KnowBe4: M&A Helping with Global Expansion

KnowBe4 continues to expand its global reach via acquisitions and partnering, while providing increasing opportunities for MSSPs, resellers and other partners in a “vastly untapped” market.

That’s according to Perry Carpenter, KnowBe4’s chief evangelist and strategy officer, at this week’s KB4-CON, the company’s user conference in Orlando, Florida. He said KnowBe4 is “in it to support the partners” and the channel is really good” for a company like his. 

KnowBe4’s Perry Carpenter

“The majority of vendors in this market are having a hard time keeping up with us … they’re kind of betting on a losing horse if they going with other vendors,” he said. “The gap between where we are and they are is increasing over time.”

KnowBe4 now has more than 25,000 customers, as well as 700 employees, and operates in eight countries.

“We have hundreds of MSPs or MSSPs that write us into their rollout,” said Stu Sjouwerman, KnowBe4’s CEO. “For these types of organizations, it’s quite a good deal because on one hand you can charge a little more, but your costs are going down because … it saves time.”

In a Q&A with Channel Futures, Carpenter tells us his company is busy developing new security awareness training content, and has its eye on opportunities in other regions.

Channel Futures: You joined KnowBe4 just over two years ago. How has your role evolved during that time?

Perry Carpenter: I’ve carved out the buckets that I work in, and about a third of it is speaking and doing analyst relations, and kind of the public face of the company in conjunction with other people who are doing that. Then I’ve also been concentrating on a couple of things related to the product and helping the product team … just fleshing out some of the ideas and then connecting the product to the way that a CISO would think about the needs that they have. And then the third section that I focus on quite a bit is content, and I break that down into two different areas: content in the procurement of itself, and then also the procurement of companies that produce content, so there’s an M&A piece of that as well. When a company is too big [for] M&A or if a company’s not willing to be acquired at this time, then we’ll partner with them and have a really good relationship with them, and try to use their content and license that. For companies that are best-in-class … within a region or on a certain topic, or something else, then we may look to acquire them so we can bring that talent in-house, and continue to fuel that so they’re not having to worry about all the distractions of running a company, but they can focus on the passion that got them in the business in the first place.

You saw us acquire two companies last year, Popcorn Training … and exploqii out of Germany. So we’re always pivoting around thinking flavors and types of style, links and then also global applicability.

CF: And the acquisitions are continuing with El Pescador in Brazil and another that will be announced soon?

PC: El Pescador was a very strategic acquisition, not only on the content side, but their real strength is on the technology side, so they give us the ability to do some development in Brazil with a great group of coders. And they’ve got a great network of people that they can also draw in there. They’e really good thought leaders [in] the way that they approach their style of content as well. And it does show that when we think global, what we want to do is focus on a company that does well in that region already, and then grow that, rather than hoping that if we …

… export North American culture, that it will just work because we know it won’t. So we want to find what’s great there and then grow it.

And then there [are] upcoming acquisitions as well. There’s one that we’ll announce (soon), and there’s potentially another one that we’ll announce within the next three months. Right now it’s a 90 percent yes, and that’s going to be a big acquisition.

CF: The one that’s going to be announced soon is all about security culture. What’s the significance of security culture?

PC: KnowBe4 really started focusing on phishing; that’s one human-behavior element that you can capture and you can measure, and you can try to train. And so we created around that the Phish-Prone Percentage, which is somebody’s propensity for being phished, and that was a good reporting metric. Last year, we released the Virtual Risk Officer and the reporting around that, which was not just a behavior, but a cluster of behaviors and the propensity for being targeted for certain attacks, so like a FICO score for risk. The acquisition that’s coming soon gives us the ability to take that to the culture level. When you think about culture, that’s the aggregation of a group of people’s behaviors, their thoughts, their beliefs and the way that they approach any situation. So it really is that third tier. You start at the individual behavior, you focus on clusters of behavior, and you focus on clusters of clusters.

CF: Are there increasing opportunities for partners, and is that tied to the acquisitions taking place?

PC: I wouldn’t say it’s tied in part to the acquisitions. I think it’s just market opportunity. This is still a vastly untapped market, so if we’re entering and we’re doing this well in a vastly untapped market, you can imagine the possibilities for partners because we can grow at a very rapid rate like we have – we’ve been in hypergrowth mode for the length of the company’s existence – and that doesn’t seem to be slowing down. But we can only add warm bodies to chairs internally, and with the quality of training and excellence that we want with our people at a certain rate, partners and that entire ecosystem, they’ve done a lot of the vetting and the quality checking for us at times. So if they’re bringing on really good people and they’ve got a solid track record, and they’re invested in their success and our success, then it’s a win-win situation.

CF: Is what cybercriminals are doing impacting KnowBe4’s strategy and a reason why that continues to evolve?

PC: A lot of it is confirmation. So I would say 80-90% of what we see cybercriminals do is confirmation that we’re on the right track. Every now and then … we see leading indicators that might involve new paths for training, but really they’re rooted in all the old things that we always talk about. It’s the same psychology embedded in that, but the technology is revealing new ways to expose that. A lot of the things that we see in the future or the trends coming up revalidate the past work, but they give a new face to it and a new nuance that we have to tease out.

CF: What’s ahead this year for KnowBe4?

PC: We continue to work on AI and machine learning. We have some really good advances there and releases last year in what we internally code name AIDA (Artificial Intelligence Driven Agent). So there will be some announcements and some discussion, but those are a little bit further off. Because we’ve been innovating so fast … what we really want to do is spend a decent amount of time ensuring that the stack that we have is stable and scalable and basically infinite. We’re attracting the attention of the largest companies in the world, and so what we don’t want to do, as we innovate as fast as we do, is …

… insert any instability anywhere, or anything that would cause the stack to suffer or a customer to suffer. So we’re spending a lot of time and focused effort ensuring that the code base is lean and is stable, that the infrastructure and support systems are stable, reliable and sustainable over time, and just making sure that everything there is rock solid. It has been, but with the explosive growth, we want to make sure that we’re positioning for that next level, too. That’s all non-sexy, under-the-cover stuff. And then there [are] other acquisitions coming and a ton of new content that we’re working on.

CF: What’s your global reach and are there areas where you’re wanting to expand into?

PC: KnowBe4 is in eight countries currently. We have offices in the United States and the Netherlands, and York in the United Kingdom, Dubai and Singapore coming online, and Australia, South Africa and Brazil. And then if we had to look at where the most global opportunity is coming, it’s kind of the emerging APAC region. We are positioned well there with the offices we’re bringing online in Australia, Dubai and Singapore. But if you start to think about the market opportunity in China and Japan, where we really have to understand the culture and go in right … and the amount of good that can be done by doing it right in those areas, it’s hard to overstate what we could do as a company. So I think that we will be thinking about those types of moves, but probably too early to say that we’re going to do anything like that or not. But when we do it, we’ll do it right.