Microsoft's latest benchmark ranks KnowBe4 first across reported uplift metrics, as businesses look for better ways to catch phishing and impersonation attacks that bypass built-in email protection. 

[For more news, click here]

An email can pass security checks and still pose a serious risk. A message asking a finance team to update a supplier’s bank details, for example, may contain no suspicious link or attachment. If it appears to come from a trusted contact, an employee may have little reason to question it. Such attacks remain a challenge for businesses, even those with established email security systems. 

KnowBe4 Defend ranked first across every reported uplift metric in Microsoft’s latest email security benchmark, which evaluated seven integrated cloud email security (ICES) providers using production data collected between May and July 2026. 

Defend detected 1.11% of dangerous emails missed by Microsoft Defender, compared with an average of 0.30% across the providers assessed. It also recorded a 1.88% uplift in spam filtering and a 65.24% uplift in promotional and graymail cleanup. The results give businesses a basis for comparing additional email security products and assessing the protection they provide beyond existing filters. 

Catching the Emails That Look Legitimate 

Business email compromise (BEC) often relies on impersonation rather than malicious files or links. Attackers may pose as company executives, suppliers, or colleagues, using familiar names and ongoing business conversations to make fraudulent requests appear routine. Generative AI can help produce convincing messages more quickly, but the underlying tactic remains the same: persuade someone to trust a message and act on it. 

Defend is designed to work alongside Microsoft Defender through native Graph API integration or pre-delivery inline deployment. It focuses on suspicious behavior and communication patterns that conventional filtering may miss. KnowBe4 is also a charter member of Microsoft's ICES Vendor Ecosystem. One notable finding was Defend's 0.65% overlap with Microsoft's detections, the lowest among the seven providers. This indicates that Defend identified threats that were less likely to have already been flagged by Defender. 

The benchmark also examined malicious emails removed after delivery. In mailboxes protected by Defend, KnowBe4 accounted for 16.92% of post-delivery malicious removals, compared with an 8.00% average across the providers assessed. This measures KnowBe4's contribution to removing malicious messages after they have reached users' inboxes. 

For businesses choosing an email security product, detection rates are only part of the decision. False positives, investigation time, and integration with existing systems also matter. Performance can vary with email volumes, security settings, and the types of attacks an organization encounters, so testing in its own environment remains important before deployment. 

On October 28, Stuart Clark, KnowBe4's senior vice president of product, is scheduled to discuss the findings in a webinar and demonstrate threat hunting using Kusto Query Language (KQL). 

Organizations that depend on email for payments, supplier relationships, and internal approvals face financial and operational risks when impersonation attempts go undetected. Microsoft's benchmark gives security leaders another reference point when deciding whether their existing email defenses need an additional layer of protection. 

Related Articles 

Chinese Hackers Posed as a Former White House AI Official to Target US AI Policy Experts 

How Attackers Are Weaponizing Microsoft 365's Own Features Against UAE Organizations 

Hackers Aren’t Breaking In Anymore, They’re Logging In