In short: Security awareness training cost depends mainly on the number of users, the licensing term, which platform and edition you choose, whether it is bundled with email or endpoint security you already own, any add-ons, and whether you run it yourself or use a managed service. Most platforms are licensed per user; ask us for a quote.
The main cost drivers
| Driver | How it affects cost |
|---|---|
| Number of users | Most platforms are licensed per user, so cost scales with headcount. Include contractors and volunteers who have accounts. |
| Licensing term | Many vendors offer monthly and annual terms. Monthly gives flexibility as headcount changes; annual terms suit stable organisations. |
| Platform and edition | Tiers differ in content, automation and reporting. For example, HacWare's Plus tier adds a learning management system to its Pro tier, and its Super tier adds SMS phishing. |
| Bundling | Training may already be included in a licence you own, or be a low-friction add-on to your email security. |
| Add-ons | Extra content packs, dark web monitoring, policy management or human risk scoring can be separate products. |
| Service level | Running it yourself costs staff time; a managed service costs more in fees but less in internal effort. |
| Consultant-led exercises | A tailored simulation run by experts is bought as an exercise, not a per-user subscription. |
There is no single list price that applies to everyone, which is why we quote per organisation.
Licensing models you will come across
- Per-user subscription: the most common model. Usually billed monthly or annually, with users counted from your directory. Acronis, for example, offers its advanced security awareness training per user, enabled in the Acronis console.
- Included in a wider licence: Microsoft includes Attack Simulation Training in Microsoft 365 E5 and Defender for Office 365 Plan 2. Microsoft 365 E3 customers get only a trial subset. See Attack Simulation Training licensing.
- Add-on to email security: Proofpoint Essentials Security Awareness is an add-on to a Proofpoint Essentials email package, and Check Point's training add-on sits on top of Harmony Email & Collaboration.
- Part of an MSP platform: Guardz builds training into its SMB security platform tiers, and Breach Secure Now is sold only through IT providers.
- Project-based: the Bitdefender Phishing Simulation Service is a consultant-led exercise.
The platform comparison shows the delivery model for every vendor we supply.
Bundled versus standalone: the real comparison
A bundled option can look free, but compare like for like:
- What is actually included? A bundled tool may have a smaller content library, fewer languages or no policy management.
- Does it cover everyone? If only some users have the qualifying licence, you may need extra licences for the rest.
- What happens if you change vendor? Training history tied to an email or endpoint product may not move with you.
- Does it support your platform? Some email-security-based training works only with Microsoft 365 mailboxes.
Equally, a standalone platform can duplicate something you already pay for. We look at your current licences before recommending anything. See alternatives to Microsoft Attack Simulation Training for an example of the trade-offs.
The hidden cost: time
The biggest cost of security awareness training is often not the licence but the time to run it well:
- Setting up directory sync, allow-listing and the report button
- Building and scheduling simulations and training each month
- Chasing overdue training and handling staff questions
- Responding to reported emails
- Producing reports for the board, auditors and insurers
If that time does not exist, the programme stalls and the licence is wasted. A managed security awareness training service turns that internal effort into a predictable fee. If budget is tight, free security awareness training resources can cover the basics while you build the case.
Getting an accurate quote
To quote accurately, we need:
- The number of users, including contractors and volunteers with accounts
- Your email platform (Microsoft 365, Google Workspace or other)
- Your current Microsoft and security licences, so we do not sell you something you already own
- Any must-haves: languages, policy management, MSP console, sector content
- Whether you want to run it yourself or have us manage it
- Your preferred term: monthly or annual
We will come back with options from different vendors so you can compare. Licensing for many of these vendors is also covered on softwarelicensing.uk.
Contact us and ask us for a quote.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How much does security awareness training cost per user?
It varies by vendor, edition, term and volume, so we do not publish a figure. Most platforms are licensed per user, monthly or annually. Ask us for a quote and we will compare options from several vendors.
Is security awareness training included in Microsoft 365?
Attack Simulation Training is included in Microsoft 365 E5 and Microsoft Defender for Office 365 Plan 2. Microsoft 365 E3 customers get a limited trial subset: the Credential Harvest payload and two training experiences.
Is it cheaper to run security awareness training ourselves?
The licence cost is lower, but you need to budget for the staff time to set it up, run monthly campaigns, chase completion and produce reports. A managed service converts that time into a fixed fee.
Are there free security awareness training options?
Yes. The NCSC's Top Tips for Staff is free, and Microsoft offers a trial subset of Attack Simulation Training to E3 customers. Free resources lack automated simulations and full reporting. See free security awareness training.