’s security. That is really the goal.

What is your assessment of regional readiness for workforce security and AI governance solutions?

It has been very encouraging. I was happy to see many of our competitors at the event (GISEC 2026) because it demonstrates that organisations increasingly appreciate the importance of addressing the human layer of cybersecurity. It gives me confidence that the region is moving in the right direction.

It is also exciting to see what organisations are doing in the agentic AI space. When you speak with CISOs, you don’t need to tell them they have an AI governance problem or a governance gap. They already know. Many have been concerned about how to address that gap for the past two years or more.

What makes these conversations valuable is the opportunity to get direct feedback from CISOs about what is required on the ground, what works and what does not. We can incorporate that feedback into our product development in real time. Our own CISO is also driving part of that development. These interactions are important in helping us build solutions that genuinely address organisations’ security requirements.