Recommended Free Tools
KnowBe4 completed its acquisition of Egress on July 9, 2024. The deal was announced on April 24, 2024, with financial terms undisclosed. Egress technology is now represented mainly by KnowBe4’s Defend, Prevent and Protect cloud-email-security products, although some contracts and support documents still use the Egress name. For customers and buyers, the important question is not whether the acquisition happened, but how the combined products, contracts and deployment options fit their environment.
What happened, and when?
| Date | Event |
|---|---|
| April 24, 2024 | KnowBe4 announced a definitive agreement to acquire Egress. The announcement said closing depended on customary conditions and regulatory approvals, and did not disclose transaction terms. KnowBe4 announcement |
| July 9, 2024 | KnowBe4 announced that the acquisition had closed after the stated conditions and approvals were completed. It said Egress products and operations would be integrated over the following months. Completion announcement |
| August 16, 2026 status | Egress-derived capabilities are marketed primarily as KnowBe4 Defend, Prevent and Protect. Egress-branded legal, subscription and end-of-support documents remain available. |
The purchase price, deal structure, Egress revenue, valuation, employee transfers, synergy targets and detailed integration milestones were not publicly disclosed. KnowBe4’s earlier 2022 transaction with Vista Equity Partners was a separate event and does not establish the value of this acquisition.
As an Amazon Associate I earn from qualifying purchases.
Why KnowBe4 bought Egress
KnowBe4’s established business centers on security-awareness training, phishing simulations, user-risk scoring and behavior change. Egress brought adaptive cloud email security, phishing and impersonation detection, outbound data-loss controls, encryption and human-risk visibility. The companies said they had already been integration partners for more than a year. The acquisition rationale was to connect technical email controls with user education.
The intended feedback loop is straightforward:
- Detect a real phishing, impersonation or data-loss event.
- Identify the affected user and attack pattern.
- Present an in-context warning or coaching message.
- Use the event to tailor training, simulations and risk analytics.
- Adjust policies as observed behavior changes.
That is the companies’ strategic thesis, not independent evidence of financial or security performance. A unified supplier can reduce administrative work, but it also concentrates several controls with one vendor.
What technology came with Egress?
KnowBe4 Defend: inbound email protection
Defend is positioned to detect phishing, business-email compromise, ransomware, impersonation, malicious links and suspicious attachments. KnowBe4 lists sender analysis, link rewriting, QR-code detection, contextual banners, graymail classification, analytics and Microsoft 365 integration. Defend product page
KnowBe4 Prevent: outbound protection and DLP-style intervention
Prevent focuses on misdirected messages, accidental disclosure, risky recipients and malicious or negligent insider activity. It is an email-centered control, not automatically a replacement for enterprise data-loss prevention across endpoints, file shares, SaaS applications and messaging systems. Prevent product page
KnowBe4 Protect: encryption and secure communication
Protect provides policy-based email encryption, recipient authentication, sender controls and auditability. Organizations already standardized on Microsoft Purview Message Encryption or a specialist secure-email platform should compare policy coverage, recipient experience, data residency and interoperability before changing products. Protect datasheet
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat changed for Egress customers?
KnowBe4 announced an intention to integrate Egress products and operations and create a unified customer experience. That does not, by itself, promise unchanged pricing, support, data residency, APIs or contract terms. The current Egress subscription archive includes historical master-subscription agreements, including an MSA v3.17 covering subscriptions from November 7 through December 31, 2024. KnowBe4’s legal hub still links Egress-specific terms, privacy material and end-of-support information.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
Before renewing or expanding, customers should obtain written answers to these questions:
- Which legal entity appears on the contract, invoice and renewal notice?
- Is the product being renamed, co-branded or replaced?
- Which support portal and escalation path apply?
- Are APIs, connectors, mail-flow routes, permissions or quarantine behavior changing?
- Are data-processing locations, subprocessors or retention periods changing?
- Are service-level commitments, pricing, packaging or renewal terms changing?
- Does any legacy Egress capability have an end-of-support date?
- Can the existing product still be purchased, and what migration path is offered?
How the current products are deployed
Current Defend materials describe both SMTP mail-flow deployment and Microsoft Graph API deployment. KnowBe4 also advertises Microsoft 365 integration, including direct quarantine integration with Microsoft Defender for Office 365. Current deployment options
SMTP versus Graph API
SMTP can provide earlier control in the mail path but may require routing changes and careful failure-mode design. Graph API deployment can reduce routing complexity and analyze or remediate messages after delivery, but it depends on Microsoft 365 permissions and API behavior. The approaches can differ in message visibility, quarantine timing, remediation of already delivered mail, latency and fail-open or fail-closed behavior. Neither is universally superior.
Microsoft 365 and Google Workspace
Microsoft 365 is the clearest documented target. Public Google Workspace information is inconsistent: the current product page describes Gmail deployment, an FAQ last updated May 20, 2026 says G Suite is unsupported, and the product roadmap lists Google Workspace support as a 2026 roadmap item. FAQ Roadmap
Those statements may reflect different release stages or scopes. Buyers using Google Workspace should confirm the generally available feature set, deployment method, remediation behavior and regional availability in writing before signing.
Does Defend replace Microsoft Defender or a secure email gateway?
No blanket replacement claim is justified. KnowBe4 markets Defend as a complementary layer that can enhance Microsoft 365 security and catch threats that native protection or traditional gateways may miss. Existing gateway architecture can affect routing, duplicate scanning, quarantine ownership and incident investigation.
Rank #4
A proof of concept should measure false positives, latency, allow-listing, internal and external sender handling, remediation, mail-flow failures and administrative workload. Compare total control-plane complexity rather than relying on “AI-powered” positioning or a single capture-rate figure.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What evidence is available on effectiveness?
KnowBe4’s Defend page advertises more than 30% higher threat capture, 97% risk reduction from point-of-risk teachable moments, 95% operational-time savings and 35% noise reduction from graymail and spam. These are KnowBe4-reported figures, not neutral benchmark results. Vendor claims
Request the baseline, sample size, measurement period, attack definitions and whether results came from real or simulated attacks. Ask whether the comparison was against Microsoft Defender alone, another secure email gateway or the broader KnowBe4 platform, and whether any independent party audited the results.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Public pricing signals
The Defend pricing page labels the following as North American MSRP from January 2025, based on a three-year term:
| Seats | Price per seat/month |
|---|---|
| 25–50 | $5.30 |
| 51–100 | $4.90 |
| 101–500 | $4.60 |
| 501–1,000 | $4.00 |
| 1,001+ | Get a quote |
These are not universal current quotes. KnowBe4 says prices may change and vary by country; term, nonprofit status, competitive-displacement discounts, package and renewal date can also affect an offer. Defend pricing
When the combined platform may fit
- You already use KnowBe4 and want email protection, coaching and human-risk reporting under one supplier.
- Microsoft 365 is your primary mail platform.
- You value contextual warnings and a shared administrative experience.
- You want an incremental layer alongside Microsoft Defender rather than an immediate gateway replacement.
When to be cautious
- You require mature, feature-equivalent Google Workspace support and cannot accept documentation ambiguity.
- You already operate a mature gateway, DLP, encryption and user-reporting workflow.
- You need specialized regulatory, classification or outbound-DLP controls that require separate validation.
- You require short-term, self-service pricing for a large deployment.
- You want separate suppliers for awareness training and email defense to limit concentration risk.
- Mail-flow changes, API permissions or quarantine integration are difficult to approve.
Proof-of-concept checklist
- Test executive, supplier, payroll and invoice-impersonation scenarios.
- Include payload-free, multilingual and AI-generated social-engineering messages.
- Test messages from legitimate but compromised internal accounts.
- Measure false positives on newsletters, alerts, customer replies, bulk mail and graymail.
- Verify search, grouping, quarantine, deletion and message recovery.
- Assess banner clarity, localization and user actionability.
- Compare SMTP and Graph API latency, permissions, routing failures and outage behavior.
- Check Defender quarantine synchronization, Microsoft-console visibility and SIEM export.
- Test outbound misdirection, autocomplete errors, reply-all mistakes, sensitive content and encryption.
- Review role-based access, audit logs, policy granularity, reporting and API quality.
- Document renewal, retention, support escalation and legacy-product end-of-support commitments.
Bottom line for buyers
The acquisition is complete, not pending. Its logic is strongest for organizations that want one operating model linking email threats to user-risk analytics and training. It is less compelling as an automatic replacement for Microsoft Defender, a specialist secure email gateway or a broad enterprise DLP platform. Evaluate the current Defend, Prevent and Protect offerings through a controlled proof of concept, and verify contract, support, Google Workspace, pricing and data-handling details before renewal or purchase.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
