PhishER review
A focused phishing-response platform with automation, enrichment, and remediation.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
PhishER is KnowBe4’s cloud security orchestration, automation, and response platform for managing suspicious emails and Microsoft Teams messages reported by users. It classifies reported content and can categorize, notify, quarantine, block, or remove threats. Teams that need a focused workflow for phishing triage and response will find its scope more relevant than a general-purpose automation platform.
Pricing is paid monthly per seat. PhishER Plus costs USD 1.50 per seat per month for 101–500 seats and USD 1.15 per seat per month for 501–1000 seats. These published prices apply under a 3-year term, while 1001+ seats require a quote. The product can operate as a standalone platform or an optional add-on. Its integration surface includes Blumira, Cortex XSOAR, CrowdStrike Falcon Sandbox, FortiSOAR, Swimlane, Tines, VirusTotal, VMRay, and other security platforms, with API, syslog, and webhook support.
Its main depth is phishing-response automation: automated rules and actions work with PhishML classification, YARA-based custom rules, PhishRIP email quarantine and mailbox remediation, and threat-intelligence URL analysis. PhishER Plus adds Global Blocklist and Global PhishRIP, while PhishFlip can convert reported attacks into simulations. The platform also supports attachment and URL scanning through VirusTotal. Choose PhishER when reported phishing is the priority and integrations can connect it to the wider security stack. Teams seeking broad orchestration across many incident types or built-in case management should choose a fuller SOAR platform instead.
PhishER pros and cons
- Where it wins
- Automates phishing classification, dispositioning, quarantine, and remediation
- Adds PhishML, YARA rules, threat-intelligence, and scanning integrations
- Supports API, syslog, webhook, and third-party security integrations
- Where it doesn't
- Focuses on phishing-response workflows rather than broad SOAR coverage
- Does not include case management
- 1001+ seat pricing requires a quote
PhishER fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update