CISO Tribune

Vendor comparison · 2 companies

Bay vs KnowBe4

Bay is an AI agent security platform that gives enterprises visibility into every agent across devices, browsers and cloud workloads, and control over what those agents do in real time. KnowBe4 sells attack simulation and training, email and collaboration security, and agent security through the KnowBe4 Platform. CISO Tribune files both under AI model and agent security. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Bay
  • KnowBe4
Bay vs KnowBe4: Products, Customers and Funding Compared
BayBay is an AI agent security platform that gives enterprises visibility into every agent across devices, browsers and cloud workloads, and control over what those agents do in real time.bay.ioKnowBe4KnowBe4 sells attack simulation and training, email and collaboration security, and agent security through the KnowBe4 Platform.knowbe4.com
What it sells
  • Bay[1][2][3][4][5][6][7][8][9]Bay is an AI agent security platform covering agents on devices, in browsers and in cloud workloads. Bay returns allow, ask, steer or block decisions on agent actions at runtime.
  • Lighthouse[6]Lighthouse is Bay's embedded agentic system that drafts policy from an organization's own agent activity.
  • Wave[3]Wave is the ephemeral binary Bay uses to deploy through an existing MDM or EDR.
  • Security Awareness Training[4][5][7]Education on recognizing threats, reinforced with phishing and vishing simulations.
  • Cloud Email Security[10]A suite of AI-driven products for inbound and outbound email.
  • Defend[1][4][5][6][10][11]Inbound email protection against phishing, ransomware and business email compromise.
  • Prevent[5][10][12]Outbound email protection and data loss prevention.
  • Compliance Plus[13]Compliance training platform.
  • Student Edition[5]Security awareness training for academic institutions.
  • BreachSim[14]A free tool to identify network vulnerabilities.
  • Weak Password Test[15]A free tool that finds users with weak passwords.
Categories
Headquarters
Not stated on its pagesClearwater, United States
Founded
Not stated on its pages2010[1]
Ownership and funding
Not stated on its pagesOwned by Vista Equity Partners since 2023[2][4][8][9]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pages
  • May 5, 2026KnowBe4 launched a two-tier Security Awareness Training offering and a new AI defense agent for custom content creation.[7]
  • April 6, 2026Dashlane announced an integration with KnowBe4 that links credential risk detection to security training for at-risk users.[18]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 4, 2026[8]
  • Gartner Peer Insights: listed, seen November 4, 2026[9]
Who it fits
Not written yetNot written yet
Last verified
November 5, 2026September 27, 2026

Where they overlap

  • Bay and KnowBe4 are both filed under AI model and agent security.

Where they differ, field by field

  • Bay's primary category is AI model and agent security; KnowBe4's is Security awareness training.
  • Bay is also filed under Endpoint management and application control and Workforce AI usage security. KnowBe4 is also filed under Human risk management and Email security.
  • Bay lists Bay, Lighthouse and Wave. KnowBe4 lists Security Awareness Training, Cloud Email Security, Defend, Prevent, Compliance Plus and 3 more.
  • KnowBe4 is headquartered in Clearwater, United States.
  • KnowBe4 was founded in 2010.
  • KnowBe4 is owned by Vista Equity Partners, since 2023.

What it sells: Bay

What Bay does[1][2][3][4][5][6][7][8][9]
Bay maps every agent, MCP server, extension, model and skill on devices on its first scan. Bay builds a contextual entity graph of the users, MCP servers, SaaS apps and access connected to each agent. Bay deploys with one script through an existing MDM and does not require a proxy. Bay keeps full transcripts of prompts, actions and MCP calls.
What Lighthouse does[6]
Lighthouse drafts policy from an organization's own agent activity. Users answer 7 questions about risk appetite, and Lighthouse recommends a setting for each question and builds the policy. Bay replays 30 days of agent history to show what a policy would do before enforcement.
What Wave does[3]
Bay is agentless and deploys through an existing MDM or EDR using Wave, an ephemeral binary. There is no persistent agent to maintain and no proxy in the path.

What it sells: KnowBe4

What Security Awareness Training does[4][5][7]
KnowBe4 says it delivers timely, personalized education that helps people recognize threats. Lessons are reinforced with realistic phishing and vishing simulations.
What Cloud Email Security does[10]
KnowBe4 Cloud Email Security is a suite of AI-driven products designed to detect and prevent advanced email threats across inbound and outbound communication. Contextual banners and prompts are delivered at the point of risk.
What Defend does[1][4][5][6][10][11]
Defend detects and blocks phishing, ransomware and business email compromise with behavioral AI and self-learning threat models. Defend inserts color-coded banners on flagged email and rewrites links, checking them at time of click. Defend integrates with Microsoft Defender for Office 365 through API-based connectivity.
What Prevent does[5][10][12]
Prevent monitors outbound email in real time and alerts users to risky behavior, such as accidental sends or misdirected emails. Prevent is integrated with Microsoft Outlook and Office 365. Prevent Enterprise adds misdirected content detection and custom DLP policies.
What Compliance Plus does[13]
Compliance Plus has a training library of 1000+ items of compliance training content. Compliance Plus offers targeted training for requirements such as HIPAA, PCI and GDPR. Organizations can upload SCORM-compliant content to the KnowBe4 LMS.
What Student Edition does[5]
The KnowBe4 Student Edition enables academic institutions to prepare students to identify and prevent modern cyberattacks. Its training content covers phishing, BYOD risks, password hygiene, social media risks and campus scams.
What BreachSim does[14]
BreachSim is a free tool from KnowBe4 to identify network vulnerabilities. BreachSim tests over 12 realistic data exfiltration scenarios following the MITRE ATT&CK framework.
What Weak Password Test does[15]
The Weak Password Test is a free tool to help IT Administrators know which users have passwords that are easily guessed. It checks the Active Directory and generates a report of users with weak passwords.

Questions about Bay and KnowBe4

What do Bay and KnowBe4 sell?
Bay sells Bay, Lighthouse and Wave. KnowBe4 sells Security Awareness Training, Cloud Email Security, Defend, Prevent, Compliance Plus and 3 more.
Are Bay and KnowBe4 in the same category?
They share AI model and agent security. Bay's primary category is AI model and agent security and KnowBe4's is Security awareness training.
Where are Bay and KnowBe4 headquartered?
KnowBe4 is headquartered in Clearwater, United States.
When were Bay and KnowBe4 founded?
KnowBe4 was founded in 2010.
Who owns Bay and KnowBe4?
KnowBe4 is owned by Vista Equity Partners, since 2023.
What have Bay and KnowBe4 announced recently?
May 5, 2026: KnowBe4 launched a two-tier Security Awareness Training offering and a new AI defense agent for custom content creation.

About Bay

Bay is an AI agent security platform that gives enterprises visibility into every agent across devices, browsers and cloud workloads, and control over what those agents do in real time. Bay describes AI endpoint security as protection for the AI agents, coding assistants and MCP servers running on employee devices. Bay was founded by three engineers who spent their careers in endpoint and API security. Bay is a Series A stage company.[2][3]

Teams run agents like Claude Code, Codex, Gemini CLI and GitHub Copilot in clusters, cloud workspaces and hosted sessions.[5]

Bay finds and maps agents first. On the first scan, Bay maps every agent, MCP server, extension, model and skill on devices, including ones nobody approved. Bay finds every agent, extension, CLI tool, MCP server, skill and model on employee devices. Bay builds a contextual entity graph of how everything connects: the user behind each agent, the MCP servers and SaaS apps it touches, and the access it holds. Bay scans every agent, package, extension, MCP server and skill for malicious indicators before approval. In the browser, Bay brings shadow AI into view, covering chatbots, extensions and embedded SaaS agents. In cloud environments, Bay discovers agents across virtual machines, Kubernetes, Coder workspaces and hosted sessions.[1][3][5][6][7]

Lighthouse, Bay's embedded agentic system, drafts policy from an organization's own agent activity. Users answer 7 questions about risk appetite, and Lighthouse recommends a setting for each question and builds the policy. Policies can be scoped by IdP group, device or runtime, and can set which MCP servers can read or write. Before enforcement, Bay replays 30 days of agent history to show what a policy would do before any user is affected. Bay also lets teams run any policy in simulation mode to see what it would allow, ask or block. At runtime, Bay enforces guardrails inline with the agentic action and returns allow, ask, steer or block in milliseconds. Bay can also prevent prompt injection attempts at runtime.[6]

Bay keeps records of agent activity. Bay keeps full transcripts of prompts, actions and MCP calls, traceable to the person behind each session. A metadata-only mode in Bay keeps prompts on the device when they must not leave it. Bay ties every prompt and agent action to a real identity, corporate or personal. Bay logs every policy change and agent action with who approved it and whether a person or an agent took it. Every decision in Bay is logged against the policy behind it, ready for auditors. Bay connects to an identity provider, so every policy applies to the right people and groups.[5][6][7][8]

Bay also checks configuration. Bay checks how every agent and AI tool is set up, across devices and cloud workloads, so risky settings can be fixed before an agent puts them to use. Bay spots bypass-permissions mode, sandboxes switched off and unrestricted tool access, rates how serious each one is and shows how to fix it. Bay finds the credentials, tokens and secrets that agents and MCP servers can read.[9]

Bay deploys with one script through an existing MDM and does not require a proxy to route traffic through. Bay deploys through an existing MDM or EDR using Wave, an ephemeral binary, so there is no persistent agent to maintain. Bay tells corporate AI accounts from personal ones, including in personal Chrome profiles. Bay's enterprise customers include Micron Technology, Peloton and ClickUp.[1][2][3][6][7][8]

Bay on the record

Sources

Bay full record

  1. [1]bay.ioBay · bay.io · undated page, accessed November 5, 2026 · Tier A
  2. [2]Security Researcher — Careers at BayBay · undated page, accessed November 10, 2026 · Tier A
  3. [3]AI Endpoint Security — BayBay · undated page, accessed November 10, 2026 · Tier A
  4. [4]About — BayBay · undated page, accessed November 10, 2026 · Tier A
  5. [5]Cloud Workspaces — BayBay · undated page, accessed November 10, 2026 · Tier A
  6. [6]Platform — BayBay · undated page, accessed November 10, 2026 · Tier A
  7. [7]Browser — BayBay · undated page, accessed November 10, 2026 · Tier A
  8. [8]AI Governance & Compliance — BayBay · undated page, accessed November 10, 2026 · Tier A
  9. [9]AI Security Posture — BayBay · undated page, accessed November 10, 2026 · Tier A

KnowBe4 full record

  1. [1]About usKnowBe4 · knowbe4.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Vista equity partners completes acquisition of knowbe4KnowBe4 · knowbe4.com · published February 1, 2023 · Tier A
  3. [3]Contact usKnowBe4 · knowbe4.com · undated page, accessed September 27, 2026 · Tier A
  4. [4]KnowBe4 | Secure Your Digital Workforce: Human + AIKnowBe4 · undated page, accessed October 26, 2026 · Tier A
  5. [5]KnowBe4 Student Edition | KnowBe4KnowBe4 · undated page, accessed October 26, 2026 · Tier A
  6. [6]Warning: Attackers Are Using Calendar Invite Files to Evade Security FiltersKnowBe4 · undated page, accessed October 26, 2026 · Tier A
  7. [7]KnowBe4 Launches AI-Native Attack Simulation & Training Product and Twelfth AI AgentBusiness Wire · published May 5, 2026 · Tier A
  8. [8]KnowBe4 Security Awareness Training Reviews 2026 - G2G2 · undated page, accessed October 26, 2026 · Tier C
  9. [9]KnowBe4 Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed October 26, 2026 · Tier C
  10. [10]Cloud Email Security for Microsoft 365 | KnowBe4KnowBe4 · undated page, accessed November 4, 2026 · Tier A
  11. [11]Pricing | DefendKnowBe4 · undated page, accessed November 4, 2026 · Tier A
  12. [12]Pricing | Prevent | KnowBe4KnowBe4 · undated page, accessed November 4, 2026 · Tier A
  13. [13]Compliance Plus: Compliance Training Platform | KnowBe4KnowBe4 · undated page, accessed November 4, 2026 · Tier A
  14. [14]BreachSim | KnowBe4KnowBe4 · undated page, accessed November 4, 2026 · Tier A
  15. [15]Weak Password Test | KnowBe4KnowBe4 · undated page, accessed November 4, 2026 · Tier A
  16. [16]Security Culture Report Analysis Center | KnowBe4KnowBe4 · undated page, accessed November 4, 2026 · Tier A
  17. [17]KnowBe4 Customer Success | KnowBe4KnowBe4 · undated page, accessed November 4, 2026 · Tier A
  18. [18]Dashlane Launches First-of-its-Kind Integration with KnowBe4 to Transform Security Awareness into Proactive DefensePR Newswire · published April 6, 2026 · Tier A

Spot a factual error? Request a correction.