KnowBe4 adds AI email security and coaching to Google Workspace
KnowBe4 has launched an email and collaboration security layer for Google Workspace, extending its Defend product line to cover the roughly three billion users of Google's productivity suite. The new offering, which becomes generally available on 15 September 2026, adds multi-engine AI threat detection and real-time security coaching directly inside Gmail through a native API integration.
At the heart of the release is a behavioural AI model that KnowBe4 says is trained on more than 1.15 billion daily event signals and sixteen years of proprietary telemetry. The platform evaluates messages for intent signals associated with business email compromise (BEC), zero-payload phishing, and prompt injection, attack categories that frequently evade built-in controls in cloud productivity suites.
Early-adopter data
KnowBe4 ran a pre-launch early-adopter programme to gather real-world performance data. Across that cohort, the platform processed 539,384 emails, flagging 810 as dangerous threats (a rate of roughly one in every 666 emails) and a further 5,491 as suspicious. Both categories had already passed Google's native filters, the company said. KnowBe4 also reported that the platform's automated classification of productivity-related email saved participants an average of 10.96 hours per week, though no methodology was disclosed for that calculation.
When a threat is detected, Defend surfaces a contextual notification to the intended recipient immediately, framing the blocked message as a training moment. For confirmed malicious variants, the system integrates with KnowBe4's PhishER Plus product to pull back matching emails from all enterprise inboxes, with the company claiming containment in under two minutes compared to what it describes as a typical multi-hour SOC process.
Greg Kras, chief product officer at KnowBe4, said the release brings "explainable, multi-engine AI detection and real-time coaching together in a single, API-native layer, so every blocked threat also becomes a teachable moment."
Market context
The email security market serving Google Workspace is well-populated. Established vendors including Proofpoint, Mimecast, Abnormal Security and Tessian compete for the same API-native position, each arguing that their behavioural models catch threats that Google's own spam and phishing controls miss. Abnormal Security in particular has positioned itself on precisely this architecture over the past several years and has raised significant growth funding on the premise.
KnowBe4's differentiation is the integration of threat detection with its security-awareness training heritage: converting a blocked email into an in-the-moment coaching prompt is a genuine product choice, rather than a bolt-on. Whether that bundled approach displaces specialist detection tools or merely supplements them will depend on how enterprise security buyers structure their vendor stacks, and on whether KnowBe4's detection performance holds up under independent benchmarking.
The timing is notable in regulatory terms. The EU's NIS2 Directive, which came into force in October 2024 and requires member states to mandate security awareness training for staff at essential and important entities, creates a structural tailwind for vendors that can combine threat detection with workforce education in a single platform. UK organisations remain subject to comparable expectations under the NCSC's Cyber Essentials and broader ICO guidance on staff training under GDPR.
KnowBe4 reports more than 70,000 customers globally. The Google Workspace release follows what appears to be an existing Defend offering for Microsoft environments, broadening the platform's addressable market to Google's installed base. The company has not disclosed pricing for the new tier.