KnowBe4 User didn't click on the link but reported as clicked in the tool

[AndreaPancrazi]

The KnowBe4 console marks a user as having clicked if the unique URL assigned to them from a specific phishing campaign is accessed. It can be accessed by a human or by an automated process. Using the Google native reporting tool will cause that message to be forwarded to Google for investigation. Part of that investigation process typically involves visiting the links which triggers the click failure for the original recipient of the message.
 
Whitelisting only protects the message on the way into the user's inbox. If the message makes it to the user's inbox without triggering a click failure, then the whitelisting is probably set up correctly.
 
Google does not openly share its spam/phishing investigation criteria and we do not have any documentation on how to prevent false positives from using their native reporting tools.

Would it be possible to avoid investigating the links in the emails reported as phishing whose domain is psm.knowbe4.com ?

[b_gorsky1]

@AndreaPancrazi We too just started using KnowBe4. Can you clarify the what the issue is and how/when it is happening?

[AndreaPancrazi]

WHAT?
The problem is that we get false positives in KnowBe4, links are marked as clicked but users claim they never clicked them.

HOW?
Because when the user reports the email as phishing in Gmail, part of Google's investigation process involves evaluating the content, including visiting the links.

WHEN?
This is not predictable because when a user reports a KnowBe4 email as phishing, the links are not always marked as clicked. My hypothesis is that Google's investigation process does not always involve visiting the links.

[KAM]

@AndreaPancrazi Google's cache and many various tools/plugins will activate links in emails.  We see it with Raptor's one click filing system from RaptorEmailSecurity.com all the time.  In the end, I wouldn't rely on KB4's technology to tell you if you have a problem user and focus instead on using it to educate and enable your staff instead.  -KAM