KnowBe4 PhishER/PhishER Plus
Incident response software
Security orchestration, automation, and response (SOAR) software
System security software
- Features
- Ease of use
- Ease of management
- Quality of support
- Affordability
- Market presence
Take the quiz to check if KnowBe4 PhishER/PhishER Plus and its alternatives fit your requirements.
$1.50 per seat per month
Free Trial unavailableFree version unavailable
Small
Medium
Large
- Education and training
- Real estate and property management
- Retail and wholesale
What is KnowBe4 PhishER/PhishER Plus
KnowBe4 PhishER/PhishER Plus is an email security incident response and automation platform focused on triaging, analyzing, and remediating user-reported phishing and suspicious messages. It is used by security operations and IT teams to centralize reported emails, enrich them with threat intelligence and analysis, and automate response actions such as ticketing, user notifications, and mailbox search-and-delete. PhishER Plus adds expanded automation and integrations compared with the base PhishER offering, with an emphasis on streamlining phishing-specific workflows rather than broad, multi-domain SOAR use cases.
Purpose-built phishing triage
The product centers on handling user-reported phishing emails, including classification, prioritization, and analyst review workflows. This specialization can reduce time spent on manual inbox monitoring and ad hoc investigation steps. It fits organizations that receive high volumes of reported emails and need consistent handling and auditability.
Automation for email remediation
PhishER supports automated actions tied to phishing response playbooks, such as routing, notifications, and remediation steps. In environments where phishing response is repetitive, automation can standardize outcomes and reduce analyst workload. The phishing-specific focus can be simpler to operationalize than general-purpose automation platforms for this single use case.
Integrations with security stack
PhishER/PhishER Plus is designed to connect with common security and IT tools used in phishing response workflows (for example, ticketing, threat intelligence, and email/security controls). These integrations help move from detection/triage to response actions without switching systems. This can improve handoffs between end-user reporting, SOC review, and IT remediation.
Narrower than broad SOAR
PhishER is primarily oriented around phishing email handling rather than end-to-end security orchestration across many telemetry sources and incident types. Organizations seeking a single platform for cross-domain detection-to-response automation may still need additional tooling. This can limit its role to a specialized component within a larger incident response program.
Depends on email ecosystem fit
Response automation effectiveness depends on compatibility with the organization’s email platform, security controls, and permissions for actions like search-and-delete. Some environments may require additional configuration, connectors, or process changes to achieve full remediation automation. Constraints in email APIs or administrative policies can reduce the level of automation achievable.
Plus features may be required
Some advanced automation and integration capabilities are positioned in the Plus tier rather than the base product. Teams may need the higher tier to meet operational requirements for scale, enrichment, or workflow automation. This can increase total cost compared with using the base tier for simple triage only.
Plan & Pricing
| Plan | Price | Key features & notes |
|---|---|---|
| PhishER Plus (101–500 seats) | $1.50 per seat/month (MSRP, USD) — monthly price shown for a 3-year term | Automatic Message Prioritization; Emergency Rooms; KnowBe4 Email Add-in Button; Rule creation; Custom workflows; Security roles; PhishML™, PhishRIP™, PhishFlip™; PhishER Blocklist for Microsoft 365; SIEM integrations; PhishER Plus Threat Intel; CrowdStrike Falcon Sandbox integration. Pricing listed as of January 2025 for North America. |
| PhishER Plus (501–1000 seats) | $1.15 per seat/month (MSRP, USD) — monthly price shown for a 3-year term | Same feature set as above; per-seat price decreases at this tier. |
| PhishER Plus (1001+ seats) | Request a quote / Contact sales | Enterprise volume pricing; KnowBe4 lists “Get a quote” / “Request a Quote” for 1001+ seats. |
Seller details
KnowBe4, Inc.
Clearwater, Florida, United States
2010
Private
https://www.knowbe4.com/
https://x.com/knowbe4
https://www.linkedin.com/company/knowbe4/
