Security Awareness Training That People Do Not Ignore
Every quote promises fewer clicks. What separates a program that changes behavior from a license nobody logs into is who runs the campaigns, what happens when somebody reports a real attack, and which of the work the contract quietly leaves with you.
Two providers quote for the same 180 employees. One is a per seat license for a content library and a phishing simulator, billed annually, with an admin login for whoever ends up owning it. The other costs roughly three times as much and includes a person who runs the campaigns, chases the staff who never finish, and arrives with a report every quarter. Both documents use the phrase security awareness training, and the phrase settles nothing.
Price is the least interesting part of that decision. The cheap option works only if a named person inside your company spends a few hours a month on it, and most companies that buy it never name that person. Eleven months later the license auto-renews, 62 percent of staff have finished the baseline module, nobody has opened a simulation result since March, and the auditor asks for completion evidence that does not exist in a form anyone can export.
This page is written for the person comparing quotes. It covers what the service includes, what it leaves on your desk, how the market splits into four recognizable shapes, what an engagement looks like from the scoping call to the first renewal, and which contract terms decide whether the year was worth paying for.
What Is Security Awareness Training?
Security awareness training is security education bought as a subscription: a library of short lessons, a system that sends fake attacks to your staff to see who falls for them, and a record of who completed what. It is sold per employee per year, usually on a twelve month term, and it is the cheapest line item on most security budgets.
What you are renting comes in four parts, and providers are rarely equally good at all four.
Content. The modules themselves. Length, tone, translation coverage, accessibility, and how often they are refreshed when attacks change.
Simulation. The infrastructure that sends test phishing emails, text messages and in some cases voice calls, records who clicked, and shows the person a coaching page at the moment they did.
Program management. Somebody deciding what runs when, writing the launch note, chasing the people who ignore the first three reminders, and presenting results to a leadership team. This is the part that decides whether the other three matter.
Evidence. Exportable completion records and campaign history in the form an auditor or a cyber insurer will accept.
The market has since renamed itself, and now sells the same subscription as human risk management, security behavior programs, or human layer defense. The renaming widened what vendors claim to cover without changing much of what ships. NIST went the other way. Its September 2024 rewrite of the standard, Building a Cybersecurity and Privacy Learning Program, deliberately dropped the older separation of awareness, training and education because the terms were being applied inconsistently across organizations. What matters is not the label on the invoice but whether the program has an owner, a plan and a measurement, which is the same test the document applies to a federal agency.
What Security Awareness Training Includes
Scope varies by provider and by tier, but a normal program contains five blocks of work. A quote that does not clearly show all five is a quote you cannot compare against another one.
The baseline curriculum. One longer module, typically 20 to 45 minutes, assigned at hire and once a year after that. It covers how a phishing attack is built, passwords and multi-factor authentication, handling customer data, devices and remote work, physical security, and how to report something suspicious. Compliance-mapped versions exist for HIPAA, PCI and similar obligations, and they exist mostly so the completion record says the right words.
Continuous refreshers. Three to eight minute modules through the year, monthly or quarterly, on one topic each. The shift away from a single annual session is the one design change in the last decade that most of the market agrees on.
Simulations. At minimum, phishing emails sent to your staff on a schedule, with results by person, team and template difficulty. Better providers also run text message and voice call scenarios, which matters more than it used to.
The reporting workflow. A report button in Outlook or Gmail, the mailbox or queue it routes to, automatic triage that closes out simulated messages, and an answer for the employee who reported a real one. Most of the operational value of a program lives here, because a workforce that reports fast gives your responders the one thing they cannot buy, which is early warning. That queue also needs to connect to whatever your incident response plan says happens next.
Reporting and evidence. Dashboards for you, and exports for auditors, insurers and the board.
Two things sit outside that list but are commonly bundled at the top tier: policy attestation, where staff sign that they have read the acceptable use policy, and a phishing report button deployment across the estate, which needs your mail administrator regardless of who sells it.
What Security Awareness Training Does Not Cover
Training changes what a person does with a message. It does not touch the systems that let an attacker in without talking to anyone, and the current data makes that boundary sharp. Verizon's 2026 Data Breach Investigations Report found exploitation of vulnerabilities is now the most common initial access vector for breaches at 31 percent, with credential abuse down to 13 percent. The same report puts the human element in 62 percent of breaches, up from 60 percent, but the human element includes errors and misdeliveries no course prevents, and its presence in a breach is not the same as its being the way in.
Specifically, the subscription does not include:
- Fixing the help desk. Identity verification before a password or MFA reset is a written procedure and a staffing decision, not a module. It is also where the expensive intrusions of the past two years have started.
- Email authentication. SPF, DKIM and DMARC enforcement stop lookalike senders from reaching anyone. Providers will report that your domain is spoofable and leave the work with you.
- Multi-factor rollout. Phishing-resistant multi-factor authentication removes the value of a stolen password. Training tells people why it matters, then stops.
- Payment controls. The callback rule that defeats business email compromise is a finance process, owned by your controller.
- Tabletop exercises, secure code training for developers, and executive coaching. All three are usually separate line items, often from different suppliers.
- Liability. No provider indemnifies you for a breach that starts with a click, and none claims to.
Types of Security Awareness Training Providers
Five shapes of supplier sell this, and the difference between them is not content quality. It is who does the work.
Platform vendors sell the software. Their libraries are large, their integrations are the deepest, and their support ends at the product boundary.
Managed service providers and MSSPs bundle awareness training into a wider contract. Convenient, usually white labeled from one of the platform vendors, and priced inside a bundle you cannot itemize. Ask whose content it is and who answers when an employee reports a genuine attack, because a bundled program that reports into the same team already running your managed security services is worth more than one that reports into a mailbox nobody owns.
Human risk management specialists sell the managed version: campaign design, behavior change goals, per person risk scoring and a named program manager.
Consultancies build custom content, run in-person sessions, train finance teams on payment fraud specifically, and work on culture. Priced by the day, and the right answer when your risk is concentrated in twelve people rather than spread across 900.
Do it yourself is a real option for small teams. CISA publishes free awareness videos and tip sheets in several languages, and NIST SP 800-50r1 is a program blueprint at no cost. What you give up is completion tracking, simulation infrastructure and the audit export, which is usually why companies stop doing it themselves.
| Shape | Who runs it | Typical fit | The catch |
|---|---|---|---|
| Platform license | You | Any size, with an internal owner | Dies quietly when the owner leaves |
| Bundled with an MSP or MSSP | Shared | Companies already outsourcing security | Hard to price, content rarely theirs |
| Managed program | Provider | 100 to 2,000 staff, no internal owner | Pays for labor, not better content |
| Consultancy | Provider, by the day | Concentrated risk, custom needs | No ongoing simulation unless bought separately |
| Free materials | You, entirely | Under about 25 staff | No tracking, no evidence, no simulation |
How a Security Awareness Training Engagement Works
The shape of the first year is consistent across the market. What differs is how much of it happens without you.
- Scoping call: seat count, departments, languages, who is in scope, which systems the provider will connect to, and who inside your company owns the program
- Technical setup. Directory sync so joiners and leavers flow automatically, mail routing rules so simulated messages arrive, the report button deployed, and a test campaign to a pilot group of five
- Baseline simulation, unannounced, at a difficulty that reflects real attacks rather than a warm-up. This number is the only honest comparison point you will get all year
- Launch communication from a leader, not from the vendor, followed by the baseline module assigned to everyone with a deadline and a manager view of who has not started
- First refresher module and first scheduled simulation cycle. Completion chasing begins, which is where a managed program starts to earn its price difference
- First real report: completion by department, click rate, report rate, median time to report, and the repeat clickers who need something other than another module
- Steady state. Monthly or quarterly content, simulations at rising difficulty, new joiners caught automatically by the directory sync, quarterly review with whoever owns risk
- Renewal decision, which is why the notice period in the contract matters. Ask for the full year export before you decide, not after
Your side of the engagement needs three people, even in the managed version. An owner with a few hours a month, who is usually in IT, operations or HR. A mail administrator for the first fortnight, to allow simulated senders and deploy the report button. And a senior person who sends the launch note, because a program introduced by the vendor gets read as marketing and a program introduced by the managing director gets read as a policy.
How Phishing Simulations Work
A simulation is a controlled version of a real attack, sent to your own staff. The point is not to catch people out. It is to find out how your workforce behaves under a specific pressure, and to give the person who fell for it a thirty second explanation while the mistake is still fresh.
The attacks worth simulating have shifted. The DBIR found that in phishing simulations, the median success rate for mobile-centric vectors such as voice and text messaging runs 40 percent higher than for email. Phishing stayed level at 16 percent of breaches, while pretexting, where an attacker builds a relationship through an invented scenario, reached 6 percent. A program that only ever sends emails is testing the channel your staff are best at.
- ResearchAttacker collects names, job titles and phone numbers from a leaked customer or staff dataset
- The callPoses as an employee locked out before a client meeting, urgent but polite, using real internal vocabulary
- The verificationHelp desk asks for date of birth and employee ID, both of which are in the leaked data
- The resetMulti-factor is re-enrolled to the attacker device, and the account is now legitimately theirs
- The callback ruleAgent instead calls the number in the HR record, the caller hangs up, and the attempt is reported in minutes
Three mechanics decide whether simulations help or hurt.
Difficulty tiers. A template every person spots teaches nothing, and a template nobody could spot teaches only that the exercise is unfair. Providers grade templates, and the grade should rise through the year.
Coaching at the click. The landing page a person reaches after clicking is the actual teaching moment. It should be short, name the specific tells in the message they just opened, and take under a minute. Some of the same tells are worth publishing internally alongside the signs that give a phishing email away, so people can check something before they act.
Rules on what a simulation may use. Fake bonus announcements, fake redundancy notices and fake payroll errors produce high click rates and lasting resentment. Several vendors still ship those templates. Agree the banned categories in writing before the first campaign, and put HR in the conversation.
How Security Awareness Training Providers Differ
Eight things separate two quotes that describe themselves identically.
Library depth and languages. Ask for the exact count of modules under five minutes, the languages with full voiceover rather than subtitles, and the refresh cadence. A library that lists 900 items and refreshes twelve a year is a back catalog.
Simulation breadth. Email only, or email plus text, voice and QR code scenarios. Ask which cost extra, because the ones matching current attacks are often the upsell.
Automation. Whether a click auto-enrolls the person into a follow-up module, whether difficulty adapts per person, and whether new joiners are assigned automatically from the directory sync or by somebody remembering.
Integrations. Single sign-on, automated user provisioning, Microsoft 365 or Google Workspace, your ticketing system, and your SIEM. Weak provisioning is the most common cause of a program drifting out of date, because the seat list stops matching the payroll.
Managed or software. Who writes the launch note, who chases the stragglers, who tunes the calendar. This is the single largest price driver in the market and the least visible one in a feature comparison.
Evidence quality. Ask to see a real audit export, not a dashboard screenshot. It should show every in-scope person, the date they completed each assignment, and the people who did not, over an arbitrary date range.
Risk scoring. Per person and per department scores are now standard. The question is whether the score can be explained to the person it describes, because an unexplainable score is unusable in a performance conversation and useless in a management report.
Pricing model. Per seat per year is the norm, but seat definitions vary, and the definition is where the money hides. Details are in the next section.
How Much Does Security Awareness Training Cost?
No independent price dataset exists for this market. Every published range traces back to a vendor describing its own list price, which is why this page gives you the structure rather than a number to plan against.
The structure is consistent. You pay per seat per year, tiered so the price per seat falls as the seat count rises, with a minimum seat count that catches small buyers. A managed program adds a labor fee on top, either a flat monthly amount or a bundled uplift on the per seat price. Custom content is quoted per module, in-person work by the day, and multi-year terms buy a discount in exchange for the escalator clause discussed below.
Four things make two quotes incomparable, and all four are worth asking about before you look at the totals.
- What counts as a seat. Every employee, every mailbox, every person in the directory including shared accounts and service accounts, or only staff in scope for the compliance obligation. The same 180 people can be quoted as 180, 214 or 260 seats.
- What is included versus metered. Simulation credits, extra languages, custom templates and additional admin logins are all commonly metered.
- Managed hours. If a program manager is included, the proposal should say how many hours a month and what they are spent on.
- The internal cost. NIST's guidance lists it plainly in its budget section: platform licenses per seat, learning management system costs, staff time, and materials. The staff time is the line most buyers leave out of the comparison and the one most likely to sink the cheaper option.
Read the first two numbers together. Training has a real and measurable association with lower breach costs, and it sits in the middle of the pack rather than at the top. That is the honest case for buying it: a cheap control with a modest, durable effect, not a substitute for identity and access work.
Security Awareness Training Compliance Requirements
For many buyers the trigger is not risk but an obligation, and the obligations are specific about training in a way they are not about most controls.
The FTC Safeguards Rule, which covers a much wider set of non-bank financial institutions than most companies realize, makes it element (e) of the required program. The FTC's own guidance says to provide your people with security awareness training and schedule regular refreshers, plus specialized training for staff with hands-on responsibility for the security program.
The NIST Cybersecurity Framework 2.0 splits the same idea in two. PR.AT-01 covers all personnel being given the knowledge and skills to perform general tasks with cybersecurity risks in mind. PR.AT-02 covers individuals in specialized roles. If your customers assess you against the framework, expect both to be asked about separately.
Questions to Ask Before Signing a Security Awareness Training Contract
Take these to two providers. The answers separate the market faster than any feature grid.
Security Awareness Training Contract Terms That Matter
Awareness training contracts are short, and that is exactly why the defaults sit where the vendor wants them. Nine terms are worth the redline.
Term, notice and auto-renewal. Twelve months with a 30 to 90 day notice window is standard, and the window usually opens before your first full year of data exists. Diary the date the week you sign.
Seat counting and true-up. Agree what a seat is, when the count is measured, and what happens mid term when you grow. Some contracts true-up upward automatically and never downward.
Price escalators. Multi-year deals carry a percentage uplift per renewal year. It is negotiable and it compounds.
Data ownership and retention. Simulation results are records of your employees failing tests. Say in writing that the data is yours, that the provider deletes it within a stated period after termination, and that it is not used to train models or feed benchmark products without your agreement.
Employee privacy obligations. Per person results are personal data. In several jurisdictions, and under some union or works council agreements, individually identified phishing results require consultation before the first campaign. Check with HR before the launch note, not after the first complaint.
Simulation authorization. The contract needs your written permission for the provider to send deceptive messages to your staff, and it should name the sending domains, cap the volume and give you a kill switch for a campaign already in flight.
Brand impersonation limits. Simulations that copy real vendor branding are effective and carry trademark questions. Providers who take this seriously use their own lookalike brands for the risky cases, and will say so.
Content update commitment. A stated cadence for new and refreshed modules, so the library does not age past the attacks.
Exit. Full export of completion records and campaign history in a documented format, available for a stated window after the contract ends, plus removal of the report button and the mail rules. Ask what the export looks like before you need it, because the auditor's request always arrives after the relationship ends.
How to Measure Security Awareness Training Effectiveness
Most programs are reported on click rate alone, which is the number easiest to move and easiest to fake. Difficulty is set by the vendor, so a program can improve its headline every quarter by sending gentler tests.
Four numbers survive scrutiny.
Report rate. The proportion of recipients who report a simulated attack, whether or not they clicked first. This is the metric that maps to a real defensive outcome, because a reported attack is one your responders learn about early.
Median time to report. Minutes from delivery to the first report. It falls faster than any other number when a program is working, and it is the number to put in front of a board.
Repeat clickers. The small group who fail repeatedly at rising difficulty. The answer for them is rarely another module. It is usually a technical control: tighter conditional access, blocked attachment types, or removal of a permission that makes their mistake expensive.
Completion, by department, with names. Unglamorous, and the one an auditor will actually ask for.
NIST draws a useful line between measurements, which are raw counts, and metrics, which compare those counts against a goal you set in advance. A dashboard full of counts with no target is a report nobody can act on, so agree the targets during scoping, while the provider is still selling.
Key takeaways
- Security awareness training is a per seat subscription covering content, simulations, a reporting workflow and completion evidence. Program management is what varies most in price and matters most in outcome.
- It does not fix the help desk procedure, email authentication, multi-factor rollout or payment controls, and vulnerability exploitation, the leading initial access vector at 31 percent of breaches, sits entirely outside its reach.
- The market splits into platform licenses, MSP bundles, managed programs, consultancies and free federal materials. The right one depends on whether anyone internal has been given the hours.
- Expect a heavy first fortnight for setup, an unannounced baseline simulation, then a steady calendar and a quarterly report. The renewal notice window usually opens before the first year of data is complete.
- Employee training was associated with breach costs USD 196,259 below the average in IBM's 2026 study, ninth of twelve cost-reducing factors. Real, modest, and not a substitute for identity work.
- Compare quotes on the seat definition, what is metered, managed hours included, and the internal time the cheaper option assumes.
- Measure report rate and median time to report, not click rate alone, and never attach a disciplinary consequence to a click.
Common questions
What is security awareness training?
It is security education bought as a subscription: short lessons assigned to staff, simulated phishing attacks that show who is vulnerable to what, a reporting workflow for genuine attacks, and completion records for auditors and insurers. It is sold per employee per year, most often on a twelve month term, and it is one of the cheapest controls on a security budget.
How often should security awareness training be done?
The market has settled on a longer baseline module at hire and once a year, short refreshers monthly or quarterly, and simulations at least monthly. Annual-only programs persist because a compliance obligation says annual, and they produce almost no measurable behavior change. If budget forces a choice, keep the simulations and the reporting workflow and shorten the modules.
How much does security awareness training cost per user?
No independent dataset exists, and every published range comes from a vendor quoting its own list price. What is knowable is the structure: per seat per year, tiered downward as seat count rises, with a minimum seat count, a labor uplift if the program is managed, and separate pricing for custom content and in-person work. Ask what counts as a seat before comparing any two totals.
Is security awareness training required by law?
For many organizations, yes, though rarely in the form of a specific curriculum. The FTC Safeguards Rule requires it as an element of the information security program for covered financial institutions. The HIPAA Security Rule requires a security awareness and training program for all workforce members. PCI DSS carries it inside its twelfth requirement. Most contractual obligations follow the same pattern: training must exist, be repeated, and be evidenced.
Does security awareness training actually reduce breaches?
The honest answer is that the evidence is mixed and the effect is real but modest. IBM's 2026 study associates employee training with breach costs about USD 196,000 below the average, ninth of twelve cost-reducing factors. Academic work consistently finds click rate improvements fade after a campaign ends, while reporting behavior holds up better. Buy it for the reporting habit and the evidence, and expect identity and patching work to move the risk more.
What topics should security awareness training cover?
Phishing in all its channels, passwords and multi-factor authentication, social engineering by phone and text, handling customer and employee data, device and remote working practice, physical security, and how to report something suspicious. Beyond that baseline, role-based content earns its place: payment verification for finance, help desk identity verification for IT support, and data handling for anyone in HR.
What is a good phishing simulation click rate?
There is no credible industry benchmark, because click rate depends entirely on template difficulty and every vendor grades difficulty differently. Compare your number to your own baseline at equivalent difficulty, not to a published average. A more useful pair of targets is a report rate above half of recipients and a median time to report under ten minutes.
Should employees be punished for failing a phishing test?
No. Discipline attached to clicks reliably reduces reporting, because a person who fears consequences hides the mistake, and the hidden mistake is what turns a click into an incident. Follow-up training, yes. Tighter technical controls for repeat clickers, yes. Naming individuals in a leadership deck or attaching results to a performance review is how a program stops producing the one signal you need.
What is human risk management?
It is the current name for the same subscription with a wider claim: awareness content and simulations plus per person risk scoring, data pulled from other security tools, and automated interventions such as extra training or tighter access for high risk individuals. Some of it is genuinely new. Much of it is a rebadge, so ask which data sources feed the score and whether the score can be explained to the person it describes.
Can we build a security awareness program ourselves?
For a small team, yes. CISA publishes free videos and tip sheets, and NIST SP 800-50r1 gives you the program structure at no cost. What you give up is simulation infrastructure, automatic assignment for joiners and leavers, and an export an auditor will accept. Companies that start in-house usually buy a platform the first time a customer questionnaire asks for completion evidence.
Who should own the program internally?
One named person, with the hours written into their objectives, in IT, operations, HR or compliance depending on where the discipline already lives. What matters is not the department but that the name exists and that a senior leader sends the launch communication. Programs that fail almost never fail on content quality. They fail because nobody was accountable for the calendar.
On this page
- What Is Security Awareness Training?
- What Security Awareness Training Includes
- What Security Awareness Training Does Not Cover
- Types of Security Awareness Training Providers
- How a Security Awareness Training Engagement Works
- How Phishing Simulations Work
- How Security Awareness Training Providers Differ
- How Much Does Security Awareness Training Cost?
- Security Awareness Training Compliance Requirements
- Questions to Ask Before Signing a Security Awareness Training Contract
- Security Awareness Training Contract Terms That Matter
- How to Measure Security Awareness Training Effectiveness
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.