Organizations using Google Workspace alongside KnowBe4’s phishing security tests and Defend must complete additional configuration steps to ensure proper email delivery and accurate testing results. This article outlines the recommended best practices for configuring Defend while using phishing security tests.

For instructions on adding Defend's sending IP addresses:

• For a list of Defend's sending IP addresses, see the Defend- KnowBe4 Security Test Emails article.
• For instructions on adding these IP addresses in Google Workspace, see the Whitelist by IP Address in Google Workspace article.

Labels and Threat Notifications

By default, phishing security tests will be marked with labels, or users will receive a threat notification about them. This default behavior simulates a real-world scenario for how Defend would react to a legitimate phishing email.

If you want to see if users still select phishing emails without labels, you can remove them from any phishing security tests by adding KnowBe4's sending IP addresses to Defend's allowlist. This process will also prevent users from receiving threat notifications for phishing security tests.

For a full description of Defend's labels, see the Defend | Google Workspace User Guide.

For full details, see the Whitelisting Guide and Defend - Allow or Deny Lists article.

Phishing Security Tests

As an alternative to removing labels and threat notifications from phishing security tests entirely, you can use the Phishing Security Tests setting on the Settings page to control which labels and actions are applied instead. For a description of each option, see the Defend | Google Workspace Settings article.

Setting this to Suspicious or Dangerous applies the threat label to phishing security tests, as long as the setting that applies the label isn’t Disabled. Phishing security tests aren’t moved out of the inbox, to spam, or to trash, regardless of the other Auto-Remediation actions configured for that level. This setting doesn’t affect detection.