KnowBe4, a global leader in digital workforce security specializing in human and artificial intelligence agent protection, has announced that KnowBe4 Defend secured the top position across all three incremental detection metrics reported by Microsoft in its real-world email security benchmark. The evaluation assessed seven Integrated Cloud Email Security (ICES) solutions operating on live customer data within Microsoft Defender environments.
KnowBe4 Defend ranked first across every incremental detection metric evaluated in Microsoft's latest email security benchmark.
Defend caught 1.11% of malicious emails that missed Microsoft Defender, compared to an industry average of 0.30%—representing a 3.7x higher threat catch rate.
The platform recorded an overlap of just 0.65% with Microsoft Defender, marking the lowest overlap among all tested vendors.
Defend accounted for 16.92% of post-delivery malicious removals (active inbox clean-ups), more than double the industry average.
Beyond high-severity threats, Defend also led in spam uplift (1.88%) and promotional/graymail cleanup (65.24%).
As modern cyber adversaries increasingly rely on payload-free techniques—such as executive impersonation, Business Email Compromise (BEC), and AI-generated social engineering—traditional perimeter filtering and static signature checks frequently leave security gaps. Because these attacks lack malicious links or file attachments, stopping them requires advanced behavioral analysis.
KnowBe4 Defend addresses this challenge by analyzing contextual behaviors, communication patterns, and relationship signals rather than just raw payloads. The latest benchmark results underscore the value of an additive behavioral layer operating seamlessly on top of native cloud infrastructure.
"Today's attacks are built to look like normal business conversation," said Stuart Clark, senior vice president of product at KnowBe4. "Defend reads behavior and relationships, not just payloads, and Microsoft's own data shows how much that layer catches."
The benchmark data highlights three core performance advantages demonstrated by KnowBe4 Defend within live Microsoft 365 environments:
Superior Threat Uplift: Catching 3.7 times more dangerous emails that slipped past baseline defenses than the average add-on solution.
Minimal Redundancy: Recording a 0.65% overlap with Defender, proving that Defend targets evasive, net-new threats rather than generating duplicate alerts.
Effective Post-Delivery Cleanup: Removing nearly 17% of total post-delivery malicious threats to protect active user inboxes.
About KnowBe4
KnowBe4 empowers the whole workforce to make smarter security decisions every day. Trusted by more than 70,000 organizations worldwide, KnowBe4 is the pioneer of digital workforce security, securing both humans and AI agents. The KnowBe4 Platform provides attack simulation and training, email & collaboration security, and agent security powered by AIDA (Artificial Intelligence Defense Agents) and a proprietary Risk Score. The Platform leverages 16 years of behavioral data to combat advanced threats including social engineering, prompt injection, and shadow AI. By securing humans and agents, KnowBe4 leads the industry in workforce trust and defense.
