Security Awareness Training

Principal workflows

• Plan: Moraph and your security lead agree an annual program: which groups are tested, which fraud scenarios are used, what training follows, and how results are reported.
• Simulate: KnowBe4 sends simulated phishing emails on the agreed schedule. Moraph builds and checks each campaign, makes sure it reaches inboxes, and tells your help desk what is coming.
• Train: KnowBe4 assigns training to everyone on schedule and to people who fail a simulation. Moraph follows up on overdue training and reports completions to the people you name.
• Report and improve: Each campaign ends with a results summary and recommendations. Moraph brings trends, repeat clickers and reporting rates to a monthly review, and adjusts the plan with your approval.

Who uses it

• Chief information security officers and information security officers at banks, credit unions and financial firms
• Compliance and risk leaders who answer for training under GLBA and state cybersecurity rules
• Operations leaders responsible for wire, ACH and payment teams
• HR and learning teams who manage required training
• Internal audit and examiners, who need evidence that training and testing happen

Reporting

• Campaign results by group and scenario
• Phish Alert Button reporting rates
• Required and remedial training completion
• Repeat failures for manager follow-up
• Program trends for board reporting
• Evidence packs for exams, audits and insurance questionnaires

Features

• Financial fraud scenarios: Simulations built around wire transfer requests, vendor payment changes, executive impersonation, account takeover and fake regulator or core-vendor notices, adapted from KnowBe4's template library.
• Role-based groups: Staff grouped by exposure, so wire operations, tellers, lenders and executive assistants get scenarios and training suited to their work.
• Managed campaign calendar: Moraph plans, builds, launches and closes each campaign on the calendar you approve, so the program does not lapse.
• Delivery checks: Allow-listing and test sends confirmed with your IT team before each campaign, so results reflect people and not mail filtering.
• Remedial training: KnowBe4 assigns short training to anyone who clicks or enters data in a simulation, and Moraph follows up on what stays incomplete.
• Phish Alert Button: KnowBe4's reporting button in Outlook or Gmail lets staff report suspicious email; Moraph configures where real reports are sent.
• Required course tracking: Annual security awareness, privacy and fraud courses assigned and tracked, with overdue lists to managers.
• Repeat clicker follow-up: People who fail repeatedly are listed for their managers and given additional training under the policy you set.
• Executive and board sessions: Targeted content and simulations for senior staff, who are frequent targets of impersonation, scheduled with care for their calendars.
• Program evidence: Training completions, campaign results and program changes assembled for examiners, internal audit and cyber insurance questionnaires.
• Directory synchronization: Users and groups kept in step with your identity provider, so new staff are enrolled and leavers removed.
• Monthly program review: Trends, issues and recommendations reviewed with your security lead each month, with decisions recorded.

Integrations

• Email platform: Microsoft 365 or Google Workspace allow-listing so simulations are delivered, configured with your mail team.
• Phish Alert Button: KnowBe4's add-in for Outlook and Gmail, with real reports routed to your security team or security operations provider.
• Identity provider: User and group synchronization and single sign-on through Microsoft Entra ID, Okta or another supported provider.
• HR or learning system: Training completions can be exported to your learning management or HR system where it keeps the record of required training.
• Security operations: Real phishing reported by staff passed to your security team, or to Moraph's Endpoint Detection & Response service if you use it.
• Moraph service reporting: Campaign plans, approvals and reviews tracked in Moraph's service tooling and shared each month.

Deployment

• KnowBe4 cloud, managed by Moraph: KnowBe4 hosts the platform; Moraph runs your program on it under a managed service agreement.
• Moraph-managed with your existing KnowBe4 subscription: If you already subscribe to KnowBe4, Moraph can take over running the program, subject to KnowBe4's terms.
• Alongside other Moraph services: Run with Moraph's Endpoint Detection & Response or Identity Access Management services, so reported phishing and risky users are handled together.

Security and privacy

• Single sign-on: Administrators sign in through identity providers with multi-factor authentication, and access is removed when people leave.
• Role-based access: Staff see their own training, managers see their teams, and individual results are limited to the people your policy names.
• Minimal personal data: Only the directory attributes needed for enrollment and grouping are synchronized; no customer data is used in simulations.
• Controlled privileged access: Moraph staff use administrative access only for approved work, with credentials they cannot use without explicit, time-bound authorization.
• Independent audits: Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. KnowBe4's own platform assurance reports are available from KnowBe4 under its terms.
• Audit trail: Campaign approvals, launches and program changes are recorded with who did what and when.

Limitations

• Moraph is not KnowBe4. The platform and content belong to KnowBe4, and KnowBe4's own service commitments, roadmap, maintenance and outages apply.
• Subscriptions are subject to KnowBe4's terms, and the content and features available depend on your subscription level.
• Training and simulations reduce the chance that staff fall for fraud; they do not prevent it. Payment controls such as call-back verification remain essential.
• Moraph cannot promise any effect on cyber insurance premiums or coverage. That is your insurer's decision; the service provides evidence of your program.
• Real phishing reported by staff is routed to your security team. Investigating it is not part of this service unless you also use a Moraph security operations service.
• Decisions about consequences for repeat failures belong to your institution and its HR policies.
• Simulations depend on mail delivery. If allow-listing is changed without notice, results may not reflect staff behavior.
• Training content is KnowBe4's; custom courses written for your institution are scoped separately.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/security-awareness-training. Purchasing routes and company information: www.moraph.com/how-to-buy.