This article outlines the key differences between the default Prevent experience and Prevent Enterprise, focusing on functionality and detection capabilities.
Key Differences
The following list highlights the high-level differences between the default Prevent experience and Prevent Enterprise.
- Configuration Requirements
- Prevent: Pre-configured detection policies are ready to use
- Prevent Enterprise: Requires additional custom configuration by KnowBe4’s professional services team
- Detection Scope
- Prevent: Focuses on common email security risks and errors
- Prevent Enterprise: Extends protection to content-specific risks and organization-specific data protection needs
Default Prevent Experience
The default Prevent experience includes the following detection policies:
- Misdirected Content
- An extension of the misdirected email detection
- Detects occurrences of human error, specifically when sending an email with a data type in the email body that is not usually shared with the selected recipient
- Custom Policies (Data Loss Prevention)
- Custom configured to nudge users when organization or industry-specific words or data types are detected in an email body
- Tailored to each organization's specific needs and compliance requirements
- Misdirected Email
- Detects when a user sends an email to the wrong person
- Finds errors that are typically caused by autocomplete
- Misspelt Recipient
- Identifies when a sender mistypes a recipient's email address
- Salutation Mismatching
- Flags when the recipient in the To or CC field does not match the recipient in the greeting of the email body
- Large Recipient List
- Alerts when there is a large number of recipients in the To or CC field
- Nudges advise the sender to move external recipients to the BCC field to maintain recipient privacy
- Data Exfiltration
- Detects when a sender attempts to send an email to a personal or webmail account
- New Recipient
- Identifies when a sender emails an external recipient for the first time
- External Domains
- Detects when two or more external domains are included in an email
- Impersonation
- Alerts when a sender is responding to an email that is impersonating a known recipient
- Newly Registered Domain
- Flags when a recipient domain was created in the last 50 days
- Provides protection, as newly registered domains are often used for malicious activity
- Blocklist
- Warns when a recipient domain is listed on a blocklist
Prevent Enterprise
Prevent Enterprise includes advanced use cases that require further configuration tailored to each organization by KnowBe4’s professional services team. The Prevent Enterprise experience includes the following detection policies:
- Purview Label Data Loss Prevention
- An extension of Data Loss Prevention
- Detects when a user sends an email or attachment labeled with a Microsoft Purview sensitivity label to an external or unauthorized recipient
- Prompt Wording Customization
- Lets admins reword real-time nudge titles and text
- Includes logo updates and the ability to add company policy URLs to real-time Outlook prompts
- Secondary Approval Workflows
- An extension of the Data Exfiltration use case
- Lets admins route high-risk outbound emails to line managers or SOC team members for an additional approval step