Supplied & supported in KSA by Blue Edge
KnowBe4 SecurityCoach — Real-Time Coaching in Saudi Arabia
Your security stack already sees the risky click. This turns that alert into a short, specific message to the person who made it, seconds later — while they still remember doing it. Supplied and supported in the Kingdom by Blue Edge in Dammam.
Blue Edge supplies and configures KnowBe4 Real-Time Coaching across Saudi Arabia — security vendor integrations, detection rule design, coaching categories and delivery setup. Licensing and support are handled in-Kingdom from our office in Dammam.
SecurityCoach is now called Real-Time Coaching
If you have been looking for SecurityCoach and cannot find it, this is why. KnowBe4 renamed the product to Real-Time Coaching, and it now sits as a feature of the Security Awareness Training platform rather than as a separate bolt-on.
It lives in the Coaching tab of the KnowBe4 console, alongside your detection rules, SecurityTips, dashboard and reports. The older SecurityCoach documentation is still available as a legacy section, which is where most search results still point.
The capability has not been withdrawn or reduced. It moved and it was renamed. Anyone quoting you for "SecurityCoach" as a standalone product is working from material that is out of date, and the commercial terms will have moved with the packaging.
Training happens in January. The risky click happens in August.
Security awareness training works — the benchmark data is unambiguous about that. But it teaches in advance, and people apply it in the moment. Between those two points sits seven months, four hundred emails and a deadline.
Real-Time Coaching closes that distance. When someone opens a risky attachment or visits a blocked category of site, the tools you already run generate an alert. Instead of that alert going only to your security team, it also produces a short message to the person who caused it, explaining what happened and why it mattered — and it works in the other direction too, sending a SecurityTip when someone correctly reports a simulated phishing test.
Where this fits
Awareness training builds knowledge. Phishing simulation measures it. Real-Time Coaching applies it at the moment of the actual behaviour.
If you already run training and your click rate has plateaued, this is the layer that moves it again — because it is the only one that reaches the person while the action is still fresh.
From vendor alert to coaching message
Five stages, all automatic once configured. Your existing tools do the detecting.
Your vendors detect
The security products you already run monitor email, endpoint and browser events as part of their normal operation.
Events are shared
Those vendors pass the event data to KnowBe4 over standard API integrations.
Detection rules match
KnowBe4 checks each event against your detection rules. System rules ship for each vendor and you can write custom ones.
The event lands on a timeline
A matched event is added to that user's events timeline, and feeds their individual and the organisation's risk score.
The user is coached
If the rule belongs to an active coaching category, a SecurityTip goes to that person through Teams, Slack, Google Chat or email.
The step people miss
Enabling a detection rule does not send anything. Rules track behaviour; coaching categories send the message. A programme with every rule switched on and no active categories will produce a very interesting dashboard and coach nobody.
It runs on the security stack you already bought
Standard API integrations across email, identity, web, endpoint and SIEM or SOAR vendors — Microsoft, CrowdStrike, Cisco and dozens of others. The number of third-party integrations you get depends on your subscription level, so we confirm that against your stack before quoting.
Endpoint
Malware detections, blocked executions and risky device activity turned into coaching for the person at the keyboard.
Attachment and link events from your mail security layer, coaching the specific user rather than sending another all-staff warning.
Web
Blocked categories, unsanctioned applications and risky browsing, coached at the moment the block happens.
Identity & SIEM
Authentication and correlated events, so behaviour already flowing into your SIEM can also reach the user it belongs to.
Behaviour, not completion rates
Course completion tells you people pressed play. Real-Time Coaching reports on what they actually did — how many events each user triggered, which rules fire most, whether the number falls after coaching starts, and how individual risk scores move over time.
The reporting set covers detection rules, coaching activity, and separate risk reports for your endpoint, email and web security vendors. Most views default to the last 90 days.
For a security leader presenting to a board, this is the difference between "94% of staff completed training" and "risky web events per user fell by half over two quarters." Only one of those is evidence.
Four things to settle before you buy
It detects nothing itself
Every event comes from your existing vendors. If your endpoint, email and web tooling is thin, there is little to coach on. This amplifies a stack — it does not replace one.
User mapping decides everything
Events have to be matched to named users. Unmapped events cannot be coached and show as a gap on the dashboard. Getting mapping right early is most of the deployment work.
Integrations vary by tier
How many third-party vendors you can connect depends on your subscription level, and third-party user mapping requires a higher tier. We check this against your stack before quoting rather than after.
Tone is a policy decision
Coaching that reads as surveillance breeds resentment fast. Agree the tone, the rules that trigger it and the frequency with HR before launch, not after the first complaint.
Configured for your stack, from Dammam
The product ships with detection rules enabled and nothing being sent. What decides whether it works is which rules you build categories around, how the messages read, and whether the user mapping is clean. That is configuration work, and it is local work.
Stack review first
Which of your vendors integrate, and how many integrations your subscription level allows.
User mapping
Matching vendor events to named users so coaching actually reaches someone.
Rule and category design
Starting with a small number of high-signal behaviours rather than switching everything on.
Arabic and English delivery
SecurityTips are localised to each recipient's training language, and you can upload your own media.
NCA ECC alignment
Coaching and behaviour records supporting the awareness and training expectations of subdomain 1-10.
Local commercial terms
Quotation, purchase order and invoicing in Saudi Riyals through a Saudi entity, support in Arabic and English.
Send us your security vendor list
Real-Time Coaching is delivered through the KnowBe4 platform and quoted rather than listed, with integration allowances varying by subscription level. Tell us which endpoint, email and web security products you run and we will confirm what integrates, what your level covers, and what it costs — before you commit to anything.
SecurityCoach and Real-Time Coaching — common questions
-
What happened to KnowBe4 SecurityCoach?
It was renamed. SecurityCoach is now called Real-Time Coaching and is a feature of the KnowBe4 Security Awareness Training platform, found in the Coaching tab of the console rather than as a separate product. The previous SecurityCoach documentation remains available as a legacy section. The capability was not withdrawn or reduced.
-
How does it know a user did something risky?
It does not detect anything on its own. Your existing security vendors monitor email, endpoint and browser events and share those events with KnowBe4 over API integrations. KnowBe4 matches them against your detection rules, adds matches to the user's timeline, and sends a SecurityTip if the rule sits in an active coaching category.
-
How are coaching messages delivered?
Through Microsoft Teams, Slack, Google Chat or email. Email is enabled by default, but chat delivery generally lands better because it reaches people where they already work. Users must exist in your KnowBe4 SAT console to receive anything.
-
Are SecurityTips available in Arabic?
SecurityTips are localised based on each recipient's training language, and many of the 200 tips in the catalogue are available across 34 languages including Arabic. You can also upload your own SecurityTip media if you want messages in your own wording or branding.
-
Will staff feel they are being monitored?
That depends entirely on the tone you set and the rules you choose. Coaching framed as help works; coaching that reads as surveillance generates complaints and quiet workarounds. Agree the message wording, trigger rules and frequency with HR before launch. Sending positive tips when someone reports a phishing test correctly also changes how the whole programme is received.
-
Do we need a specific subscription level?
Real-Time Coaching is delivered through the Security Awareness Training platform, and how many third-party vendor integrations you can connect varies by subscription level. Third-party user mapping requires a higher level. KnowBe4 has changed this packaging recently, so we verify the current position against your seat count and vendor list at quotation rather than working from a published table.
-
What does it report on?
Detection rule activity, coaching activity, vendor events, and separate risk reports for endpoint, email and web security vendors. The dashboard shows SecurityTips delivered, percentage of users coached, top detection rules and top users by detections. Most views default to the last 90 days. Events also feed individual and organisational risk scores.
Talk to Blue Edge about coaching your users
Blue Edge has always embraced our clients and partners as part of our team. Every project is performed with open communication, and a mutual respect with our clients provides the groundwork for our success.
Send us your security vendor list and headcount. We will tell you what integrates, what your subscription level allows, and which handful of detection rules are worth starting with.