KnowBe4 Training — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited KnowBe4 Training (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
KnowBe4 training campaigns deliver security awareness content to users through structured enrollment workflows. Training can be assigned manually, triggered automatically after phishing test failures, or scheduled on a recurring basis. Each campaign tracks enrollment status, completion rates, and compliance deadlines. The training content library includes interactive modules, videos, games, assessments, and policy documents.
separate ID spaces and near-identical lifecycles. If the subject is a simulated phishing test, its templates, or who clicked, it is knowbe4-phishing; this skill covers only training campaigns and enrollments.
trigger is configured here, but the failure data itself is knowbe4-phishing.
skill reads individual campaigns and enrollments; aggregates and compliance dashboards are knowbe4-reporting.
CREATED ──> SCHEDULED ──> ACTIVE ──> CLOSED
│ │
└──── CANCELLED └──> ARCHIVED| Status | Description | Business Meaning |
|---|---|---|
| Not Started | User enrolled but has not begun | Needs reminder |
| In Progress | User has started but not completed | Actively working |
| Completed | User finished all required content | Compliant |
| Past Due | Deadline passed without completion | Non-compliant |
| Type | Description | Typical Duration |
|---|---|---|
| Training Module | Interactive course with slides and quizzes | 15-45 minutes |
| Video | Pre-recorded security awareness video | 5-15 minutes |
| Game | Gamified security training | 10-20 minutes |
| Assessment | Knowledge check quiz | 5-10 minutes |
| Policy | Policy document requiring acknowledgment | 2-5 minutes |
| Newsletter | Security awareness newsletter | 3-5 minutes |
| Poster | Downloadable awareness poster | N/A |
Training can be triggered automatically based on:
| Trigger | Description |
|---|---|
| Phishing Failure | User clicked/failed a phishing test |
| New Hire | User added to the system |
| Group Membership | User added to a specific group |
| Scheduled | Recurring enrollment (monthly, quarterly, annually) |
| Manager Request | Manual enrollment by manager/admin |
| Field | Type | Description |
|---|---|---|
campaign_id | int | Unique campaign identifier |
name | string | Campaign name |
status | string | Current status |
content | array | List of training modules/content assigned |
groups | array | Target groups |
duration_type | string | How long users have to complete |
start_date | datetime | When enrollment begins |
end_date | datetime | Completion deadline |
relative_duration | string | Days from enrollment to complete |
auto_enroll | boolean | Whether new group members are auto-enrolled |
allow_multiple_enrollments | boolean | Can users retake the training |
completion_percentage | float | Percentage of enrollees who completed |
| Field | Type | Description |
|---|---|---|
enrollment_id | int | Unique enrollment identifier |
content_type | string | Type of content assigned |
module_name | string | Name of the training module |
user | object | Enrolled user details |
campaign_id | int | Parent campaign |
enrollment_date | datetime | When user was enrolled |
start_date | datetime | When user began training |
completion_date | datetime | When user completed training |
status | string | not_started, in_progress, completed, past_due |
time_spent | int | Seconds spent on training |
current_module | string | Module user is currently on |
policy_acknowledged | boolean | Whether policy was acknowledged |
| Field | Type | Description |
|---|---|---|
store_purchase_id | int | Unique purchase identifier |
content_id | int | Purchased content item |
content_type | string | Type of content |
content_name | string | Name of content item |
purchase_date | datetime | When purchased |
expiration_date | datetime | License expiration |
| Tool | Description | Parameters (required in bold) |
|---|---|---|
knowbe4_training_campaigns_list | List training campaigns | page, per_page |
knowbe4_training_campaigns_get | Get campaign details, including its modules, enrollments and completion stats | `campaign_id` |
knowbe4_training_enrollments_list | List training enrollments across the account | page, per_page |
knowbe4_training_enrollments_get | Get enrollment details, including module progress and completion date | `enrollment_id` |
knowbe4_store_purchases_list | List ModStore purchases — the training content this account owns | page, per_page |
knowbe4_store_purchases_get | Get purchase details | `purchase_id` |
knowbe4_policies_list | List security policies and their acknowledgment requirements | page, per_page |
knowbe4_policies_get | Get one policy, including acknowledgment status | `policy_id` |
Two shape notes that change how these get used:
`knowbe4_training_enrollments_list` is account-wide and takes no filters. There is no campaign_id and no status argument. "Overdue enrollments for the HIPAA campaign" is a full paginated read filtered client-side on the campaign and status fields of each record — not a query. Budget the request count accordingly (see api-patterns), and pass per_page=500 rather than accepting the default of 100.
There is no training-module catalog tool. Nothing here lists the modules available to assign or reads a single module by ID. knowbe4_store_purchases_list is the nearest real capability and it answers a different question — what content this account has purchased from the ModStore, not what modules exist or what a campaign could use. knowbe4_training_campaigns_get names the modules already attached to a campaign. Choosing content for a new campaign is console work.
knowbe4_store_purchases_list — thisshows what the account has bought, which constrains what a campaign can assign. Browsing the full module catalog is console-only.
knowbe4_training_campaigns_list, then filterto the active ones yourself — there is no status argument
knowbe4_training_enrollments_list (account-wide;match them back to campaigns on the enrollment record)
| Code | Message | Resolution |
|---|---|---|
| 400 | Invalid campaign configuration | Verify content IDs and group IDs exist |
| 401 | Invalid API token | Verify KNOWBE4_API_KEY |
| 403 | Insufficient permissions | API token needs Training permissions |
| 404 | Campaign not found | Verify campaign_id exists |
| 404 | Enrollment not found | Verify enrollment_id exists |
| 429 | Rate limit exceeded | Implement backoff (see api-patterns) |
| Issue | Cause | Resolution |
|---|---|---|
| Zero completion rate | Campaign just started | Allow time for users to complete |
| User not enrolled | Not in target group | Check group membership |
| Completion not recording | Module requires assessment pass | User may need to retake quiz |
| Past due but completed | Completed after deadline | Marked past_due at deadline, then completed |
| Duplicate enrollments | Multiple campaigns with same content | Check allow_multiple_enrollments |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.