Human Risk Management
How the Kinds Security platform automates security awareness training for MSPs and lean IT teams.
Kinds Security Team
•
Last reviewed
How the Kinds Security platform automates security awareness training for MSPs and lean IT teams.
Kinds automates security awareness training end to end through a public API. A new client goes from a signed agreement in your PSA to running training and phishing simulations without anyone opening a console. Rosters stay current on their own. Audit evidence generates on request. And your own AI assistant can operate the platform in plain language through the Kinds MCP server.
What can you actually automate in a SAT program?
Most of it. Not the judgment, but nearly all of the assembly.
Run through what a SAT program costs you in a month and it’s rarely the training. It’s the labor around it.
The job | How it usually goes | Automated |
|---|---|---|
Onboarding a new client | Create tenant, invite users, pick curriculum, build campaign, schedule it. An hour if nothing goes wrong. | One workflow. No console. |
Keeping the roster accurate | Someone notices a leaver still has assignments. Eventually. | Directory sync on your schedule, with a diff you can review |
Getting simulations delivered | Email the client, ask for an allowlist, wait three weeks, follow up | Nothing to allowlist |
Chasing non-completers | Export, sort, email, repeat | Reminders fire at each learner’s local 9am |
Audit prep | Export raw data, reformat for the framework, assemble per-employee logs | One request returns the finished PDF |
Seat reconciliation | Nobody does it, so you eat the difference | A monthly check against your PSA records |
Every one of those is a call against the Kinds API at api.kindssecurity.com, documented in an OpenAPI spec you can point Rewst, n8n, Power Automate, or a code generator at. But the endpoint list isn’t the interesting part. What you can stop doing is.
Zero-touch client onboarding
This is the one that changes an MSP’s economics.
A client signs. Your PSA fires a workflow. The workflow creates the Kinds tenant with its compliance frameworks and training cadence, connects the client’s Entra ID, Google Workspace, or Okta directory, pulls every user in, enrolls them in workshops and phishing simulations, and hands the client’s own IT lead a read-only login scoped to their tenant and nothing else.
Five calls. Nobody touched a screen.
Enrollment isn’t a flag that waits for next month’s cycle. The first workshop assigns immediately. A client who signs on the 20th isn’t sitting idle until the 15th of next month, and new hires who join in week three get caught by the same logic on their first sync.
Set the tenant’s compliance frameworks and the curriculum assembles itself. Kinds supports thirteen, including HIPAA, SOC 2, ISO 27001, PCI DSS, CMMC, NIST CSF, GLBA, and Texas DIR. The scheduler pulls every workshop mapped to that client’s frameworks, orders them, and fills the remaining cadence with core material. Nobody picks modules from a library of a thousand. Nobody maintains a per-client curriculum spreadsheet.
Your directory already knows what to phish them with
A directory connection gives Kinds more than a user list. Each sync reads assigned licenses, service plans, OAuth app assignments, group membership, and manager relationships, then normalizes the app data into a shared vocabulary: Outlook, SharePoint, Teams, Gmail, Drive, Slack, Zoom, Salesforce, GitHub, Workday, ServiceNow.
That list is what makes a simulation land.
Each learner’s template gets picked one of three ways. If they’re licensed for a service, they can get a template impersonating that service. If their manager or job title is known, they can get a template that uses the real name and targets their actual role. Otherwise they get a general template. A controller gets an invoice fraud attempt from the person they report to. A developer gets something dressed as GitHub. Not a generic “IT Department” email that everyone in the company forwards to each other by lunchtime.
Matching is word-boundary aware, so a target of “microsoft 365” catches “microsoft 365 business premium” while a short target like “ad” needs an exact match instead of false-positiving on “adp”. Small thing. Also what separates real targeting from theater.
Sync runs when you call it, which is the right default for automation. Stagger 200 tenants overnight, or sync one the moment your RMM sees an onboarding ticket close. The response comes back as a reconcilable diff, added and removed with a reason per user, so a workflow can post the delta into a ticket for approval instead of applying changes blind.
Stop asking clients to allowlist your phishing sender
Kinds writes simulations directly into the mailbox through the Microsoft Graph API or the Gmail API. The message appears in the inbox with a realistic received time, unread, not as a draft.
There is no sending domain to allowlist. No transport rule. No SEG exception. No email to a client’s IT team asking them to whitelist a range.
If you run SAT across dozens of clients, this is the single biggest operational tax in the category, and nobody talks about it in a demo.
The permissions are worth stating plainly, starting with the one that matters most.
Open detection on Google runs on gmail.metadata. Wider scopes exist and would have been easier to build against: gmail.readonly returns every message in full, gmail.modify returns them and lets you change them. Kinds asks for neither. gmail.metadata cannot return a message body at all, and that limit is enforced by Google rather than promised by a vendor. Answering “did this learner open the simulation” takes one label. Delivery is the same shape: gmail.insert places a message and cannot read one.
Microsoft has no equivalent split. Graph ships no write-only mail scope, so Mail.ReadWrite is the only way to place a message, and the read half comes attached whether anyone wants it or not. What Kinds does with it is narrower than what it grants. Kinds creates one message and keeps its ID. Every call after that is keyed to that ID and asks for exactly one field: read or unread. No bodies, no headers, no attachments, no other messages, no mailbox listing. If a learner deletes the simulation, the next poll returns a 404 and Kinds stops.
The read flag is also why Kinds doesn’t use tracking pixels. Outlook and Gmail proxy and prefetch images through their own servers, which can fire a pixel before the recipient has opened anything. Mailbox read state can’t be flipped by a scanner, a link rewriter, or a preview pane. An open means a person opened it. Six outcomes get tracked: delivered, opened, clicked, phished, reported, and resisted. A seventh, recovered, fires when someone who clicked later reports the same simulation, which is the only one that tells you the training worked.
A risk score you can build a workflow on
Every learner action writes a score event in Kinds. Workshop completions, phishing outcomes, onboarding. Those roll into a per-learner Aware Score, then into an organization average, recalculated nightly.
Score | Grade | Label |
|---|---|---|
90 to 100 | A | Secure |
80 to 89 | B | Low risk |
70 to 79 | C | Risky |
60 to 69 | D | Vulnerable |
Below 60 | F | Critical |
The number matters less than the fact that it’s addressable. Subscribe to a threshold-crossing event and remediation starts within seconds of a click: assign a follow-up workshop, open a PSA ticket, post to the client’s Teams or Slack channel. Not at 2am when the nightly job runs.
The same number fills the QBR slide. Account-level rollups return your top four and bottom four tenants by completion rate in a single call, so the “which clients need attention” question is a query, not an afternoon.
The audit pack builds itself
Frameworks in, evidence out.
One request to Kinds returns a finished PDF: summary metrics, requirements coverage mapping each workshop to the framework’s clause code with a covered or not-covered verdict, attestation language for that framework, a per-employee training log with dates, duration, score, and status, and optional phishing results per person.
The attestation text cites real sections. 45 CFR §164.308(a)(5) for HIPAA. ISO/IEC 27001:2022 Annex A.6.3. CMMC AT.L2-3.2.1 and 3.2.2. PCI DSS 12.6. SOC 2 CC2.2. GLBA Safeguards under 16 CFR Part 314.
Each report carries a SHA-256 integrity hash over the underlying data and a deterministic report ID, so the document is tamper-evident. An auditor can confirm the PDF matches the data it was built from. Unglamorous, and often the real purchase reason for regulated buyers.
One PDF per request, so a fleet-wide pack is a loop in your workflow at month end.
Can you pull usage data and reports through the API?
Yes. Usually the first three things anyone asks for.
Usage. Account-level rollups return enrolled organizations, completion and past-due rates per tenant, and learner-level results across every client in one query rather than one call per tenant.
Billable seats. Active learner counts broken out per organization, alongside the current subscription and its quantity. Run it monthly against your PSA’s agreement records and you close the gap between what you’re billed for and what you bill for. Almost nobody checks by hand, which is why almost everybody loses a little money to it.
Monthly reports. One request per client returns the finished PDF, so a month-end loop across your tenant list produces the whole pack without a console login or a CSV export.
Where the AI part comes in
Two places, and they do different jobs.
One instruction, every tenant. Learners stuck mid-workshop can ask the in-workshop Kinds assistant for help. You control what it’s allowed to tell them, through a guidance field on your account settings that every client underneath inherits. Write “we deploy Okta, not Microsoft SSO, so never tell a learner to reset a password in Entra” once, and every answer across every client respects it. A specific tenant can override it where their setup differs.
For an MSP with 60 clients on a mix of stacks, that’s the difference between an assistant that helps and one that generates tickets.
Ask your assistant about your security posture. Connect the Kinds MCP server to Claude, Copilot, or Cursor with an API key and ask in plain language: which clients are below 70% completion this quarter, or onboard Acme with HIPAA and SOC 2 on a monthly cadence.
Two things make that work rather than demo well. It’s a thin client over the same public API your Rewst workflow uses, so an MCP call carries identical permissions, tenant isolation, and audit trail. And the tool set is curated at roughly two dozen covering what admins actually do, rather than one tool per endpoint. Large tool sets crowd an assistant’s context and make selection less reliable, so two dozen tools that get picked correctly beat two hundred that don’t.
Read tools run freely, write tools respect the key’s permission. So a read-only key gives an assistant complete visibility into your fleet and zero ability to change anything. For a cautious enterprise, that’s the version to start with.
What automation doesn’t fix
Automation removes assembly, not judgment. A program that runs itself and that nobody has reviewed in a year is a compliance artifact, not a security control. Worth a quarterly look: whether the curriculum still matches the client’s risk profile, whether simulation difficulty is calibrated or just producing a flat click rate, and whether anyone is acting on the learners sitting at the bottom of the distribution.
Directory access is a real requirement. Mailbox injection needs mailbox permissions. Kinds doesn’t serve tenants that won’t grant them, and there’s no lesser delivery path to fall back to.
Some of this needs an orchestrator. The API is only as automated as the thing calling it. If you don’t already run Rewst, n8n, Power Automate, or equivalent, you’re adding a tool to your stack. The scheduled behavior inside the platform runs regardless, but the PSA-to-provisioning loop is yours to build.
Frequently asked questions
Do I need a developer to automate SAT?
For the scheduled parts, no. Cadence, reminders, assignment, campaign sending, and manager digests all run without anything on your side. For the PSA-triggered parts, you need something to call the API. If you already run an orchestrator, this is workflow configuration rather than code. If you don’t, budget a day of someone technical to stand up the onboarding workflow, then almost nothing after that.
Can I automate SAT without connecting a directory?
Partly. CSV import covers roster loading and accepts the same fields, including manager email, job title, timezone, and app list. What you give up is the roster staying accurate without anyone maintaining it, and the license and app data that drives simulation targeting. It works. It just means someone owns the file, which is the exact administrative burden automation is supposed to remove.
Is an MCP server useful, or is it just a demo?
Depends what you ask it. Good for ad-hoc questions across a fleet and for multi-step work you’d otherwise chain by hand. Worse than a scheduled workflow for anything recurring: a cron job is deterministic, an assistant isn’t. Use it for exploration and the API for anything that has to happen the same way every night.
Does automated training actually work as well as a hands-on program?
A well-run manual program, with someone selecting role-appropriate content and following up personally, will likely beat an automated one. The catch is that almost nobody runs that program. Most teams buy a platform, configure it once, and underuse it from there. The honest comparison isn’t automated versus ideal. It’s automated versus what’s actually happening in your tenants right now.
Most platforms in this category hand you a console and call that the product. The work of running the program stays with you: the onboarding clicks, the roster upkeep, the campaign builder, the export-and-reformat before every audit. An API doesn’t make that work faster. It makes it nobody’s.
Set it up once, then done.
You don’t have a training problem. You have a platform problem.
This post describes technical capabilities, not legal guidance. Compliance obligations vary by organization and jurisdiction. Consult your own counsel or auditor for how a framework applies to you.
Related reading
Sources
Kinds Security documentation (first-party, for platform behavior)
Kinds Security API Reference and OpenAPI specification
Kinds Security Microsoft Permissions and Provider Sync Guide
Kinds Security Google Workspace Permissions and Provider Sync Guide
Kinds Security Compliance Report and Verification Guide
Kinds Security MCP Server Documentation
Platform documentation
Gmail API authorization scopes, Google for Developers
Restricted scopes, Google Cloud Platform Console Help
Microsoft Graph permissions reference, Microsoft Learn
Overview of Microsoft Graph permissions, Microsoft Learn
Regulations and standards
45 CFR Part 164 Subpart C, HIPAA Security Rule, including §164.308(a)(5) on security awareness and training
2017 Trust Services Criteria (with revised points of focus, 2022), AICPA
