Supplied & supported in KSA by Blue Edge
KnowBe4 PhishER Plus — Phishing Incident Response in Saudi Arabia
Triage reported emails automatically, pull confirmed threats out of every mailbox they reached, and block the next one before anyone sees it. Supplied and supported across the Kingdom by Blue Edge in Dammam.
Blue Edge supplies, configures and supports KnowBe4 PhishER Plus across Saudi Arabia — mail platform integration, triage rule design, quarantine workflows and reporting. Licensing and technical support are handled in-Kingdom from our office in Dammam.
You trained staff to report suspicious email. Now someone has to read it all.
A working awareness programme creates a new problem. Reports start arriving — and most of them are newsletters, delivery notices and internal mail that looked odd for a moment.
Somebody opens each one, decides what it is, and moves on. It is slow, it is repetitive, and it is the exact task where attention fails. The genuine attack sits in the same queue as forty pieces of marketing, and it waits its turn.
Meanwhile the same message is in dozens of other inboxes belonging to people who never reported it. Even once your team identifies the threat, removing it from every mailbox by hand is a job nobody has time for — so it usually does not happen.
From reported message to closed threat
Staff report with one click. The platform does the sorting. Your team only sees what needs a human.
Report
Users report with the Phish Alert Button, or by forwarding to a mailbox. Everything lands in one console.
Prioritise
PhishML analyses every message and tags it with a confidence value. Routine categories are handled automatically.
Investigate
URLs are checked against web reputation data, with sandbox detonation via CrowdStrike Falcon Intelligence.
Remove
PhishRIP searches every connected mailbox for the same message and deletes or quarantines it everywhere.
Reuse
PhishFlip strips the malicious payload and turns the real attack into a safe simulated phishing template.
PhishFlip is the part teams underuse
A simulation built from an attack that genuinely targeted your organisation lands differently from a generic template. Staff recognise the sender, the context and the timing — which is exactly why it teaches.
Protection from attacks nobody in your organisation has seen yet
The base product handles what your own users report. The Plus tier adds the part that makes it preventive rather than reactive: threat intelligence gathered from more than 10 million reporting users worldwide, vetted by KnowBe4's Threat Research Lab.
These are attacks that already slipped past commercial email filters somewhere else in the world. By the time one reaches Dammam or Riyadh, it has been identified, validated and distributed.
Global Blocklist
A continuously updated crowdsourced threat feed that syncs with your Microsoft 365 mail server, blocking future messages that share a sender, URL or attachment with a confirmed threat. If you would rather not use crowdsourced data, you can run your own private blocklist instead.
Global PhishRIP
Automatic quarantine of messages matching threats other organisations have already removed and the Threat Research Lab has validated. It searches messages your users received in the last 72 hours and pulls matches out before anyone in your organisation reports them.
Four things to establish before you buy this
Three of these are limitations. We would rather raise them now than have you find them during deployment.
It is not a gateway
PhishER Plus is designed as the layer after your secure email gateway, catching what got through. It does not replace your existing filtering, and any proposal to remove that filtering because you bought this is a bad proposal.
Blocklist is Microsoft 365
The Global Blocklist syncs with Microsoft 365 mail servers. Quarantine through PhishRIP and Global PhishRIP works with both Microsoft 365 and Google Workspace, but the pre-inbox blocking side is M365-oriented. Worth knowing if you run Workspace.
Check regional availability
KnowBe4's own documentation notes Global PhishRIP is not compatible with every Microsoft 365 environment and may not be available in all regions. We verify this against your specific tenant before quoting. Do not let any supplier skip that step.
Seat parity with training
If you run PhishER alongside KnowBe4 security awareness training, both products need the same seat count. That affects the total, so we set it out in the quotation rather than letting it appear later.
Where it sits, and what it needs
PhishER Plus works as a standalone product or as an add-on for organisations already running KnowBe4 training. Either way the integration work is the same, and it is mostly about mail platform permissions.
- Microsoft 365 or Google Workspace — required for the quarantine features. Mailbox search and removal run through your tenant.
- Phish Alert Button — deployed to user mail clients, included across KnowBe4 subscription levels. Forwarding to a reporting mailbox also works.
- Web reputation checking — URLs analysed against classification and reputation data from the console.
- CrowdStrike Falcon Sandbox — available where you hold an active Falcon Intelligence subscription, for detonating files and URLs.
- Your KnowBe4 training console — required for PhishFlip, since flipped templates are delivered as simulated phishing campaigns.
Configured properly, from Dammam
An incident response tool that nobody tuned becomes another inbox. The value is entirely in the rules — what gets auto-dispositioned, what escalates, what triggers a mailbox sweep. Left at defaults, your team reads the same volume as before with an extra login.
Tenant verification first
Confirming which Plus features are available for your Microsoft 365 or Google Workspace environment before you commit.
Triage rule design
Tags and actions built around your actual reporting volume, so routine categories clear themselves.
Quarantine policy
What gets removed automatically versus what waits for a human decision, agreed with your security team.
Phish Alert Button rollout
Deployed across mail clients with the internal messaging that gets staff using it.
Regulatory alignment
Reporting shaped to support NCA ECC subdomain 2-13 on incident and threat management and 2-4 on email protection.
Local commercial terms
Quotation, purchase order and invoicing in Saudi Riyals through a Saudi entity, support in Arabic and English.
Tell us your mail platform and your reporting volume
PhishER Plus is priced per seat and quoted rather than listed. Before we quote, we confirm which Plus features your Microsoft 365 or Google Workspace tenant actually supports — because a quotation for a feature you cannot use is worth nothing to either of us.
PhishER Plus — common questions
-
What is the difference between PhishER and PhishER Plus?
PhishER handles what your own users report — machine-learning prioritisation, rules and actions, mailbox search and removal through PhishRIP, and PhishFlip to convert real attacks into training. PhishER Plus adds crowdsourced global threat intelligence: the Global Blocklist, which blocks messages matching confirmed threats before delivery, and Global PhishRIP, which quarantines matches automatically before anyone in your organisation reports them.
-
Does this replace our email security gateway?
No. PhishER Plus is explicitly built as an additional layer after your existing gateway and filtering, catching what those systems missed. Its whole value comes from operating on the messages that already got through. Do not remove existing email security on the strength of this purchase.
-
Does it work with Google Workspace as well as Microsoft 365?
Partly. PhishRIP and Global PhishRIP quarantine features integrate with both Microsoft 365 and Google Workspace. The Global Blocklist, which stops matching messages reaching the inbox, syncs with Microsoft 365 mail servers. If you run Google Workspace you get the remediation side but not the same pre-delivery blocking, and you should factor that into the decision.
-
Are all Plus features available in Saudi Arabia?
This needs checking against your specific tenant. KnowBe4's documentation states that Global PhishRIP is not compatible with every Microsoft 365 environment and may not be available in all regions outside the United States. We verify it for your environment before issuing a quotation, and if a feature is unavailable we will tell you rather than quote for it.
-
Can we use it without KnowBe4 training?
Yes. PhishER Plus is available as a standalone product as well as an add-on for existing KnowBe4 customers. The exception is PhishFlip, which converts real attacks into simulated campaigns and therefore needs a training and phishing subscription to deliver them. If you run both products together, they require matching seat counts.
-
What is PhishRIP and how far back does it reach?
PhishRIP searches every mailbox connected to your Microsoft 365 or Google Workspace tenant for the same or similar message and removes or quarantines it — including copies sitting with users who never reported anything. It can be triggered manually or by a rule. Global PhishRIP, the automated crowdsourced version, searches messages received in the previous 72 hours.
-
Do we have to use crowdsourced threat data?
No. If your security policy or data governance position rules it out, you can run your own private blocklist for Microsoft 365 instead of the crowdsourced global feed. You keep the triage, quarantine and automation and forgo the shared intelligence — a reasonable trade for some regulated organisations.
-
How is PhishER Plus priced in Saudi Arabia?
Per seat, quoted rather than published, with the rate moving on seat count and contract term. If you are combining it with KnowBe4 training the seat counts must match, which we set out explicitly. Blue Edge issues a written quotation in Saudi Riyals with local purchase order and invoicing terms.
Talk to Blue Edge about your reported-email workload
Blue Edge has always embraced our clients and partners as part of our team. Every project is performed with open communication, and a mutual respect with our clients provides the groundwork for our success.
Tell us your mail platform, your seat count and roughly how many suspicious emails your team handles each week. We will verify what your tenant supports, then come back with a written quotation and a deployment plan.