Reduce risky behaviour, with a score you can explain.
Keepnet turns signals from your security tools and its own simulations into named behaviours, then adapts training and nudges to each employee, measured before and after.
Listed in Gartner’s Representative List of Secure Behavior Management Vendors, September 2026.1
From signal to secure behaviour
1Signals inFrom the security tools you run.
2Named behaviourMapped to the controls it evidences.
3Where it sitsBy department, employee and host.
4Next stepExplained, with the training that fits.
5Before and afterPositive behaviour and reporting, over time.
From the consoleScreens from the Secure Behaviour Dashboard. Example data; names are fictional.
Security teams running Keepnet
More than 11 million employees have taken a Keepnet simulation or training.3
Why the market is moving beyond awareness training
In Gartner’s view, security awareness training is “antiquated and commoditized”, and CISOs should plan the move to secure behaviour management.1
- TriggerSecurity awareness training: Modules on a calendarSecure behaviour management: Training triggered by what each employee does
- ChannelsSecurity awareness training: Email phishing onlySecure behaviour management: Multi-channel phishing simulations, not email-only
- ContentSecurity awareness training: Same content for everyoneSecure behaviour management: Content matched to role, risk and language
- DataSecurity awareness training: Data from the training toolSecure behaviour management: Signals from the security stack you already run
- ProofSecurity awareness training: Completion ratesSecure behaviour management: Behaviour measured before and after
of organisations had a phishing, vishing or smishing incident in the past year.
of security leaders still track training completion as a top metric.
Why more training does not fix it
“Pre-scheduled, calendar-based training achieves compliance, but fails to alter employee behavior.”
Signal, behaviour, action, measure
Signals
Your security tools and Keepnet simulations show what employees do.
Behaviours
Each signal becomes a named behaviour, risky or positive.
Action
Training, nudges and simulations follow the behaviour.
Measure
The same employees, before and after.
Only signals that match a behaviour reach the record, so noise stays out of the score.
AI agents suggest the next step for each employee. Nothing goes out until you approve it.
Scores describe behaviours, not employees
Evidence-based, explainable and auditable: each behaviour shows its source, its severity and the controls it maps to.
One severity scale for each behaviour
Each behaviour carries a severity from a shared catalogue, the same for each customer, and is never assigned to one employee.
Mapped to named controls
Each behaviour shows the controls it helps you evidence, in MITRE ATT&CK, NIST CSF 2.0, CIS Controls and more.
Explained in plain language
An AI summary for each behaviour: where it sits, how it compares and the training that fits. Zero-PII.
Positive behaviour counts
Reports, completed training and voluntary learning show up as good behaviour. Thanks first, not blame.
A published behaviour catalogue
259 behaviours mapped to 11 frameworks, from CIS Controls to the Insider Threat Matrix.
What changes after the first simulation
An employee's first simulated phishing email is the one they are most likely to click: 9.2%, falling to 4.8% across every simulation that follows. The template difficulty mix stayed flat between the first and the twelfth.
The median organisation's click rate on a simulated phishing email fell from 3.4% on its employees' first simulation to 1.4% by their twelfth.
The drop held in every cohort size tested, between 31% and 50%. Your own starting rate depends on template difficulty; the drop is what carries across.
Board report, manager report and the employee view are on the reporting page.
Each product feeds the behaviour record
Open any product for the detail.
Multi-channel phishing simulations
See which employees click and which report, across the channels attackers use, not email-only.
Example dataPhishing simulatorVishing simulatorSmishing simulatorQuishing simulatorCallback phishing simulator
Security awareness training
Training and nudges by email, SMS or Teams, matched to what each employee did.
Example dataReporting
A board report you build once, each manager’s team, and the employee view, from the same data.
Example dataPhishing reporting and response
Reported emails, SMS and calls analysed in one queue, with a verdict for each employee who reports.
Example dataNew Keepnet SMS and Call Reporter for iPhone and Android: employees report a suspicious SMS or call and get a verdict. Free, no Keepnet account needed. App Store · Google Play
Integrations
Your security tools become behaviour data
Alerts and logs from your stack become named behaviours in each employee record.
See all integrations
Microsoft Defender
Entra ID Protection
Microsoft Sentinel
Google SecOps
Google Workspace
Zscaler
Splunk
Microsoft TeamsKeepnet API
Behaviour data in the tools you already run
Pull behaviour and campaign data into your BI, warehouse or AI assistant.
See the Keepnet API"It would be unfair to single out just one feature. The mail scenarios and customisable training modules are particularly excellent."
"It's a really great platform with a lot of flexibility to ensure our requirements are met. Onboarding was friendly, enjoyable, and thorough."
"It's super easy and intuitive to setup campaigns, whilst making it easier for end-users to report phishing emails."
"The product itself works great on day one and delivers immediate value as our team was able to get started with our phishing exercise program immediately."
"It has been consistent, reliable, and implementations over time shows that they really listen customer feedback."
"We've seen a noticeable improvement in how employees react to suspicious emails or phone calls- because they remember the stories."
"Within minutes, we can create realistic, scenario-based templates specific to our organization, reducing setup time while increasing the relevance of training."
"The simulations and campaigns are very customisable and realistic."
"Thanks to Keepnet's Incident Response tool, we reduced the e-mail analysis and response time, which used to take hours, to 2 minutes."
Keepnet Labs has a rating of 4.9 out of 5 based on 104 ratings in the Security Awareness Computer-Based Training market on Gartner Peer Insights as of October 2026. GARTNER is a registered trademark and service mark, and PEER INSIGHTS is a trademark and service mark, of Gartner, Inc. and/or its affiliates, and are used herein with permission. All rights reserved. Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates.
Pricing
Add it to the plan you run
The Secure Behaviour Dashboard is added to any Keepnet plan. Each product can still be bought on its own.
See pricing- Pay only for what you runStart with one product and add the rest later.
- Add to what you runVoice, SMS, QR code and deepfake simulations next to your current provider.
- Switch without paying twiceKeepnet covers the overlap with your current contract.
- Try before you commitTry and buy, or a proof of value with your own employees.
Ready for your security review
Four current certifications, independently audited. Certificates and the full control set are published at doc.keepnetlabs.com/resources/compliance.
Questions buyers ask
Secure behaviour management changes how employees act on phishing, SMS, calls and deepfakes, and measures that change before and after. Gartner uses the term for the market long known as security awareness training; some buyers call it human risk management.
Keepnet turns signals from your security tools and its own simulations into named behaviours, then adapts training, nudges and simulations to each employee. Read the full explanation.
From the behaviours themselves. Each behaviour in the catalogue carries a severity, the same for each customer, and the dashboard shows where the organisation, each department and each host sits against those bands.
Each behaviour behind the score can be opened: its source, its events and the controls it maps to. Severity describes a behaviour, never an employee.
Microsoft Defender, Microsoft Entra ID Protection, Microsoft Sentinel, Google SecOps, Google Workspace audit logs, Mimecast, Zscaler Internet Access and Cornerstone OnDemand, alongside Keepnet's own simulations, training and phishing reports. See all integrations.
No. Only signals that match a behaviour in the catalogue reach the employee record. Events that do not indicate a behaviour are left out, so noise stays out of the score.
259 behaviours are mapped to 11 frameworks: CIS Controls v8.1, ISF Benchmark, ISF Human-Centred Security, ISF IRAM2, ISF SOGP 2024, NIST CSF 2.0, SebDB, FAIR (Open Group), MITRE ATT&CK, the Insider Threat Matrix and NIST SP 800-30. Each behaviour shows the controls it helps you evidence.
Yes. Multi-channel phishing simulations, not email-only, the training library and compliance courses stay. Behaviour decides who gets which, and when.
No. AI agents suggest the next step for each employee, and nothing goes out until you approve it. Autonomous mode is off by default and only a system admin can turn it on.
AI summaries are Zero-PII, Keepnet holds ISO/IEC 42001, and customer data never trains models. How the AI agents work.
Yes. It is added to any Keepnet plan, and each product can still be bought on its own. See pricing.
Test it live on your own tools
- See what your tools can measureThe behaviours your connected sources produce.
- Follow one behaviour end to endFrom the signal to the score to the next step.
- Plan a proof of valueOn your own tools, if it fits.
Book a 30-minute demo
Thirty minutes, no cost and no obligation.
Thank you, your request is in
A confirmation is on its way to your inbox.
Thirty minutes with the Keepnet team, on Microsoft Teams. Your details are already filled in.
Prefer to pick a time later? The team will follow up within one working day.
Your demo is booked
A calendar invite is on its way to your inbox, with a Microsoft Teams link.
The booking calendar will not open in this page.
Open the calendar in a new tabSources
- Gartner, Ditch Security Awareness and Adopt AI-Powered Secure Behavior Management, William Candrick, Alex Michaels, 22 September 2026 (G00860839), 2026 Gartner CISO Role Survey (n=297). Keepnet is listed in Table 1, Representative List of Secure Behavior Management Vendors. Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner's business and technology insights organization and should not be construed as statements of fact. GARTNER is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.
- Keepnet anonymised customer research, email phishing simulations delivered 1 January 2020 to 29 September 2026. Per employee: employees who received at least 12 simulations (n=102,452 employees across 158 organisations). Per organisation: median of the same 158 organisations. Benchmark: all ten cohort sizes tested, the largest 498,861 employees.
- Keepnet platform data, cumulative to October 2026: unique employees who have received at least one Keepnet phishing simulation or training module.
- Gartner, Fight AI Disinformation: A CISO Playbook for Working with Your CIO, CCO and CMO, Akif Khan, 23 October 2025 (G00840501).
- Gartner, “6 Ways to Transform Your Cybersecurity Awareness Program” (G00840741, March 2026), 2025 Secure Behavior Strategies Survey (n=65).