What Is KnowBe4 Human Risk Management? A Guide for Saudi Organisations

Most organisations already run some form of security awareness training. Employees watch an annual video, pass a short quiz, and the box is ticked. Then a convincing invoice email arrives, someone in finance opens the attachment, and the training turns out to have changed nothing.

The problem is not that people cannot learn. It is that a once-a-year course measures attendance, not behaviour, and attackers target behaviour. Phishing and impersonation, explained in how social engineering attacks target Saudi employees, succeed because they exploit habits that a single course does not change.

This guide explains how KnowBe4 defines human risk management, what is inside its HRM+ platform, how risk is measured, what results the benchmarks show, and what Saudi organisations need to plan for.

What Is Human Risk Management?

Human risk management is a security approach that treats employee behaviour as a risk to be measured and reduced continuously, rather than a training requirement to be completed once. KnowBe4 frames it as a people-focused strategy: find out how employees actually behave, manage the riskiest behaviours, and reduce the incidents they cause.

In practice, a human risk management programme does five things:

• Measures behaviour through simulated phishing and other tests, starting with a baseline.
• Trains each person according to their results, instead of giving everyone the same course.
• Coaches in the moment, when someone does something risky, rather than months later.
• Protects the inbox, so fewer real threats reach people in the first place.
• Reports risk to leadership in numbers that show whether it is going up or down.

What is KnowBe4 HRM+?

HRM+ is KnowBe4's human risk management platform. It was introduced after KnowBe4 acquired Egress, bringing Egress's AI-based email security together with KnowBe4's training. It includes:

• Security Awareness Training, with simulated phishing and a large training library.
• PhishER Plus, which helps security teams triage and respond to emails that employees report.
• Real-Time Coaching, which sends a short lesson when a user's risky action is detected by the organisation's existing security tools.
• Compliance Plus, for compliance-focused training such as codes of conduct and workplace policies.
• Cloud email security, which adapts protection to each user's risk.
• AIDA (Artificial Intelligence Defense Agents), AI agents that personalise training and reduce administration.

How does KnowBe4 measure human risk?

KnowBe4 measures risk at three levels. The Phish-prone Percentage is the share of employees who click, open or otherwise engage with a simulated phishing test. Each user also receives a proprietary Risk Score, which combines their behaviour and other factors, so the security team can see who and which departments need attention first. The third measure is how many people report suspicious emails rather than ignoring them, which shows whether a reporting culture is forming.

Human Risk Management vs Traditional Security Awareness Training

The difference is not the content library. It is how often people are tested, who gets what, and what is measured.

Aspect	Traditional awareness training	Human risk management
Frequency	Once a year, often at onboarding	Continuous, on a regular schedule
Content	The same course for everyone	Assigned according to each person's results and role
Testing	A quiz at the end of the course	Simulated phishing that mirrors real attacks
Measurement	Completion rate	Phish-prone Percentage, Risk Score, reporting rate
Response to risky behaviour	Nothing until next year's course	Coaching and extra training soon after
Email protection	Separate tool, unconnected to training	Linked to each user's risk
Reporting to leadership	Training completion figures	Risk trend by department and over time
Goal	Compliance evidence	Fewer incidents caused by people

What Results Can You Expect?

KnowBe4 publishes an annual benchmark from its customers' simulated phishing results, and the 2026 edition gives the clearest picture available. It analysed 42 million phishing simulations across 14.8 million users at 64,000 organisations.

Before any training, the global average Phish-prone Percentage was 33.2%: roughly one employee in three engaged with a simulated phishing email. After a year of continuous training and testing, the average fell to 4.2%.

Size matters too. The report found a baseline of 24.7% in small organisations and 39.5% in enterprises with more than 10,000 employees, so larger organisations usually start from a weaker position.

These are averages across KnowBe4 customers, not a guarantee. Your own baseline test is the number that matters, and the trend after it is what shows whether the programme is working. How simulated phishing fits into wider defences is covered in anti-phishing in Saudi Arabia.

How Do You Start a Human Risk Management Programme?

Start by measuring, then train, then automate. Buying every module on day one is the most common way to stall.

Where should you start?

Run a baseline simulated phishing test before any training, so you know your real starting point. Tell leadership what the test is for, but not staff, or the result will not reflect normal behaviour. The baseline gives you a Phish-prone Percentage to compare against later.

Which modules do you need first?

Most organisations start with Security Awareness Training and simulated phishing. Add PhishER Plus when reported emails start to overwhelm the security team, and Real-Time Coaching when you have security tools whose alerts can trigger it. How in-the-moment coaching works is explained in real-time security coaching.

How do you keep it running?

Test on a regular schedule rather than in occasional bursts, vary the lures, and assign follow-up training automatically to people who engage with a simulation. Review the Risk Score by department each month and move training effort to where risk is highest. A broader view of building the programme is in security awareness training in Saudi Arabia.

What Do Saudi Organisations Need to Consider?

Four factors shape human risk management in the Kingdom, and global guides rarely cover them.

Regulation sets the minimum, not the goal. The National Cybersecurity Authority's Essential Cybersecurity Controls, which apply to government entities and operators of critical national infrastructure, require a cybersecurity awareness programme that is delivered to staff and reviewed over time. Financial institutions have similar expectations under SAMA's framework. KnowBe4's reports provide evidence of training and testing, but a programme built only to pass an audit rarely changes behaviour. What the controls cover is set out in Saudi Arabia's NCA Essential Cybersecurity Controls.

Arabic is supported, but check the depth. KnowBe4 lists Arabic for simulated phishing templates, training modules, Compliance Plus and the learner interface. The widest content choice is in its most-requested languages, which do not include Arabic, so review the Arabic modules you plan to use before launch. Many Saudi workplaces are multilingual, so assign content in the language each group actually reads.

Employee risk scores are personal data. Simulation results and individual Risk Scores describe identifiable employees, so the Personal Data Protection Law applies. Tell staff that the programme exists, limit who can see individual results, and decide how long results are kept.

Use local lures. Generic simulations about foreign parcel services teach little. Effective tests mirror the scams Saudi employees actually receive, such as fake delivery notices, impersonated government services, HR and salary messages, and invoice fraud of the kind described in business email compromise.

Blue Edge, a value-added technology distributor based in Dammam, Saudi Arabia, is an authorised KnowBe4 distributor. It supplies the KnowBe4 human risk management platform and KnowBe4 security awareness training to organisations across the Kingdom, with licensing and onboarding support.

What Are the Most Common Human Risk Management Mistakes?

Six mistakes undermine most programmes, and the first is the most damaging.

Punishing people who click. When a failed simulation leads to blame, employees stop reporting real mistakes, and the security team loses its earliest warning of an attack.

Treating one annual course as a programme. Behaviour drifts back within months, and attackers do not wait for the next training cycle.

Measuring completion instead of behaviour. A 100% completion rate says nothing about whether people still click. Track Phish-prone Percentage, Risk Score and reporting rate instead.

Making reporting hard. If reporting a suspicious email takes several steps and nobody replies, people stop doing it. Make it one click and acknowledge every report.

Training in the wrong language. Content people do not fully understand produces completions without learning.

Using lures that damage trust. Simulations built on fake bonuses or alarming HR news can feel like a betrayal. Keep tests realistic without exploiting sensitive topics.

Start With a Baseline, Then Train Continuously

Run a baseline phishing test first, and record your Phish-prone Percentage. That single number tells you where you stand and gives every later result something to be compared with.

Then roll out training and regular simulations, assign follow-up training automatically, and make reporting a one-click habit. Review the Risk Score by department each month, and add PhishER Plus, Real-Time Coaching or email security when the data shows where they will help most.

Report the trend to leadership every quarter, alongside any real incidents. A falling Phish-prone Percentage and a rising reporting rate are the clearest signs the programme is working.

Frequently Asked Questions

• How does KnowBe4 define human risk management?

  KnowBe4 describes human risk management as a people-focused security strategy rather than a training course. It starts with measuring how employees behave, then manages the riskiest behaviours through targeted training, coaching and protection, with the goal of reducing incidents caused by human action. KnowBe4 separates this strategic approach from its HRM+ platform, which is the software used to carry it out.

• What is KnowBe4 HRM+?

  HRM+ is KnowBe4's human risk management platform. It brings together Security Awareness Training with simulated phishing, PhishER Plus for handling reported emails, Real-Time Coaching, Compliance Plus training, cloud email security from KnowBe4's acquisition of Egress, and AIDA, its Artificial Intelligence Defense Agents. Organisations can start with training and phishing and add the other modules as their programme matures.

• How is human risk management different from security awareness training?

  Security awareness training is one part of human risk management. Traditional training gives everyone the same course, usually once a year, and measures completion. Human risk management tests people continuously with simulated attacks, assigns training according to each person's results, coaches risky behaviour soon after it happens, and reports whether risk is actually falling over time.

• Is KnowBe4 available in Arabic?

  Yes. KnowBe4 lists Arabic for simulated phishing templates, training and video modules, Compliance Plus training and the learner interface. The broadest selection of content is in its most-requested languages, which do not include Arabic, so organisations should review the specific Arabic modules they intend to use and combine Arabic and English content to suit their workforce.

• How does KnowBe4 help security leaders measure and report human risk?

  KnowBe4 tracks each organisation's Phish-prone Percentage over time, gives every user a Risk Score, and records how many employees report suspicious emails. Dashboards and reports break these figures down by department, location or group, so security leaders can show leadership and auditors whether risk is falling and where training effort should go next.

Sources & References

• KnowBe4 — Introducing HRM+: The All-in-One Human Risk Management Platform vendor documentation (press release)
• KnowBe4 — KnowBe4 Defines a Holistic Approach to Human Risk Management vendor documentation (press release on its strategic framework whitepaper)
• KnowBe4 — 2026 Phishing by Industry Benchmarking Report vendor research
• KnowBe4 — KnowBe4 Research Finds Global Phishing Susceptibility Drops After One Year of Security Awareness Training (2026 report findings, 7 July 2026) vendor research (press release)
• KnowBe4 — Multi-Language Support and Localization vendor documentation
• National Cybersecurity Authority (NCA) — Essential Cybersecurity Controls (ECC-2:2024) regulator
• Saudi Data and Artificial Intelligence Authority (SDAIA) — Laws and Regulations: Personal Data Protection Law and its Implementing Regulation regulator

---

Published 2 October 2026 • Last updated 3 October 2026 • This article is reviewed when standards, regulations or product guidance change.