KnowBe4, which provides security awareness training and a simulated phishing platform, raises $300M round led by KKR at a $1B valuation
Context & Ripple Effects
KnowBe4's $300M round marks the moment security awareness training graduated from niche budget line to unicorn-scale software category. It builds on proof laid by rival PhishMe, whose $42.5M Series C in 2016 showed investors would fund employee-facing phishing defense at venture scale.
The KKR bet aged well on private equity's own terms: just over three years later, Vista Equity Partners agreed to take the entire company off the market for $4.6B, more than quadrupling the entry valuation in this round.
First-order effects
- KnowBe4 gains $300M of growth capital to expand its simulated-phishing platform and sales footprint, while KKR secures a major position at a $1B valuation.
- Direct competitor PhishMe now faces a rival with unicorn status and deep-pocketed sponsorship in the same employee-security segment it pioneered.
Second-order effects
- The round signals to other PE firms that human-layer security is institutionally fundable, priming the category for the kind of full buyout Vista executed in 2022.
- Later entrants such as Sublime Security, which raised a $150M Series C for AI-agent email defense, inherit a market where phishing training budgets are already established — they compete for the same spend with newer tooling.
Third-order effects
- The pattern that holds: PE firms treat security-awareness vendors as durable cash-flow software assets worth owning outright, not just minority stakes — KKR's entry price versus Vista's $4.6B exit frames the arbitrage.
- Phishing defense keeps attracting capital across generations of technology, from PhishMe's training-first approach through agentic platforms like Beacon Security, suggesting the human attack surface remains a permanently funded category even as methods shift.
The trend: Private equity is systematically moving into human-risk security vendors — first as growth-stage backers like KKR, then as outright acquirers like Vista — making security awareness training a consolidated, PE-owned software category.