Supplied & supported in KSA by Blue Edge
KnowBe4 Phishing Simulation for Saudi Organisations
Stop guessing how your staff would react and find out. Realistic simulated phishing across email, SMS, voice and QR codes — set up, run and reported by Blue Edge in Dammam.
Blue Edge supplies, deploys and supports the KnowBe4 platform across Saudi Arabia — phishing simulation, security awareness training, compliance training, phishing incident response and real-time coaching. Campaign setup, licensing and support are handled in-Kingdom from our office in Dammam.
A safe version of the attack, sent on purpose
A phishing simulation sends your own staff a harmless copy of a real attack. Nobody is compromised, nothing is installed, and no data leaves the organisation. What you get back is a number: how many people engaged with it, and who.
That number is usually the reason organisations buy. A security manager can argue for a training budget for months and get nowhere. One baseline test showing that a third of the workforce clicked ends the argument in a single meeting.
It is also the cheapest way to find out where you stand. Simulation is included across every KnowBe4 subscription level with unlimited tests, so once you are licensed the marginal cost of testing again next quarter is nothing.
Email is where it starts, not where it stops
Testing only email leaves most of the modern attack surface untested. A workforce that has learned to be suspicious of email will still scan a QR code on a printed notice or return a call to a number that arrived in a message.
Link tests
The classic case — a message that asks the user to follow a link.
Attachment tests
Whether staff open files from unexpected senders.
Data entry tests
Whether they enter credentials on a page that is not what it claims to be.
Spear phishing
Targeted messages using details specific to the individual or role.
Reply-to tests
No link at all, just a request for a reply — the pattern behind most business email compromise.
QR code tests
Codes on posters, invoices and notices, which bypass email filtering entirely.
Callback tests
A message asking the user to phone a number — the technique behind current callback scams.
Voice and SMS simulation are available alongside email, and the vectors included depend on your subscription level. We confirm which are in scope when we quote.
Built from attacks in circulation, not invented scenarios
A simulation only teaches something if it resembles what your staff will actually receive. Templates written from imagination age quickly and test for the wrong things.
KnowBe4 maintains thousands of templates with unlimited use, and two categories matter most here. Reported Phish templates are built from genuine phishing emails that KnowBe4 users flagged through the Phish Alert Button, stripped of malicious links and identifying details, and refreshed weekly. Real Scam templates are rebuilt from documented attacks in current security reporting.
You are testing against what is being sent this month, not what worked three years ago.
Arabic templates, not translated ones
Simulated phishing templates are available in Arabic, alongside more than 34 languages. That matters more here than in most markets.
A test written in English and machine-translated into Arabic reads wrong to a native speaker, and staff spot it for the wrong reason — the language, not the red flags. The result is a flattering score that tells you nothing. Templates written natively in Arabic test what you actually want to test.
One test tells you where you stand. Twelve months change it.
A single simulation is a diagnostic. A repeating programme is what moves the number — and the data on how far it moves is unusually clear.
| Stage | Average click rate | What happens at this point |
|---|---|---|
| Baseline test | 33.2% | Sent with no warning. One in three staff engage. This is the number that unlocks budget. |
| 90 days | 20.1% | Training assigned and testing repeated. A 40% drop, and the point where many programmes wrongly stop. |
| 12 months | 4.2% | Roughly one in twenty-five. The steepest gains land between month three and month twelve. |
| 24 months | 3.9% | The improvement holds rather than drifting back toward the baseline. |
Key takeaway: these figures come from KnowBe4's 2026 benchmarking report, covering 42 million simulated tests across 14.8 million users at 64,000 organisations. If you run one test and stop, you get the diagnosis without the treatment.
Test against the lures your staff actually see
Attackers localise. A generic international template testing a Saudi workforce misses the themes that are actually working in the Kingdom, so the score comes back reassuring and the real exposure stays hidden.
When we design a campaign we select templates around the categories your staff genuinely encounter — messages imitating government service notifications, banking and payment alerts, delivery and logistics updates, HR and payroll communications, and supplier invoice or procurement requests. Seasonal pressure points matter too: attack volume around Ramadan, Hajj and the year-end procurement cycle behaves differently from the rest of the year.
The mix is agreed with you before anything is sent, and templates can be adjusted for the sectors and roles that carry the most risk in your organisation.
Numbers your board will accept
Security awareness fails at board level when it is reported as activity rather than risk. "We trained 400 people" is activity. "Click rate fell from 31% to 6% across twelve months" is risk, and it is the version that gets renewed.
Organisation-level trend
One line over time. The single chart an executive committee needs and the only one most of them will look at.
Breakdown by department and role
Where the risk actually sits. Finance and procurement usually behave differently from engineering, and the response should differ too.
Industry benchmarking
Your figure against your sector, which turns an abstract percentage into a position relative to peers.
Individual history
A per-user timeline. Useful for targeting training, and for the compliance evidence an NCA ECC or SAMA assessment will ask to see.
Report the reporting rate too
Click rate is the headline number, but on its own it is only half the picture. The other half is how many staff actively reported the message.
A workforce with a 6% click rate and a 5% report rate is quiet. A workforce with a 6% click rate and a 60% report rate is actively defending the organisation — and giving your security team early warning on live attacks.
Track both. Organisations that only measure clicks end up punishing failure rather than rewarding vigilance, and staff quietly stop reporting anything.
What phishing simulation is not
Better said before the quotation than after the first campaign.
It is not a penetration test
A simulation tests how people respond to a message. It does not test your network, your applications or your configuration. Both belong in an NCA ECC programme and they answer different questions.
It is not a staff performance review
Used to discipline people, it produces a workforce that hides mistakes and stops reporting suspicious email. That costs you far more than the click rate it improves on paper.
It is not enough on its own
Testing without training measures the problem repeatedly without fixing it. The click rate falls because staff learn to spot simulations, not attacks. Simulation and training belong together.
The first campaign is the one that can go wrong
Most of the risk in a phishing programme is in week one. Simulated emails land in spam because the platform was never allow-listed. A manager escalates the first test as a real breach and the security team spends a day standing down an incident that never happened. Staff hear about it second-hand and decide the company is trying to catch them out.
- Technical allow-listing — configured in Microsoft 365 or Google Workspace before the first send, so tests reach the inbox and the results mean something.
- Stakeholder briefing — the security team, service desk and senior managers know a campaign is running before it runs.
- Campaign design — template mix, difficulty, send timing and randomisation agreed with you rather than left on defaults.
- Arabic and English groups — configured in one campaign, not run as two separate programmes.
- Reporting configured — set up to produce the evidence an NCA ECC or SAMA assessment expects, from the first campaign rather than retrofitted later.
- Local commercial terms — quotation, purchase order and invoicing in-Kingdom, in Saudi Riyals, with support in Arabic and English from Dammam.
Find out your real click rate before you commit to anything
We will run a baseline phishing simulation against your organisation and give you the result — your actual click rate, broken down by department, with no obligation to buy a licence at the end of it. It is the fastest way to find out whether you have a problem, and the number you get is a far better business case than any global average on this page.
Phishing simulation — common questions
-
Is it legal to send fake phishing emails to our own staff?
Simulated phishing against your own workforce on your own systems is standard security practice and is what regulators expect to see as part of an awareness programme. Nothing malicious is sent and no personal data leaves the platform. The practical requirements are internal: get the programme approved, make sure your employment and acceptable-use policies cover security testing, and handle the results in line with PDPL obligations. We work through this with you during setup.
-
Should we tell staff a simulation is coming?
Announce the programme, not the individual tests. Staff should know the organisation runs security testing and why. They should not know that a test is arriving on Tuesday, because then you are measuring alertness on Tuesday rather than normal behaviour. Announcing the programme in advance is also what keeps it from feeling like a trap.
-
Are the templates available in Arabic?
Yes. Simulated phishing templates are available in Arabic alongside more than 34 languages, and a single campaign can run across several languages at once. This matters because a poorly translated test gets spotted for the wrong reason — the language rather than the red flags — which produces a flattering score and no real insight.
-
How often should we run simulations?
Monthly is the usual rhythm for a live programme, with randomised send times so staff cannot anticipate them. Tests are unlimited across all subscription levels, so frequency is a matter of how much reporting you want to act on rather than cost. What does not work is one test a year — the gap is long enough for the lesson to fade completely.
-
What happens to someone who clicks?
They land on a page explaining what just happened and what the warning signs were, and training can be assigned automatically at that moment — when the lesson is most likely to stick. That is the whole design. Nothing is installed, nothing is compromised, and the recommended response is training rather than disciplinary action.
-
Will the simulations get blocked by our email filter?
They will, unless the platform is allow-listed properly first. This is the single most common reason a first campaign produces a meaningless result — the tests never reached the inbox, so a 2% click rate reflects your spam filter rather than your staff. We configure this in Microsoft 365 or Google Workspace before the first send.
-
Do we need to buy the full training platform to run simulations?
Simulation and training come together in the KnowBe4 subscription rather than being sold separately, and in practice you want both — testing without training measures the problem without fixing it. Which simulation vectors are included depends on the subscription level, so we confirm what is in scope when we quote.
-
Does this count toward NCA ECC compliance?
Simulation results and the training that follows form part of the evidence for subdomain 1-10, Cybersecurity Awareness and Training Program. No tool makes an organisation compliant on its own, since the controls also cover policy and governance, but a documented testing programme with trend data is considerably stronger evidence than a set of attendance sheets.
Talk to Blue Edge about a baseline test
Blue Edge has always embraced our clients and partners as part of our team. Every project is performed with open communication, and a mutual respect with our clients provides the groundwork for our success.
Tell us your headcount, your email platform and the languages your workforce needs. We will set up a baseline simulation and come back with your real click rate, broken down by department.