The biggest challenge in email security today isn’t just detecting a threat; it’s the speed of response across a global landscape. As we head into the second half of 2026, the stakes with speed have gotten higher. According to SQ Magazine, AI-generated phishing attempts are 68% harder to detect than they were just a year ago, and the average cost of an AI-powered breach has climbed to $5.72 million.
Cybercriminals are using the same AI you are to bypass your filters. In this environment, the most critical layer remains the same: humans.
Stop Doing ‘Work About the Work’
One of the biggest unexploited areas in risk management is human effectiveness. CISOs today are plagued by ‘work about the work’ aka the administrative burden of security. Analysts spend hours on low-value triage because:
- Tools don’t talk to each other
- Tools don’t talk to you
- Tools don’t enact real change within your organization
According to the FAIR (Factor Analysis of Information Risk) methodology, risk isn’t just a bad thing happening; it’s the frequency and magnitude of loss. When your SOC analysts are buried in false positives, your mean time to acknowledge (MTTA) and mean time to triage (MTTT) skyrocket. That isn’t just a technical lag; it’s a massive gap in your risk landscape.
Add The KnowBe4 Network to Your SOC Team
KnowBe4 believes in collective remediation. We analyze telemetry across our global footprint, processing 6.6 billion messages annually. This scale allows us to quantify exactly how much low-value work we can remove for your SOC.
Attackers use the same tactics to infiltrate your environment as they do hundreds of thousands of others. While traditional algorithms can take hours to identify and block a new threat, what happens while that threat is sitting in your users’ inboxes waiting to be clicked?
Human Intelligence Recovers 16,000 Hours
By introducing Global Blocklists and Global PhishRIP (powered by PhishER Plus), organizations receive real-time remediation from the PhishER community and KnowBe4 Threat Labs before the threat ever comes on your radar. When properly trained, humans spot threats that technology misses. In fact, our research shows that humans are still often the first to identify sophisticated lures compared to “sophisticated” AI email security filters.
But what does this global network equate to? On average, 48,000 emails have annually been removed from each PhishER Plus customer’s environment before anyone could interact with the known threat.
Now let’s break down the impact on your team:
- Time Saved: If it takes an analyst 10 minutes to investigate, quarantine and remediate a single threat, Global Blocklists and Global PhishRIP saves your team 8,000 hours per year.
- Closing the Loop: A high-performing SOC uses threats as training. With PhishFlip, your team can take those real-world threats and automatically turn them into phishing simulations and report on effectiveness in minutes. By automating this for just 48 threats a year, you save another 8 hours of high-value time assuming it takes another 10 minutes for this activity.
- Increase Focus, Reduce Hiring: With 16,000+ hours saved just from the global functionality in PhishER Plus, your team reallocates focus and you don’t need to hire an additional 4 full-time security analysts to keep up with the threat demand to your SOC.
Introduce New Metrics to Your Board
A critical metric that all InfoSec teams should be tracking is the percentage of incidents addressed by automated versus human response. When you leverage PhishER Plus you aren’t just buying another tool; you are improving your control health. You are reducing your variability aka the enemy of the CISO. You are ensuring that your team is focused on high-priority risk reduction rather than manually chasing the same phishing link that the network has already neutralized before your organization was even put on the cybercriminal’s radar.
Learn more about how your workforce + PhishER Plus is the most comprehensive way to automate triage in our “Humans + AI: Better Than Your SEG” Infographic.
Learn how the University of Oklahoma leveraged PhishER’s PhishRIP to remove nearly 150,000 malicious emails from users’ inboxes before anyone had a chance to interact with them.
