Safeguard configuration

Safeguards are the user-facing responses when a policy is triggered. They range from subtle notifications to full page blocks, providing real-time security awareness and enforcement.

What is a safeguard?

A safeguard can:

• Block access to dangerous sites
• Warn users about potential risks
• Require confirmation before proceeding
• Provide security education in the moment
• Allow users to report suspicious content or request access

Every policy can have its own safeguard configuration, or you can use shared safeguard templates.

User actions

User actions define how the safeguard affects the user's ability to continue:

Notify user (Notice)

Displays a notification without blocking activity. The user can continue browsing while being informed of the policy match.

Use cases:

• Security awareness education
• Informational alerts
• Low-risk policy matches

Pause user (Pause)

Creates friction by requiring the user to acknowledge before continuing. Does not fully block the activity.

Use cases:

• Confirm business justification
• Acknowledge risky behavior
• Require explicit consent

Restrict user (Restrict)

Prevents the user from continuing the activity. May allow requesting access or reporting.

Use cases:

• Block malicious sites
• Prevent data exfiltration
• Enforce strict access policies

Reinforce user (Reinforce)

Provides positive reinforcement on trusted or verified sites. Confirms the user is on a legitimate page.

Use cases:

• Indicate verified login pages
• Confirm legitimate corporate resources
• Build security awareness for trusted sites

Obstruct user (Obstruct)

Visually obstructs page content with a watermark. Must be paired with the Watermark safeguard style.

Use cases:

• Mark sensitive content
• Deter unauthorized screenshots
• Indicate protected information

Safeguard styles

Styles determine how the safeguard is displayed to the user:

Preview	Style	Description	Works with
	Redirect	Redirects the user away from the page entirely. Opens a new tab with the safeguard content while blocking access to the original page.	Page Visit
	Page block	A full-page overlay that blocks access to the page content. User must interact before the page becomes accessible.	Page Visit
	Modal	A centered dialog that appears over the page content. User must interact before continuing.	Page Visit
	Card	A small notification card displayed in a corner of the browser. Less intrusive than a modal.	Upload, Download, Input, Copy, Paste
	Tooltip	A small notification that appears near the user's cursor or input field. Ideal for contextual warnings.	Input, Copy, Paste
	Watermark	Displays a text watermark across the page content. Used to mark sensitive content or deter screenshots.	Page Visit

Action buttons

Safeguards can include action buttons for user interaction:

Button	Description
Dismiss	Allows the user to dismiss the safeguard and continue
Close	Closes the current tab (included by default)
Learn	Links to more information about the policy or threat
Request	Allows the user to request access to the blocked location
Report	Allows the user to report the page as suspicious or safe

Safeguard variables

Make safeguards contextual by using variables that are replaced with actual values:

Variable	Description
{{callToAction}}	Custom call-to-action text (e.g., contact helpdesk)
{{requestTitle}}	Title for access request submissions
{{requestMessage}}	Message shown after submitting an access request

Configure these variables in Policy > Safeguards > Settings.

Creating safeguards

Using default safeguards

Keep Aware provides default safeguards for common scenarios:

• Default Page Block
• Default Policy Notice
• Default Tooltip
• Default Extension Notice
• Default Connection Block
• Default On-Page Action

To use a default safeguard, select it from the safeguard dropdown in the policy editor.

Creating custom safeguards

To create a reusable custom safeguard:

1. Navigate to Safeguards in the console
2. Click Create safeguard
3. Configure:
   • Name — Identifier for the safeguard
   • User Action — How it affects user behavior
   • Style — How it displays
   • Messages — Title, description, learn more content
   • Buttons — Which action buttons to include
   • Branding — Colors and styling
4. Click Save

The safeguard will then be available for selection in all policies.

Global safeguard settings

Configure organization-wide safeguard settings in Policy > Safeguards (click Settings):

Branding

• Organization Name — Displayed in safeguard headers
• Logo — Your organization's logo
• Icon — Favicon or small icon

Default messages

• Call to Action — Default CTA text (e.g., "Contact IT Security")
• Request Title — Default access request title
• Request Message — Default access request confirmation

Safeguard cooldown

Each safeguard can have its own cooldown period, controlling how frequently it displays to the same user for the same policy.

Example: A 60-second cooldown means the safeguard won't appear again for that user/policy combination for 60 seconds.

This is separate from the policy-level cooldown, which controls integration and threat creation frequency.

Matching safeguards to activities

Not all safeguard styles work with all activity types:

Activity	Available Styles
Page Visit	Redirect, Modal, Watermark
Upload	Card
Download	Card
Input	Card, Tooltip
Credential Use	Card, Tooltip
Copy	Card, Tooltip
Paste	Card, Tooltip

The policy editor automatically filters available safeguards based on selected activities.

Best practices

1. Match severity to response — Use Restrict for high-risk threats, Notice for awareness

2. Provide context — Include helpful messages explaining why the safeguard appeared

3. Enable Request Access — For Restrict safeguards, allow users to request exceptions

4. Use branding — Custom logos and colors increase trust and recognition

5. Test safeguards — Use the Preview feature to see how safeguards will appear

6. Consider user experience — Too many intrusive safeguards can cause alert fatigue

Example configurations

Phishing block

• Action: Restrict
• Style: Redirect
• Buttons: Close, Report
• Message: "This page has been identified as a phishing attempt. For your security, access has been blocked."

Upload warning

• Action: Pause
• Style: Card
• Buttons: Dismiss, Learn
• Message: "You're uploading a file to an external site. Please confirm this is for business purposes."

Security awareness tooltip

• Action: Notice
• Style: Tooltip
• Buttons: Dismiss
• Message: "Be cautious when entering credentials. Verify you're on the correct site."