KnowBe4 incident
PhishML Evaluations Causing PML:BYPASSED Tags to Apply
KnowBe4 experienced a minor incident on June 30, 2026 affecting PhishML, lasting 4h 53m. The incident has been resolved; the full update timeline is below.
Affected components
Update timeline
- investigating Jun 30, 2026, 02:18 PM UTC
We have identified an issue where PhishML evaluations are causing the "PML:BYPASSED" tag to be applied.
- monitoring Jun 30, 2026, 03:42 PM UTC
We’ve implemented a fix for PhishER and we’re monitoring the results to make sure no further issues occur. Impacted messages can be replayed through all rules and actions. Please be aware this could cause duplicate responses to be sent if an action successfully ran during this incident. If you have further questions or concerns please contact our support team directly: https://support.knowbe4.com/hc/en-us/requests/new The following Knowledge Base Article contains instructions on how to replay messages: https://support.knowbe4.com/hc/en-us/articles/13169303385619-PhishER-Inbox-Guide#h_01HCNEBF8CJQ98GE9PGM7HGDZ0
- resolved Jun 30, 2026, 07:11 PM UTC
This incident has been resolved.
- postmortem Jul 22, 2026, 01:20 PM UTC
On Tuesday, June 30, 2026, from approximately 07:40 to 19:15 \(UTC\), customers experienced incorrect results from PhishER's PhishML scoring. Affected emails received a PML:BYPASSED tag instead of a legitimate PhishML classification, and confidence scores were missing from impacted messages. Rules and actions that depend on PhishML results also did not activate. This issue was caused by a code refactor introduced approximately two weeks earlier. This refactor introduced a faulty update that omitted essential drivers required for PhishML scoring to run. However, the issue remained dormant until another update triggered a new PhishML model deployment, which caused the scoring issue to emerge. To resolve this issue, our team rolled back to the last stable deployment and added more capacity to process the resulting backlog of email evaluations. PhishER's PhishML scoring returned to normal performance by 19:15 \(UTC\). To prevent this type of issue in the future, we have improved health checks by introducing a new endpoint for smoke testing new models before deployment.