Agent Risk Manager helps you discover and monitor the AI agents operating across your organization. It also helps you detect security risks and control which AI tools your users can access. This overview explains how to access Agent Risk Manager, navigate it, connect your integrations, configure your policies, review your AI activity, and understand events and detections.
For step-by-step setup, see our quickstart guide. For answers to common questions, see our FAQ. For product updates, see our change log.
Access Agent Risk Manager
How you access Agent Risk Manager depends on whether you use the classic KnowBe4 console or the KnowBe4 Platform. Follow the steps in the matching subsection.
Classic KnowBe4 Console
To access Agent Risk Manager from the classic KnowBe4 console, follow these steps:
- Log in to your classic KnowBe4 console.
- In the top-left corner of the screen, select the grid icon. A drop-down menu will display.
- In the drop-down menu, select Agent Risk Manager.
KnowBe4 Platform
To access Agent Risk Manager from the KnowBe4 Platform, follow these steps:
- Log in to your KnowBe4 Platform.
- In the sidebar, select Agent Risk Manager. A pop-up menu will display.
- Select the tab you want to navigate to, such as Dashboard.
Navigate Agent Risk Manager
To move between pages in Agent Risk Manager, use the sidebar. The sidebar includes the following sections:
- Dashboard: A summary of AI activity across your organization.
- Discovery: Your organization's AI Activity Log and Inventory.
- Policies: Your organization's AI Policies, AI Tool Permissions, and Data Detection Policies.
- Setup: Integrations, where you can connect and manage your integrations.
- Users: User Activity, where you can review the activity of your users.
Each page is summarized in the sections below, in the order you typically use them.
Connect Your Integrations
Before Agent Risk Manager can discover agents or show detections, you'll need to connect at least one integration in Setup > Integrations. Integrations connect Agent Risk Manager to the AI providers your organization uses, so Agent Risk Manager can receive and analyze agent activity.
Agent Risk Manager supports the following integrations:
- Anthropic Claude Compliance: Connects Claude activity. For setup steps, see our Claude Compliance integration guide.
- Google Gemini Enterprise: Connects Gemini Enterprise activity.
- KnowBe4 Browser Extension (Intune): Deployed to managed Google Chrome and Microsoft Edge browsers through your device management (MDM) platform. The extension governs in-browser AI usage and allows users to acknowledge your Acceptable Use Policy (AUP).
- Microsoft Copilot: Connects activity from Microsoft Copilot Studio agents and, where available, Microsoft 365 Copilot Chat.
- OpenAI ChatGPT Compliance: Connects ChatGPT activity.
On the Integrations page, you can also view each integration's connection status, pause and resume data collection, and delete an integration. For more information, see our integrations guide.
Configure Your Policies
The Policies section of the sidebar is where you set the rules your users and AI tools follow. See the subsections below for an overview of each page.
AI Policies
Use the AI Policies page to upload and version the Acceptable Use Policy (AUP) that your users acknowledge in the KnowBe4 Browser Extension. The AUP is a PDF that tells your users how they may use AI tools. Each time you upload a new version, Agent Risk Manager keeps the earlier one in the version history. It then asks users to acknowledge the new version. For more information, see our AI Policies guide.
AI Tool Permissions
Use the AI Tool Permissions page to control which AI tools your users can access. In the AI Tool Registry, set each AI tool's Tier to Approved, Warn, or Blocked. The KnowBe4 Browser Extension can then warn your users when they use an AI tool, block them from accessing it, or redirect them to an approved alternative. For more information, see our AI Tool Permissions guide.
Data Detection Policies
Use the Data Detection Policies page to choose which sensitive data types Agent Risk Manager should flag when AI agents and tools handle them. Data types are grouped into categories, such as credentials, financial, and identity. For each data type, you can choose the providers it's enabled for, choose what to redact, configure exceptions, and add custom detection rules. For more information, see our Data Detection Policies guide.
Review Your AI Activity
After your integrations are connected, Agent Risk Manager begins collecting activity. See the subsections below for an overview of the pages you can use to review activity.
Dashboard
The Dashboard is your starting point in Agent Risk Manager. It summarizes what your AI agents did, how much of that activity was flagged, and which of your users were involved. For more information, see our Dashboard guide.
AI Activity Log
The AI Activity Log is a record of the AI activity that Agent Risk Manager has received from your connected integrations. Use this log to see the individual events behind the Dashboard figures. From the log, you can review your AI activity coverage, search and filter the events table, open an event's details, and export events as a CSV file. For more information, see our AI Activity Log guide.
Inventory
The Inventory page shows what AI agents in your organization can do, what they have done, and which users they did it for. For more information, see our Inventory guide.
User Activity
The User Activity page shows each user's detection count, last detection, last browser extension check-in, and AUP acknowledgment status. For more information, see our User Activity guide.
Understand Events and Detections
Agent Risk Manager receives event data from your connected integrations. The terms below describe that data:
- Event: Any recorded activity, such as an agent running, a tool being called, a schema being discovered for an agent, a user acknowledging your AUP, or the KnowBe4 Browser Extension blocking a user.
- Detection: An event that Agent Risk Manager flagged for review.
Agent Risk Manager assigns each detection to one of the following categories:
- Excessive Agency
- Prompt Injection
- Sensitive Information
- Unbounded Consumption
For definitions of each event status and category, see our events and detection categories guide.