Supplied & supported in KSA by Blue Edge
KnowBe4 Security Awareness Training in Saudi Arabia
One in three employees will engage with a phishing email before you train them. After a year of continuous training, it is roughly one in twenty-five — supplied, deployed and supported across the Kingdom by Blue Edge in Dammam.
Blue Edge supplies, deploys and supports the KnowBe4 platform across Saudi Arabia — security awareness training, phishing simulation, compliance training, phishing incident response and real-time coaching. Licensing, rollout and support are handled in-Kingdom from our office in Dammam.
Training that changes behaviour, not a video everyone clicks through
KnowBe4 Security Awareness Training combines an on-demand training library with unlimited simulated phishing tests, so you can teach staff what an attack looks like and then measure whether the lesson actually held.
Most awareness programmes in Saudi Arabia are an annual slide deck and a signed attendance sheet. Everyone completes it, the file goes in the compliance folder, and nobody knows whether a single person would behave differently when a real phishing email lands. The training was delivered. Nothing was measured.
KnowBe4 inverts that. You start with a baseline phishing test to establish where your organisation actually stands, assign training based on what the results show, then keep testing. The number moves or it does not, and you can see it by department, by role and by individual.
Phish-prone Percentage — the one number that tells you if it worked
Phish-prone Percentage is the share of your staff who click, open or otherwise engage with a simulated phishing test. It is the single metric that makes an awareness programme accountable, because it can only be moved by behaviour changing. KnowBe4's 2026 benchmarking report analysed 42 million simulated phishing tests across 14.8 million users at 64,000 organisations.
| Stage of the programme | Average Phish-prone % | What it means in practice |
|---|---|---|
| Baseline, before training | 33.2% | One in three staff engage with a phishing email that reaches the inbox |
| After 90 days | 20.1% | A 40% drop — real, but the programme is only getting started |
| After 12 months | 4.2% | Roughly one in twenty-five. The steepest gains happen between month three and month twelve |
| After 24 months | 3.9% | The improvement holds and stabilises rather than drifting back |
Key takeaway: the ninety-day mark is not the finish line. Most of the risk reduction happens between month three and month twelve, exactly the window where one-off annual training programmes have already stopped. Budget for twelve months or the number will not move far.
Arabic across the whole programme, not just the login screen
Awareness training only works if staff understand it well enough to change what they do. In a mixed Saudi workforce that means Arabic for some teams, English for others, and often a third language on site. Partial localisation — an Arabic interface wrapped around English videos — does not solve that.
- Simulated phishing templates — the test emails themselves, in Arabic.
- Training and video modules — the actual teaching content, not subtitles.
- Security awareness resources — posters, newsletters and reinforcement material.
- Learner experience — the interface each employee logs into.
One campaign can run across multiple languages at once, alongside more than 34 languages in total, so you are not maintaining a separate Arabic programme and English programme side by side.
Four stages, then it repeats
Campaigns are automated once configured, so the programme keeps running without someone manually chasing completions every quarter.
Baseline test
A simulated phishing campaign runs before any training, with no warning. This gives you an honest starting number rather than a flattering one.
Assign training
Modules are assigned by role, department or risk level. Staff who failed the baseline can receive different content from those who reported the email correctly.
Test again, continuously
Unlimited simulated phishing runs on a schedule with varied templates, so staff cannot pattern-match their way to a good score.
Report and adjust
Results break down by department, role and individual. Weak areas get targeted content rather than the whole organisation repeating the same module.
On naming and shaming
Reporting can identify individuals, but the organisations that get the best results use it to target training, not to discipline people.
Staff who fear punishment stop reporting suspicious emails — and a reported email is the outcome you actually want. The point of the number is to find where training is needed, not who to blame.
Evidence for NCA ECC, SAMA CSF and PDPL
The National Cybersecurity Authority's Essential Cybersecurity Controls are mandatory for government entities and critical national infrastructure operators, and increasingly written into contracts for the organisations that supply them. Subdomain 1-10, Cybersecurity Awareness and Training Program, is the one this page speaks to directly.
An assessor asking about 1-10 wants more than a completion certificate. They want to see a programme that runs on a defined cycle, covers the workforce, adapts to identified risk and produces records. KnowBe4 generates that as a by-product of running the campaigns — completion data, test results and trend history, per user and per department.
Where this fits your controls
The same reporting supports subdomain 1-9 on cybersecurity in human resources and contributes to the human side of 2-4 on email protection.
It also speaks to the staff-awareness expectations in the SAMA Cyber Security Framework and the security obligations organisations carry under the PDPL.
What Security Awareness Training is not
We would rather set this out before the quotation than after the rollout.
It is not an email security gateway
This trains the people. It does not filter the mail. You still need email filtering — KnowBe4 addresses what happens when something gets through it, which is the case the filter did not catch.
It is not a one-quarter project
The data is clear that most of the improvement lands between month three and month twelve. A three-month pilot will show you a 40% drop and then stop short of the result you actually bought it for.
Not every module is in every tier
Content access, simulation channels and analytics differ by subscription level, and Compliance Plus and SecurityCoach are separate add-ons. We will state what your quotation includes rather than let it emerge at renewal.
Four subscription levels, priced per seat per year
Each level builds on the one below it. The right choice depends on how many simulation channels you need, how deep the content library has to go, and whether you need the analytics and integrations to report human risk to your board.
Silver
The core platform — unlimited simulated phishing, foundation training content, the Phish Alert Button and single sign-on. Suits smaller teams establishing a baseline for the first time.
Gold
Adds a wider training library, industry benchmarking so you can compare against your sector, advanced reporting and API access. The common starting point for organisations with a compliance obligation.
Platinum
Adds further simulation channels beyond email, AI-driven template selection and risk analytics with integration into your wider security stack.
Diamond
The full platform, including the complete content library of 1,300+ items across interactive modules, videos, games, posters and newsletters, plus the deepest integration and reporting options.
Add-ons. Compliance Plus, the regulatory and policy training library, is available across all four levels. SecurityCoach, which delivers real-time coaching when a user does something risky, is available on the higher levels and carries a minimum seat count. Feature allocation between levels changes from time to time, so we confirm the current position against your seat count when we quote rather than working from a published table.
Licensed, rolled out and supported inside the Kingdom
An awareness programme fails more often on rollout than on product. Staff do not know why they are being tested, a manager escalates the first simulation as a real attack, and the programme loses credibility in week one. Blue Edge supplies KnowBe4 as a technology partner operating in Saudi Arabia, which is where that difference gets made.
- Baseline test before you commit — see your real starting number before signing anything, so the business case is built on your data.
- Launch communications — how the programme is announced internally, including the message to managers so the first simulation does not cause an incident.
- Language and campaign design — Arabic and English groups configured in one programme, with content matched to roles.
- Compliance mapping — reporting configured to produce the evidence an NCA ECC or SAMA assessment will ask for.
- Local commercial terms — quotation, purchase order and invoicing handled in-Kingdom, in Saudi Riyals, through a Saudi entity.
- Support in Arabic and English — from our team in Dammam, covering Riyadh, Jeddah, Khobar and the Eastern Province.
Find out your organisation's real starting number
KnowBe4 is priced per seat per year and quoted rather than listed, because the rate moves with seat count, subscription level and contract term. Tell us your headcount and we will come back with a written quotation and a rollout plan — and if it is useful, a baseline phishing test first so the business case sits on your own data rather than a global average.
Security Awareness Training in Saudi Arabia — common questions
-
Is the training content available in Arabic?
Yes, and across the whole programme rather than just the interface. Arabic is supported for simulated phishing templates, training and video modules, awareness resources, Compliance Plus training and the learner experience each employee logs into. More than 34 languages are supported in total, and a single campaign can run across several languages at once.
-
What is a Phish-prone Percentage?
It is the share of your staff who click, open or otherwise engage with a simulated phishing test. KnowBe4's 2026 benchmarking report puts the global average at 33.2% before training, falling to 20.1% after 90 days and 4.2% after twelve months of continuous training and testing. It is the metric that makes an awareness programme measurable rather than assumed.
-
How long before we see results?
The first 90 days typically deliver around a 40% reduction. But the benchmarking data is clear that the steepest improvement happens between month three and month twelve. Programmes that stop after a quarter capture the smaller half of the benefit. Plan for a twelve-month cycle at minimum.
-
Does it satisfy NCA ECC requirements?
It supports subdomain 1-10, Cybersecurity Awareness and Training Program, and contributes to 1-9 on cybersecurity in human resources. No platform makes an organisation compliant on its own — the controls cover policy, governance and process as well — but KnowBe4 produces the programme records and completion evidence an assessor will ask to see, rather than a folder of attendance sheets.
-
How is KnowBe4 priced in Saudi Arabia?
Per seat, per year, billed annually, across four levels — Silver, Gold, Platinum and Diamond. The per-seat rate falls as seat count rises, and multi-year terms change the number again, which is why it is quoted rather than published. Blue Edge issues a written quotation in Saudi Riyals with local purchase order and invoicing terms.
-
Can we run a phishing test before we buy anything?
Yes, and we usually recommend it. A baseline test gives you your organisation's real starting number instead of a global average, which makes the internal business case far easier to argue. Talk to us and we will set it up.
-
Will staff feel they are being tricked or monitored?
That depends almost entirely on how the programme is announced, which is why we spend time on launch communications during rollout. Programmes framed as building a shared defence work. Programmes that feel like a trap cause staff to stop reporting suspicious emails, which removes the most valuable signal you have.
-
We already have email filtering. Do we still need this?
The two solve different problems. Filtering stops most of what is sent. Awareness training addresses what reaches the inbox anyway — which, by definition, is the message your filter did not recognise, and increasingly one written with AI assistance to avoid the patterns filters look for. KnowBe4 reports a 17% rise in phishing attacks since late 2025.
Talk to Blue Edge about your awareness programme
Blue Edge has always embraced our clients and partners as part of our team. Every project is performed with open communication, and a mutual respect with our clients provides the groundwork for our success.
Tell us your headcount and the languages your workforce needs. We will come back with a written quotation, a rollout plan and a clear view of which subscription level fits — and which add-ons you do not need.