KnowBe4 Cloud Email Security

Detects signs of internal mailbox compromise (anomalous login geography, mail forwarding rule creation, unusual send volume), and can trigger automated session revocation.

Checks outbound messages before they are sent for recipients who do not match the sender's normal communication pattern, wrong or lookalike addresses, and attachments that do not belong with the message, and warns or blocks the sender, so accidental data exposure by misaddressed email is stopped at the point of sending.

Detects AI-generated impersonation in email-borne fraud - synthetic text, deepfake audio and video lures, and cloned sender styles - beyond signature and rule-based content analysis.

Separates newsletters and bulk mail from threats by routing them to dedicated folders, refining classification from how each user files messages.

Inserts dynamic banners into delivered messages flagging risk signals such as first-time senders, lookalike domains, or unusual payment requests at read time.

Builds per-user and per-vendor communication baselines from historical email patterns to detect anomalous content, timing, or sender behavior without relying on signatures or blocklists.

Extends the same phishing, malware, and social-engineering detection applied to email to messages and files in collaboration and productivity tools such as Teams, Slack, SharePoint, OneDrive, Google Drive, and Salesforce, through the tools' APIs, so threats that arrive outside the inbox are caught by the same policies and remediation.

Connects to Microsoft 365 or Google Workspace via native APIs for visibility into internal and delivered mail, enabling post-delivery clawback without changing MX records.

Presents one quarantine and release workflow across the vendor's own detections and the cloud email provider's native filtering, so administrators and end users do not manage two split quarantines when an API-based product is layered on Microsoft Defender for Office 365 or Google Workspace.

Automates the intake, deduplication, and triage of user-submitted suspicious emails, cross-references against in-flight campaigns and triggers retroactive remediation across all recipients.

Detects compromised or spoofed third-party supplier accounts by analyzing communication pattern deviations, domain aging, and content signals, targeting invoice fraud and payment redirection attacks.

Analyzes email body text semantically to detect social engineering, pretexting, and urgency manipulation in messages that contain no malicious attachments or URLs.