Cookie settings

Choose which cookies Keepnet can use. You can change this at any time from "Cookie settings" at the bottom of every page.

Book a demo

Keepnet integrations

Integrations that turn your security stack into behaviour data

Connect your tools once. Keepnet acts on their signals and keeps the record.

Popular integrations

New integrations are added regularly.

Why connect Keepnet

What your integrations make possible

The most common uses. Your use cases and requirements decide the rest.

Behaviour data

Signals from your security tools become named behaviours in the employee record.

Behaviour signals

Automation

Reports analysed, mailboxes cleaned, employees synced and simulations sent, with fewer manual steps.

Automation integrations

Security

Admins sign in with SSO. Connections use scoped access you approve.

Identity and access

Audit and accountability

Keepnet audit logs stream to your SIEM, and training records stay in step with your LMS.

Audit logs and SIEM

Behaviour data

Signals become named behaviours, not black-box scores

You see which tool reported what, which behaviour it became, and what the employee got next.

Signals in

From your stack

Microsoft DefenderEntra ID ProtectionMicrosoft SentinelGoogle SecOpsMimecastZscalerGoogle WorkspaceCornerstoneYour tools, through the APIKeepnet simulationsReported emails, SMS and calls

Behaviour record

One record per employee

Risky and positive behaviours, each with a severity, drawn from a catalogue of 259 behaviours.

Actions out

What changes next

Next trainingNext simulationNudge by email, SMS or TeamsBefore and after reportingWebhooks to your toolsAudit logs to Splunk or syslog
SignalMimecast URL clickBehaviourClicked a malicious linkNextShort training, then a follow-up simulation
SignalEntra ID risky sign-inBehaviourRisky sign-inNextNudge in Microsoft Teams
SignalCornerstone overdue courseBehaviourOverdue trainingNextReminder, counted in the record

Directory

Keepnet integrations

Pick a job or search a tool. Open any card for what it does, what data moves and what you need.

Last updated October 2026.

Behaviour signals

Events from your security tools become named behaviours in the employee record.

Microsoft DefenderTurn Defender alerts into each employee’s behaviour record.Entra ID ProtectionMicrosoftBring risky sign-ins into the behaviour record.Microsoft SentinelUse the alerts your SOC already triages as behaviour signals.Google SecOpsGoogle (Chronicle)Pull per-employee risk signals from your Google SecOps events.MimecastTurn Mimecast click logs into behaviour data. Your gateway stays as it is.Zscaler Internet AccessSee web behaviour by employee, including consumer AI sites.Cornerstone OnDemandCount on-time and overdue training as behaviour.

Phishing analysis

Reported emails are checked by the engines you connect, on your own keys.

VirusTotalGoogleCheck URLs, files and IPs against many antivirus and reputation engines.FortiSandboxFortinetDetonate suspicious URLs and files in Fortinet’s sandbox.VMRayDetonate samples in VMRay and attach the verdict to the incident.ANY.RUNRun URLs and files in an interactive sandbox.OPSWAT MetaDefenderScan with many engines at once.IBM X-ForceAdd IBM threat intelligence to verdicts.Google Safe BrowsingCheck URLs against Google’s unsafe site lists.Google Web RiskClassify URLs with Google Web Risk lists.Spamhaus ZENCheck sender IPs against Spamhaus blocklists.USTAQuery USTA threat intelligence for URLs and file hashes.Cyber X-RayRoksitScan URLs with the Roksit engine.Your own analysis APICross Company IntegrationSend reported URLs to your own API and use its verdict.

Mailbox investigation

Find a reported email in the mailboxes that received it, then remove or tag it.

Microsoft 365Find, remove and simulate across Microsoft 365.GCC High · DoDGoogle WorkspaceInvestigate, deliver, report and read sign-in signals with one connection.Microsoft ExchangeExchange Web ServicesRun the same search and remove flow on Exchange Server.

Reporting

Employees report emails, SMS and calls from where they are. Reports enter the same analysis and response.

OutlookDesktop, web, new and mobileOne report button across the Outlook apps employees use.GCC High · DoDProofpointKeep Proofpoint’s report button. Incidents still land in Keepnet.SMS and Call ReporterKeepnet app for iOS and AndroidEmployees report suspicious SMS and calls from their phone.iOSAndroidReport by emailYour Keepnet reporting addressForward any email to your Keepnet address and it enters analysis and response.

Simulation delivery

Multi-channel phishing simulations, not email-only: email through DEC or your SMTP, SMS and voice from Keepnet numbers.

Direct Email Creation (DEC)Microsoft 365 and GmailCreate simulations straight in Microsoft 365 and Gmail mailboxes through their APIs.SMS deliveryKeepnet numbersSend SMS phishing simulations from Keepnet numbers, with nothing to register yourself.Voice deliveryKeepnet numbersRun voice phishing simulations from numbers Keepnet owns, not spoofed.SMTPYour mail serverSend simulations and training through your own mail server.Cloudflare DNSCreate and remove simulation domain records from your Cloudflare account.

Identity and access

Keep employees and groups in sync, and sign admins in with your identity provider.

SAML 2.0 SSOOkta, Entra ID, ADFS and moreAdmins sign in to Keepnet with your identity provider.SCIMOkta, Entra ID and moreEmployees and groups provisioned from your identity provider.LDAP / Active DirectoryMicrosoft and othersSync employees and groups from your directory.

Training and nudges

Reach employees in Teams and keep learning records in step with your LMS.

Microsoft TeamsTraining invites and nudges in the Teams activity feed.

Audit logs and SIEM

Stream Keepnet audit logs to the SIEM your SOC already runs.

SplunkStream Keepnet audit logs into Splunk.SyslogSend audit logs to your syslog receiver.

BI and AI tools

Report on and ask questions of the Keepnet metrics enabled for your company, in the BI and AI tools your teams already use.

Microsoft Power BIBuild your own Power BI reports on Keepnet metrics, queried live.DirectQueryClaudeAnthropicAsk Claude about your Keepnet metrics and get answers from live data.

API, webhooks and email

Build your own integration: use the API in both directions, receive events by webhook, or forward emails to your reporting address.

Keepnet APIREST APIPull Keepnet data into your tools, or push your data into Keepnet.WebhooksYour endpointSend Keepnet events to your own tools as they happen.

Data and trust

What Keepnet reads, and what it leaves alone

Permissions in plain sight

Each card lists the data the integration reads and the permissions it needs.

Your keys, your accounts

Threat engines run on your own API key and licence.

You choose what leaves

VirusTotal checks file hashes by default. Files go to a sandbox only if you connect one.

The evidence is published, not on request

ISO/IEC 27001 certification logo
Information security
ISO/IEC 27017 certification logo
Cloud security
ISO/IEC 27018 certification logo
Cloud privacy
ISO/IEC 42001 certification logo
AI management

Four current certifications, independently audited. Certificates and the full control set are published at doc.keepnetlabs.com/resources/compliance.

Data residency
Your data stays in the region you choose: the UK, EU, US, Canada, Türkiye or the UAE. New regions open on request.
Hosting and encryption
AES-256 at rest, TLS 1.2 or 1.3 in transit.
Data protection
EU and UK GDPR, DPA 2018. The DPA is published with the SCCs, the UK Addendum and the sub-processor list.

Beyond the list

Not on the list?

Keepnet API

Pull Keepnet data into your tools, or push your data into Keepnet.

View details

Webhooks

Send Keepnet events to your own endpoint as they happen.

View details

Report by email

Forward any email to your Keepnet address and it enters analysis and response.

View details

Request an integration

Tell us the tool. Requests decide what we build next. We use your email only to reply, as set out in our privacy policy.

Questions

The things buyers ask about integrations

The questions we hear most often.

The details of each integration show the Keepnet products it works with: Phishing Simulator, Security Awareness Training, Incident Responder, Phishing Reporter, the Secure Behaviour Dashboard and Agentic AI.

Keepnet builds and supports the integrations on this page, so there is no third-party connector to maintain.

Application permissions with admin consent. Before it runs, Keepnet checks API access, access to every account, email access, and rights to create and update categories and delete email.

In the region you choose: the UK, EU, US, Canada, Türkiye or the UAE. New regions open on request. The DPA, SCCs, UK Addendum and sub-processor list are published in the trust centre.

Yes. Mailbox investigation and the Outlook add-in support GCC High and DoD endpoints.

Yes. The API lets you pull Keepnet data into your tools or push your data into Keepnet. Webhooks send Keepnet events to your own endpoint, so you can connect products not listed here.

Yes, with the Keepnet SMS and Call Reporter app for iOS and Android. Reported SMS and calls go through the same analysis and response as reported emails, and count in the same reporting metrics.

Yes. Keepnet audit logs stream to Splunk or a syslog receiver. Keepnet also reads alerts from Microsoft Sentinel and Google SecOps as behaviour signals.

Book a demo

See Keepnet with your stack in mind

  1. See your tools connectedMicrosoft 365 or Google Workspace, your identity provider and your SIEM.
  2. Watch signals become behavioursHow Defender, Sentinel or Mimecast events shape what each employee gets next.
  3. Review data and permissionsWhat each integration reads, and where your data is stored.
Tom, Matt, Ellie and Shonna, the Keepnet team you will meet
Who you will actually meet
Tom, Matt, Ellie and Shonna
Across UK and US time zones

Book a 30-minute demo

Thirty minutes, no cost and no obligation.

Required
Required
Please use your work email address
Where your organisation is based.
Please pick a country from the list
Start with + for another country code.
Please enter a phone number we can call you on
Required
Employees
Please pick a size
Please pick one

Bring your setup and questions, and we will map Keepnet to your programme. No employee data needed.

Thank you, your request is in

A confirmation is on its way to your inbox.

While you wait