Security Awareness Training

Moraph resells, implements and runs KnowBe4 as a managed service for banks, credit unions, broker-dealers and other financial firms. We plan simulated phishing campaigns around the fraud your staff actually see, such as fake wire transfer requests, payment change requests and executive impersonation, and assign training to the people who need it. Your security and compliance leads approve the program, and you get the evidence examiners and cyber insurers ask about.

The problem it solves

Financial institutions are required to train staff on information security, and the people most often targeted by fraud are the ones who move money: wire rooms, tellers, payment operations and executive assistants. Many training programs run generic annual courses and occasional off-the-shelf phishing tests that look nothing like a business email compromise aimed at a bank. The platform is bought, but nobody has time to plan campaigns, follow up with repeat clickers or turn results into evidence for examiners, auditors and insurance applications.

Who it’s for

• Chief information security officers and information security officers at banks, credit unions and financial firms
• Compliance and risk leaders who answer for training under GLBA and state cybersecurity rules
• Operations leaders responsible for wire, ACH and payment teams
• HR and learning teams who manage required training
• Internal audit and examiners, who need evidence that training and testing happen

1. PlanMoraph and your security lead agree an annual program: which groups are tested, which fraud scenarios are used, what training follows, and how results are reported.
2. SimulateKnowBe4 sends simulated phishing emails on the agreed schedule. Moraph builds and checks each campaign, makes sure it reaches inboxes, and tells your help desk what is coming.
3. TrainKnowBe4 assigns training to everyone on schedule and to people who fail a simulation. Moraph follows up on overdue training and reports completions to the people you name.
4. Report and improveEach campaign ends with a results summary and recommendations. Moraph brings trends, repeat clickers and reporting rates to a monthly review, and adjusts the plan with your approval.

Financial fraud scenarios

Simulations built around wire transfer requests, vendor payment changes, executive impersonation, account takeover and fake regulator or core-vendor notices, adapted from KnowBe4's template library.

Role-based groups

Staff grouped by exposure, so wire operations, tellers, lenders and executive assistants get scenarios and training suited to their work.

Managed campaign calendar

Moraph plans, builds, launches and closes each campaign on the calendar you approve, so the program does not lapse.

Delivery checks

Allow-listing and test sends confirmed with your IT team before each campaign, so results reflect people and not mail filtering.

Remedial training

KnowBe4 assigns short training to anyone who clicks or enters data in a simulation, and Moraph follows up on what stays incomplete.

Phish Alert Button

KnowBe4's reporting button in Outlook or Gmail lets staff report suspicious email; Moraph configures where real reports are sent.

Required course tracking

Annual security awareness, privacy and fraud courses assigned and tracked, with overdue lists to managers.

Repeat clicker follow-up

People who fail repeatedly are listed for their managers and given additional training under the policy you set.

Executive and board sessions

Targeted content and simulations for senior staff, who are frequent targets of impersonation, scheduled with care for their calendars.

Program evidence

Training completions, campaign results and program changes assembled for examiners, internal audit and cyber insurance questionnaires.

Directory synchronization

Users and groups kept in step with your identity provider, so new staff are enrolled and leavers removed.

Monthly program review

Trends, issues and recommendations reviewed with your security lead each month, with decisions recorded.

Security program owner

Approves the program, scenarios and policies, and receives results

People manager

Sees their team's results and follows up on overdue training

Staff member

Receives simulations and training and reports suspicious email

Client IT administrator

Maintains mail delivery, the reporting button and directory sync

Moraph service team

Plans, builds and runs campaigns and training and reports on the program

Auditor or examiner (read-only)

Views program evidence without changing anything

Email platform

Microsoft 365 or Google Workspace allow-listing so simulations are delivered, configured with your mail team.

Phish Alert Button

KnowBe4's add-in for Outlook and Gmail, with real reports routed to your security team or security operations provider.

Identity provider

User and group synchronization and single sign-on through Microsoft Entra ID, Okta or another supported provider.

HR or learning system

Training completions can be exported to your learning management or HR system where it keeps the record of required training.

Security operations

Real phishing reported by staff passed to your security team, or to Moraph's Endpoint Detection & Response service if you use it.

Moraph service reporting

Campaign plans, approvals and reviews tracked in Moraph's service tooling and shared each month.

Single sign-on

Administrators sign in through identity providers with multi-factor authentication, and access is removed when people leave.

Role-based access

Staff see their own training, managers see their teams, and individual results are limited to the people your policy names.

Minimal personal data

Only the directory attributes needed for enrollment and grouping are synchronized; no customer data is used in simulations.

Controlled privileged access

Moraph staff use administrative access only for approved work, with credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. KnowBe4's own platform assurance reports are available from KnowBe4 under its terms.

Audit trail

Campaign approvals, launches and program changes are recorded with who did what and when.

KnowBe4 cloud, managed by Moraph

KnowBe4 hosts the platform; Moraph runs your program on it under a managed service agreement.

Moraph-managed with your existing KnowBe4 subscription

If you already subscribe to KnowBe4, Moraph can take over running the program, subject to KnowBe4's terms.

Alongside other Moraph services

Run with Moraph's Endpoint Detection & Response or Identity Access Management services, so reported phishing and risky users are handled together.

Program design

We agree goals, groups, scenarios, training and the results policy with your security, compliance and HR leads.

Platform setup

KnowBe4 is configured with single sign-on, directory synchronization, groups and administrator roles.

Mail and reporting button

Allow-listing is set up with your mail team, the Phish Alert Button is deployed, and real reports are routed to your security team.

Baseline campaign

A first simulation, approved by your program owner, establishes where each group starts.

Communication to staff

We help you announce the program, explain how to report suspicious email, and brief the help desk.

Handover to service

The calendar for the year is approved, and the program moves to monthly reviews with Moraph's service manager.

• Moraph is not KnowBe4. The platform and content belong to KnowBe4, and KnowBe4's own service commitments, roadmap, maintenance and outages apply.
• Subscriptions are subject to KnowBe4's terms, and the content and features available depend on your subscription level.
• Training and simulations reduce the chance that staff fall for fraud; they do not prevent it. Payment controls such as call-back verification remain essential.
• Moraph cannot promise any effect on cyber insurance premiums or coverage. That is your insurer's decision; the service provides evidence of your program.
• Real phishing reported by staff is routed to your security team. Investigating it is not part of this service unless you also use a Moraph security operations service.
• Decisions about consequences for repeat failures belong to your institution and its HR policies.
• Simulations depend on mail delivery. If allow-listing is changed without notice, results may not reflect staff behavior.
• Training content is KnowBe4's; custom courses written for your institution are scoped separately.

• Ask to see sample scenarios built around wire, ACH and payment-change fraud
• Review the results policy and decide who should see individual results
• Walk through the approval step for a campaign that names an executive
• Check how real phishing reports will be routed and who investigates them
• Review a sample evidence pack against your last exam request or insurance questionnaire
• Walk through the responsibilities table with your security, HR and IT leads