Data Detection Policies Guide for Agent Risk Manager

Use Data Detection Policies to choose which sensitive data types Agent Risk Manager should flag when AI agents and tools handle them. This guide explains how to access your policies, configure your policy categories, and review flagged detections.

Access Your Policies

How you access Data Detection Policies depends on whether you use the classic KnowBe4 console or the KnowBe4 Platform. Follow the steps in the matching subsection.

Classic KnowBe4 Console

To access your Data Detection Policies from the classic KnowBe4 console, follow these steps:

1. Log in to your classic KnowBe4 console.
2. In the top-left corner of the screen, select the grid icon. A drop-down menu will display.
3. In the drop-down menu, select Agent Risk Manager.
4. In the sidebar, select Policies, then select Data Detection Policies.

KnowBe4 Platform

To access your Data Detection Policies from the KnowBe4 Platform, follow these steps:

1. Log in to your KnowBe4 Platform.
2. In the sidebar, select Agent Risk Manager.
3. Under Policies, select Data Detection Policies.

Configure Your Policy Categories

The Data Detection Policies page groups sensitive data types into categories, such as personally identifiable information (PII), credentials, health data, and financial records. Each category card shows how many data types it contains, badges for any data types that are paused or have exceptions, and a summary of excluded providers and paused data types. 

To view a category's data types, select View All on its card. 

For more information about the data types available in each category, see the table below:

Configure Data Types

To configure a data type, select its category card, then select Details to the right of the data type row. From the details panel, you can choose what is redacted when the data type is detected and enable or disable data type detections for a specific provider.

To choose what information to redact, use the If accessed, redact control to choose between redacting the Matched string and the Full message, then select Save Changes.

To change the detection status of a provider, select or clear the checkbox to the left of the provider's name, then select Save Changes. For more information on available providers, see our integrations guide.

Review Exceptions

On the Data Detection Policies page, select a category card, then select the Approved Exceptions tab to review the data types in that category that have been disabled for specific providers. The table shows each exception's Data Type, Provider, and Disabled At timestamp.

To add an exception, clear the checkbox for a provider, then select Save Changes. The exception will then appear in the Approved Exceptions tab. To remove an exception and restore detections for that provider and data type, select the three dots icon in the exception's row, then select Remove.

Add Custom Data Types

To add a custom data type, select a category card, then select + Add Detection Rule, then follow these steps:

1. Enter a Display Name.
2. Select a Category. You can select a category from the list or type your own to group the rule in the table and in reports.
3. Optionally, add a description under Optional Details.
4. Choose a Detection Method:
   • Pattern: Matches anything with a consistent format, such as IDs, card numbers, or email addresses. Describe the pattern in plain language, and AI will search the pattern library and display the closest matches. Under Select matching formats, select at least one suggested format. If the suggestions aren't what you expected, paste a real example and select Suggest.
   • Word List: Matches exact words or phrases that you provide. Enter one word or phrase per line.

When you're finished, select Add Rule.

Review Flagged Detections

To review flagged detections for your configured policies, see the AI Activity Log.