KnowBe4’s Defend system takes top spot in Microsoft-linked real-world email security benchmark

KnowBe4 said its KnowBe4 Defend solution ranked first in what it described as Microsoft’s real-world email security benchmark, marking a rare public win for an endpoint and security-awareness vendor in a testing environment tied to Microsoft’s ecosystem.

In its announcement, KnowBe4 highlighted performance across “all three incremental detection” measures referenced in the benchmark. The company did not publish the full test methodology, the specific organizations included in the evaluation, or the precise scoring rubric in the posting associated with the news.

The company also framed the result as relevant to today’s threat model, noting that Defend is designed to secure both humans and AI agents. That language indicates that the product is intended to operate not only against conventional phishing and email-based scams that target people, but also against risks created when AI systems receive, interpret, or take action based on email content.

Microsoft, meanwhile, is at the center of much of enterprise email traffic and identity infrastructure, meaning benchmark results tied to Microsoft environments can be persuasive for security teams that are trying to align new controls with Microsoft 365 workflows. Even so, the KnowBe4 release did not specify which Microsoft services were part of the benchmark scope beyond referencing Microsoft’s test.

For buyers, incremental detection categories generally matter because they suggest how quickly and effectively a system catches threats at multiple stages, such as earlier versus later indicates during an attack chain. However, KnowBe4 did not enumerate what those three categories were, nor did it provide detection-rate percentages, false-positive rates, or time-to-detect figures in the announcement connected to the report.

KnowBe4 also did not disclose whether the top ranking reflected results from a single dataset, a set of repeated trials, or a broader set of real-world email campaigns. Without those details, it is difficult to assess how stable the ranking would be across different organizations, email configurations, and threat mixes.

Still, the company’s emphasis on “real-world” testing underscores a competitive shift in security product marketing, where vendors try to demonstrate outcomes using adversary-like inputs rather than only lab simulations. If additional documentation is released, security practitioners will likely focus on the test harness, how “real world” was operationalized, and what controls were included or excluded.

As of the publication of the report, KnowBe4 had not provided the underlying benchmark report text, the scoring methodology, or the names of the other competitors evaluated alongside Defend. The next question for the market will be whether Microsoft or the benchmark organizer publishes further documentation that allows teams to verify the result and map the detected categories to specific operational use cases.