KnowBe4 to acquire Norwegian assessment company CLTRe

Terms of the deal were not disclosed.

The security training vendor KnowBe4 has acquired CLTRe, a Norwegian company that specializes in measuring clients’ security preparedness, according to an announcement scheduled for Tuesday.

Florida-based KnowBe4 describes itself as the world’s largest security awareness training company. The firm is known for providing clients with a simulated phishing platform and partnering with Kevin Mitnick, the hacker-turned-consultant who now works as KnowBe4’s chief hacking officer. KnowBe4 was named among the fastest-growing apps used by corporate America, according to a survey released in February.

CLTRe (pronounced “culture”) is a small firm that created its own security culture framework, which is meant to provide companies with information about how their security culture changes over time. The framework measures corporate behavior, responsibilities, cognition, norms, compliance, communication and attitudes, as all those factors relate to security, over time.

Terms of the deal were not disclosed.

KnowBe4 currently is integrating the CLTRe assessments into its platform, and does not plan to change its pricing as a result of the deal.

“With KnowBe4 and CLTRe, organizations can gain true insight into their security culture, improve their security with pinpoint accuracy, report their progress to their board of directors, and educate their users to make smarter security decisions,” CLTRe CEO Kai Roer said in a statement.

A quantified risk assessment about a company’s security culture could help corporate chief information security officers inform their board of directors about the most pressing vulnerabilities, perhaps resulting in a larger budget. Directors frequently view security risk through a financial perspective, and assigning a numerical or understandable value to existential concepts like organizational responsibilities can shrink the amount of misunderstanding.

Third party assessment providers like Accenture Security, BitSight, SecurityScorecard and others also measure security risk in a way meant to help companies understand their security needs in clearer terms.

This deal marks only the latest cybersecurity merger or acquisition in an industry that analysts predict will only continue to consolidate. The data backup service Carbonite in February acquired Webroot, and some $3 billion of investors’ dollars has been pumped into the industry so far this year, Dino Boukouris, a founding director at Momentum Cyber, said last week.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure