Financial Services · Managed platform (KnowBe4)

Security Awareness Training

Phishing simulations and security training built around financial fraud, run on KnowBe4 by Moraph

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs KnowBe4 as a managed service for banks, credit unions, broker-dealers and other financial firms. We plan simulated phishing campaigns around the fraud your staff actually see, such as fake wire transfer requests, payment change requests and executive impersonation, and assign training to the people who need it. Your security and compliance leads approve the program, and you get the evidence examiners and cyber insurers ask about.

The problem it solves

Financial institutions are required to train staff on information security, and the people most often targeted by fraud are the ones who move money: wire rooms, tellers, payment operations and executive assistants. Many training programs run generic annual courses and occasional off-the-shelf phishing tests that look nothing like a business email compromise aimed at a bank. The platform is bought, but nobody has time to plan campaigns, follow up with repeat clickers or turn results into evidence for examiners, auditors and insurance applications.

  • Simulations are generic and do not reflect the payment fraud staff actually face
  • Training is a once-a-year course rather than a response to what people do
  • Nobody owns the program day to day, so campaigns lapse
  • Evidence for examiners, auditors and cyber insurance applications is assembled by hand

Who uses it

  • Chief information security officers and information security officers at banks, credit unions and financial firms
  • Compliance and risk leaders who answer for training under GLBA and state cybersecurity rules
  • Operations leaders responsible for wire, ACH and payment teams
  • HR and learning teams who manage required training
  • Internal audit and examiners, who need evidence that training and testing happen

Requirements it supports

Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 App. B, Part 364 App. B)NCUA Security Program rules (12 CFR Part 748)NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including cybersecurity awareness trainingSEC Regulation S-P (17 CFR Part 248)FFIEC IT Examination Handbook, Information Security booklet

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

KnowBe4 provides and operates the training platform and content, Moraph runs your program on it, and your institution sets policy and owns the results.

AreaMoraphKnowBe4Your organization
LicensingResells KnowBe4 subscriptions and keeps seat counts aligned with your staffSets license terms and subscription levelsAgrees the users and subscription level and pays under the order
Platform availabilityMonitors campaign delivery and raises platform issues with KnowBe4Operates the platform under its own service commitmentsTells Moraph about business impact
Program designProposes the annual program, groups and scenariosProvides templates and training contentApproves the program and every campaign
Campaign operationsBuilds, tests, launches and closes campaignsSends simulations and records resultsKeeps mail delivery allow-listing in place
TrainingAssigns courses and follows up on overdue trainingDelivers courses and records completionsRequires staff to complete training and acts on overdue items
Identity and accessConfigures directory sync and platform rolesProvides sync and access featuresMaintains the directory and approves who sees results
Use of resultsReports results to the people your policy namesStores results under its termsSets and applies the policy for follow-up and consequences
Content and updatesReviews new KnowBe4 content and features and recommends changesReleases content and platform updatesDecides whether to adopt them
Real phishing reportsConfigures the reporting button routingProvides the reporting buttonInvestigates real phishing, directly or through a security operations provider
Regulatory obligationsProvides program evidenceProvides platform attestations under its termsRemains responsible for its training obligations

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of KnowBe4 itself, which belongs to its vendor.

  1. Step 1

    Onboarding tracker

    During onboarding, each part of the setup moves to done with a named owner, before the first campaign is approved.

    TaskOwnerStatus
    Single sign-on for administratorsClient IT with MoraphDone
    Directory sync and groupsMoraphDone
    Mail allow-listing and test sendClient ITDone
    Phish Alert Button deployedClient ITIn progress
    Results policy approvedProgram ownerDone
    Baseline campaign approvedProgram ownerWaiting
    During onboarding, each part of the setup moves to done with a named owner, before the first campaign is approved.

  2. Step 2

    Approving a campaign

    Every campaign goes to your program owner with its scenario, audience and timing before it is launched.

    Campaign CM-0412 · Urgent wire request from executive

    Scenario
    Executive asks for an urgent wire to a new beneficiary
    Audience
    Wire operations and executive assistants (48 users)
    Window
    Fictional sample week, staggered sends
    Landing page
    Training page on call-back verification
    Remedial training
    Business email compromise, short module
    Help desk briefed
    Yes

    Checks before launch

    • Test send delivered to inbox
    • No overlap with quarter-end processing
    • Executive named in scenario has agreed
    Every campaign goes to your program owner with its scenario, audience and timing before it is launched.

  3. Step 3

    Campaign results

    Each campaign closes with results by group, including how many people reported it, not only how many clicked.

    GroupDeliveredClickedEntered dataReportedFollow-up
    Wire operations222015Remedial training assigned
    Executive assistants14416Manager review
    Treasury management12109Remedial training assigned
    Each campaign closes with results by group, including how many people reported it, not only how many clicked.

  4. Step 4

    Following up overdue training

    Moraph tracks overdue training and sends it to the managers you name, so required courses are finished.

    DepartmentManagerCourseOverdueAction
    Branch network, region 2Manager A (fictional)Annual security awareness11Reminder sent
    Commercial lendingManager B (fictional)Annual security awareness4Reminder sent
    Payment operationsManager C (fictional)Business email compromise7Escalated to program owner
    Moraph tracks overdue training and sends it to the managers you name, so required courses are finished.

  5. Step 5

    Handling a reporting button issue

    When something breaks, the change or fix is tracked from report to confirmation.

    Request SR-1188 · Reports from branch staff not reaching security mailbox

    1. Issue reported by help deskClient IT
    2. Routing rule checked in KnowBe4 and mail systemMoraph service engineer
    3. Cause: mail rule change blocked forwarded reportsClient IT with Moraph
    4. Mail rule correctedClient IT
    5. Test report confirmed in security mailboxMoraph service engineer
    6. Closed and noted in monthly reviewMoraph service manager
    When something breaks, the change or fix is tracked from report to confirmation.

  6. Step 6

    Monthly program review

    Each month, Moraph and your program owner review results, training, issues and the decisions needed.

    AreaThis monthStatusDecision needed
    Campaigns2 run, 1 plannedOn planApprove next scenario
    Reporting rateUp on last quarter in wire operationsGoodNone
    Training22 overdue across 3 departmentsWatchEscalate payment operations
    Repeat failures5 staffFollow-upConfirm manager review
    KnowBe4 noticesNew template set releasedInformationalReview for next quarter
    Each month, Moraph and your program owner review results, training, issues and the decisions needed.

Workflows

The principal workflows

  1. Plan

    Moraph and your security lead agree an annual program: which groups are tested, which fraud scenarios are used, what training follows, and how results are reported.

    • Staff grouped by role and exposure, such as wire operations, branches and executives
    • Fraud scenarios chosen from KnowBe4 templates and adapted to your institution
    • Training modules selected for each group
    • Calendar of campaigns and courses approved by your security lead
    • Sensitive dates, such as quarter-end or system changes, avoided

  2. Simulate

    KnowBe4 sends simulated phishing emails on the agreed schedule. Moraph builds and checks each campaign, makes sure it reaches inboxes, and tells your help desk what is coming.

    • Campaign built from the approved scenario and landing page
    • Email delivery allow-listing confirmed with your IT team
    • Help desk and approvers told the campaign window
    • KnowBe4 sends the emails and records opens, clicks, data entry and reports
    • Moraph watches for delivery problems during the campaign

  3. Train

    KnowBe4 assigns training to everyone on schedule and to people who fail a simulation. Moraph follows up on overdue training and reports completions to the people you name.

    • Required courses enrolled for each group
    • Remedial training assigned automatically after a failed simulation
    • Reminders sent through KnowBe4
    • Overdue lists sent to managers you nominate
    • Completions recorded for audit

  4. Report and improve

    Each campaign ends with a results summary and recommendations. Moraph brings trends, repeat clickers and reporting rates to a monthly review, and adjusts the plan with your approval.

    • Campaign results summarized by group
    • Reporting rate through the Phish Alert Button tracked alongside clicks
    • Repeat failures listed for manager follow-up under your policy
    • Program adjustments proposed and approved
    • Evidence packs prepared for audit, exams and insurance applications

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Security program owner

Chief information security officer, information security officer, IT risk manager

Owns the awareness program, approves what is tested and taught, and reports on it to management and the board.

Sees

  • All campaign results, training completions and trends
  • Individual results, under your institution's policy
  • The program calendar and change history
  • Monthly reviews from Moraph

Does

  • Approves the annual program and each campaign's scenario
  • Sets the policy for repeat failures and manager follow-up
  • Decides which staff groups are exempt from or added to campaigns
  • Approves changes Moraph proposes after reviews
  • Presents program results to management, the board and examiners

Cannot

  • Use simulation results for discipline outside the policy your institution has approved
  • Edit recorded results
Approvals
Approves campaigns, scenario choices and program changes. Scenarios naming executives or partners also need the approval your policy requires.
Notified about
Campaigns about to launch, campaign results, overdue training beyond your threshold and the monthly program review.

People manager

Branch manager, operations manager, department head

Makes sure their team completes training and follows up with people who need extra help.

Sees

  • Training status for their own team
  • Simulation results for their team, where your policy allows
  • Repeat failure lists for their team

Does

  • Follows up on overdue training
  • Discusses repeat failures with staff under your policy
  • Suggests scenarios based on fraud attempts their team has seen

Cannot

  • See other teams' results
  • Exempt staff from training or campaigns
Approvals
Exemption requests go to the security program owner.
Notified about
Overdue training and repeat failures in their team.

Staff member

All employees and contractors in scope

Learns to spot and report fraud attempts, and completes required training.

Sees

  • Their own assigned training and due dates
  • Feedback pages after a simulation
  • Their own completion history

Does

  • Completes required and remedial training
  • Reports suspicious email with the Phish Alert Button
  • Acknowledges security policies where the program includes them

Cannot

  • See anyone else's results
  • Opt out of required training
Approvals
None.
Notified about
Training assigned and due, and reminders from KnowBe4.

Client IT administrator

Email administrator, identity administrator, help desk lead

Keeps the technical pieces working: delivery of simulations, the reporting button, and the directory feed.

Sees

  • Campaign schedules and sending details
  • Directory sync status
  • Where reported email is routed

Does

  • Maintains mail allow-listing for simulations
  • Deploys and maintains the Phish Alert Button
  • Maintains directory synchronization and single sign-on
  • Routes real reported phishing to your security team

Cannot

  • Change scenarios, groups or training assignments
  • See individual simulation results unless granted
Approvals
Technical changes follow your own change process.
Notified about
Upcoming campaigns, delivery problems and directory sync failures.

Moraph service team

Moraph awareness program specialists, service desk analysts and the named service manager

Runs the program day to day on KnowBe4 and reports on it.

Sees

  • Campaign results, training status and directory data in KnowBe4
  • Platform notices from KnowBe4
  • The approved program and policies

Does

  • Builds, tests, launches and closes campaigns
  • Adapts scenario templates to your institution
  • Assigns training and follows up on overdue items
  • Prepares campaign summaries and monthly reviews
  • Raises platform issues with KnowBe4 support
  • Assembles evidence packs on request

Cannot

  • Launch a campaign that has not been approved
  • Use real logos of your partners or vendors without your approval
  • Share individual results outside the people your policy names
Approvals
Every campaign and program change they make is approved by your security program owner first.
Notified about
Delivery failures, directory sync errors and new service requests.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Checks that training and testing happen as the institution's program says.

Sees

  • Training completion and campaign summaries
  • The approved program and its change history
  • Evidence packs within the scope granted

Does

  • Reviews evidence and reports
  • Requests additional detail through the program owner

Cannot

  • Change or delete anything
  • Keep access after it expires
Approvals
Their access is approved by the security program owner, with a scope and an end date.
Notified about
Nothing by default.

Permissions at a glance

ActionProgram ownerManagerStaffClient ITMoraph teamAuditor
Approve the annual programApprovesNo accessNo accessNo accessView onlyView only
Build and launch campaignsApprovesNo accessNo accessView onlyFullNo access
View all campaign resultsFullNo accessNo accessNo accessFullView only
View team resultsFullOwn work onlyNo accessNo accessFullNo access
Complete assigned trainingOwn work onlyOwn work onlyOwn work onlyOwn work onlyNo accessNo access
Assign training and groupsApprovesNo accessNo accessNo accessFullNo access
Approve exemptionsApprovesNo accessNo accessNo accessView onlyView only
Maintain mail delivery and reporting buttonView onlyNo accessNo accessFullView onlyNo access
Maintain directory syncView onlyNo accessNo accessFullView onlyNo access
Prepare evidence packsFullNo accessNo accessNo accessFullView only
Manage platform users and rolesApprovesNo accessNo accessView onlyFullNo access
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Individual results are sensitive. Who can see them, and how they may be used, follows a policy your institution approves before the first campaign; Moraph configures KnowBe4 to match it.
  • Moraph launches a campaign only after your program owner approves the scenario, audience and timing, and each approval is recorded.
  • Groups follow your identity provider, so access and enrollment change as people join, move and leave. Administrators and Moraph staff sign in with single sign-on and multi-factor authentication.
  • Auditors, examiners and insurers' assessors can be given read-only evidence for a defined scope and period rather than platform accounts.

Features

What it does

Financial fraud scenarios

Simulations built around wire transfer requests, vendor payment changes, executive impersonation, account takeover and fake regulator or core-vendor notices, adapted from KnowBe4's template library.

Role-based groups

Staff grouped by exposure, so wire operations, tellers, lenders and executive assistants get scenarios and training suited to their work.

Managed campaign calendar

Moraph plans, builds, launches and closes each campaign on the calendar you approve, so the program does not lapse.

Delivery checks

Allow-listing and test sends confirmed with your IT team before each campaign, so results reflect people and not mail filtering.

Remedial training

KnowBe4 assigns short training to anyone who clicks or enters data in a simulation, and Moraph follows up on what stays incomplete.

Phish Alert Button

KnowBe4's reporting button in Outlook or Gmail lets staff report suspicious email; Moraph configures where real reports are sent.

Required course tracking

Annual security awareness, privacy and fraud courses assigned and tracked, with overdue lists to managers.

Repeat clicker follow-up

People who fail repeatedly are listed for their managers and given additional training under the policy you set.

Executive and board sessions

Targeted content and simulations for senior staff, who are frequent targets of impersonation, scheduled with care for their calendars.

Program evidence

Training completions, campaign results and program changes assembled for examiners, internal audit and cyber insurance questionnaires.

Directory synchronization

Users and groups kept in step with your identity provider, so new staff are enrolled and leavers removed.

Monthly program review

Trends, issues and recommendations reviewed with your security lead each month, with decisions recorded.

Integrations

How it connects to your systems

Connects toHowWhat flows
Email platformMicrosoft 365 or Google Workspace allow-listing so simulations are delivered, configured with your mail team.Out: simulated phishing emails to enrolled users.
Phish Alert ButtonKnowBe4's add-in for Outlook and Gmail, with real reports routed to your security team or security operations provider.In: reported messages. Out: forwarded reports to your security mailbox.
Identity providerUser and group synchronization and single sign-on through Microsoft Entra ID, Okta or another supported provider.In: users, groups, managers and employment status.
HR or learning systemTraining completions can be exported to your learning management or HR system where it keeps the record of required training.Out: course completions by user.
Security operationsReal phishing reported by staff passed to your security team, or to Moraph's Endpoint Detection & Response service if you use it.Out: reported messages for investigation.
Moraph service reportingCampaign plans, approvals and reviews tracked in Moraph's service tooling and shared each month.Out: program calendar, approvals and summaries.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Administrators sign in through identity providers with multi-factor authentication, and access is removed when people leave.

Role-based access

Staff see their own training, managers see their teams, and individual results are limited to the people your policy names.

Minimal personal data

Only the directory attributes needed for enrollment and grouping are synchronized; no customer data is used in simulations.

Controlled privileged access

Moraph staff use administrative access only for approved work, with credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. KnowBe4's own platform assurance reports are available from KnowBe4 under its terms.

Audit trail

Campaign approvals, launches and program changes are recorded with who did what and when.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Campaigns

Campaign results

For security program owner

For each campaign: emails delivered, opened, clicked, data entered and reported, by group.

Break down by
Group, Scenario, Department, Location
Delivered as
PDF summary after each campaign; live view in KnowBe4
Used for
Seeing which scenarios and groups need attention.

Reporting rate

For security program owner and security operations

How many staff reported simulated phishing with the Phish Alert Button, and how quickly, compared with how many clicked.

Break down by
Group, Campaign, Period
Delivered as
Monthly review; PDF
Used for
Measuring whether staff act as an early warning, not just whether they avoid clicking.

Repeat failures

For security program owner and named managers

Staff who failed more than one simulation in the period you set, with their remedial training status.

Break down by
Department, Manager, Scenario type
Delivered as
Monthly, to the people your policy names
Used for
Targeted follow-up under your approved policy.

Training

Training completion

For security program owner, HR and managers

Required and remedial training assigned, completed and overdue.

Break down by
Course, Department, Manager, Due date
Delivered as
Weekly overdue email to managers; monthly PDF
Used for
Getting everyone through required training on time.

New joiner enrollment

For security program owner and HR

New staff enrolled from the directory, their assigned courses and completion status.

Break down by
Start month, Department, Course
Delivered as
Monthly CSV
Used for
Confirming that new staff are trained soon after joining.

Program oversight

Program trend

For management and the board

Click, data-entry and reporting rates and training completion over time, with the scenarios used.

Break down by
Period, Group, Scenario type
Delivered as
Quarterly PDF for committee packs
Used for
Board oversight of the information security program.

Monthly program review

For security program owner and Moraph service manager

Campaigns run, results, training status, issues, KnowBe4 notices and decisions needed.

Break down by
Area, Status, Owner
Delivered as
PDF and review meeting
Used for
Keeping the program on plan and recording decisions.

Audit and assurance

Program evidence pack

For internal audit, examiners and cyber insurers

The approved program, campaigns run, training completions and changes for the period requested.

Break down by
Period, Program element, Group
Delivered as
PDF on request
Used for
Answering exam requests and insurance questionnaires about training and testing.

Approval log

For security program owner and internal audit

Every campaign and program change, who approved it and when it ran.

Break down by
Campaign, Approver, Date
Delivered as
Live view; CSV export
Used for
Showing that simulations were authorized.

Directory coverage

For security program owner and client IT

Users in the directory compared with users enrolled, and anyone missing or exempt.

Break down by
Department, Status, Exemption reason
Delivered as
Monthly CSV
Used for
Confirming that everyone in scope is in the program.

Exports, access and evidence

  • Results and completions come from KnowBe4; plans, approvals and reviews come from Moraph's service tooling. The monthly review brings them together.
  • Reports with individual results go only to the people your policy names. Board and management reports use group-level figures.
  • Every report can be exported to CSV, and summary and evidence reports to PDF.
  • Evidence packs are scoped to the period and questions asked, whether by an examiner, internal audit or an insurer's questionnaire.
  • The reports KnowBe4 itself provides remain available to your authorized administrators.

Deployment

Where and how it runs

KnowBe4 cloud, managed by Moraph

KnowBe4 hosts the platform; Moraph runs your program on it under a managed service agreement.

Moraph-managed with your existing KnowBe4 subscription

If you already subscribe to KnowBe4, Moraph can take over running the program, subject to KnowBe4's terms.

Alongside other Moraph services

Run with Moraph's Endpoint Detection & Response or Identity Access Management services, so reported phishing and risky users are handled together.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Program design

We agree goals, groups, scenarios, training and the results policy with your security, compliance and HR leads.

Platform setup

KnowBe4 is configured with single sign-on, directory synchronization, groups and administrator roles.

Mail and reporting button

Allow-listing is set up with your mail team, the Phish Alert Button is deployed, and real reports are routed to your security team.

Baseline campaign

A first simulation, approved by your program owner, establishes where each group starts.

Communication to staff

We help you announce the program, explain how to report suspicious email, and brief the help desk.

Handover to service

The calendar for the year is approved, and the program moves to monthly reviews with Moraph's service manager.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not KnowBe4. The platform and content belong to KnowBe4, and KnowBe4's own service commitments, roadmap, maintenance and outages apply.
  • Subscriptions are subject to KnowBe4's terms, and the content and features available depend on your subscription level.
  • Training and simulations reduce the chance that staff fall for fraud; they do not prevent it. Payment controls such as call-back verification remain essential.
  • Moraph cannot promise any effect on cyber insurance premiums or coverage. That is your insurer's decision; the service provides evidence of your program.
  • Real phishing reported by staff is routed to your security team. Investigating it is not part of this service unless you also use a Moraph security operations service.
  • Decisions about consequences for repeat failures belong to your institution and its HR policies.
  • Simulations depend on mail delivery. If allow-listing is changed without notice, results may not reflect staff behavior.
  • Training content is KnowBe4's; custom courses written for your institution are scoped separately.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Ask to see sample scenarios built around wire, ACH and payment-change fraud
  2. Review the results policy and decide who should see individual results
  3. Walk through the approval step for a campaign that names an executive
  4. Check how real phishing reports will be routed and who investigates them
  5. Review a sample evidence pack against your last exam request or insurance questionnaire
  6. Walk through the responsibilities table with your security, HR and IT leads

Questions

Frequently asked questions

Will this lower our cyber insurance premium?

We cannot promise that; premiums are your insurer's decision. Many insurers ask about phishing testing and training in their applications, and the service gives you the evidence to answer.

Do you write simulations about our own vendors and executives?

Only with your approval. Scenarios that name an executive, partner or vendor are approved by your program owner, and by the person named where your policy requires it.

Who sees individual results?

The people your results policy names, agreed before the first campaign. Board and management reporting uses group-level figures.

We already subscribe to KnowBe4. Can Moraph run it?

Usually, subject to KnowBe4's terms. We start by reviewing your current setup and results and agree a program.

What happens to real phishing that staff report?

The Phish Alert Button routes it to your security team or security operations provider. Moraph configures the routing; investigating real phishing is a separate service.

How is it priced?

KnowBe4 subscriptions are priced under KnowBe4's terms, usually per user and subscription level, and Moraph's managed service is priced separately. See Working with Moraph for what drives a quotation.

Next steps

Evaluate Security Awareness Training

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Security Awareness Training guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Security Awareness Training support guide.

Related products