PhishER is the natural companion to the PhishAlert button. We can't respond to every submission, and we don't want copies of potentially malicious emails sent to IT. PhishER gives us an outside mailbox that submissions go to so they can be analyzed and responded to automatically. You hope that the tool concludes that most if not all submissions are clean or even spam, but in the event the PhishER machine learning or VirusTotal scanning of links and attachments that indcate a threat, the tool can alert the submitter, your IT team, and take action to search for the same email across your mail server to pull them before anyone else has a chance to interact with it. We encourage our users to PhishAlert anything suspicious because they might not be the only person that received a malicious email, so reporting it first and getting all copies pulled fast can save the company. But let's face it, most submissions are benign, but at least users are getting immediate automated responses to their submissions that take manpower out of the equation. Submit all you want, I just need to be alerted to potential threats. PhishER has easily paid for itself.

The VirusTotal integration relies on the customer getting an API key. The free account API key has a limitation on polls per day that we often experience when there's been a lot of submissions. Paid VT accounts are cost prohibitive and there's no alternative.

Automating the process of analyzing and responding to user submissions.

As a new admin to the PhishER platform is was very easy to pickup and use from day 1. The implementation and integration processes were easy and quick. It has become a staple of our organization to fight against phishing threats.

Nothing comes to mind in terms of dislikes

PhishER is helping us asses threats and getting out users more aquainted with flagging emails as phishing. It is helping me filter through these and investigate questionable emails

The flexibility to create rules and powerful fuctions to identity threat. Once you created all rules and actions, you can completely rely on it.

There is learning curve to learn how to use PhishER properly. You also need to learn Yara rule editor to create proper Yara rules.

It automatically caterized 90% suspicious emails and took proper actions on them without human intervention. Our support just needs to work on 10% users reported emails.

Integrating with all the other functionality that Knowbe4 brings makes the PhishER product seamless.

We receive a high volume of items, so navigating through and filtering is critical.

Reporting phishing emails and extracting that from users emails.

I like that it tahs emails and sets a acore based on threat, clean, or threat

Sometimes images dont always show and hard to troubleshoot the email

Help catch emails that get through our spam filter.

I like the ease of setting up "actions" and then being able to click on the appropriate action for each reported email

I dont like the fact that you have to purchase a VT licences if you go over a certain amount of reported emails.

It's helping our members be able to report a suspicious email and our security team can investigate it when we have time rather than the member calling us on the phone every time they have a questionable email.

Being able to pull all infected or suspicious emails (PhishRIP) from the company network before "the usual suspects" have the opportunity to click or open malicious attachments brings a great deal of peace of mind. PhishFLIP's ability to create a testing opportunity out of what was once a genuine threat is also valuable, as it creates a "real world" training experience. Integration with VirusTotal allows automated scanning of links or attachments which speeds up response time

There is some room for improvement in the automation of resolving reported emails. Setting up rules is not particularly intuitive and, having not seen a volume to justify it, I have not spent the time to figure it out. Additionally, the query process for PhishRIP feels unpolished as it's not always easy to narrow down requirements. Also, if the reported email comes via a chain of "Is this safe?" emails being passed around, the original contents (sender, recipient, etc.) can become lost in the traffic and queries can become impossible to create effectively.

The inherent flaw with the PhishER approach is that it does little to mitigate ongoing attacks. This is in line with KnowBe4's approach to CyberSecurity in general which emphasizes the "human side" of cybersecurity, but can be frustrating when you're being bombarded by a specific attacker who is hoping his persistence will pay off and PhishER offers no way to shut down specific users, domans, IP's etc. All of that needs to be done at the firewall or ESA level.

As we are now looking at replacing our end-of-life ESA, we are discovering that there are other companies that can offer more holistic packages that include the hardware, the training, and the software. PhishER was something we added on as part of our need to implement training and so, at the time, working with KnowBe4 made a great deal of sense. However, now that we are looking at replacing our ESA I would have preferred to opt for a total-solution package. This is not because I am in anyway dissatisfied with KnowBe4 or their PhishER product, but because I dislike having to manage multiple tools and will always opt for more complete integration in a centralized package where I can.

If you're in need of a "total package" hardware, software, and training oriented security solution, there are, I think, better options - albeit far more expensive ones. But if you're looking for something to add onto your existing security measures, then KnowBe4 is an effective and affordable option.

Multiple instances of widespread attacks have been shut down, quickly and efficiently. This reduces the time spent on addressing the attack and minimizes vulnerability.

We are already seeing the benefits of PhishER at our company. Our employees get excited about discovering phishing attempts.

Getting PhishER stood up was a bit of struggle but that was not a deterrent. It is a great program.

It is helpimg out user get more familiar with phishing attemps and helping us keep the phishers out of our data.

Simple to grasp at first glance yet very deep in features.

There are a lot of options and it can be overwelming

Being aware of bad actors and how many there are out there

PhishER is amazing as i have implemented it for every user in my enviroment and it has helped stop a lot of phising attempts.

I have also notice it has help reduce people asking if something is spam. they know click the button and if it is spam it will be gone for good

the only real dislikes i have with the software is the deplyment to some machine. as it wouldnt work with group policy deployment. so it took about an hour or so to get the remaining machines to install the software.

The interface could use a bit of work also

im using it to solve issue we have been having with spam emails. also to reduce my spent time on looking into if something is spam or not. also is helping usings to detect spam on their own