In short: Hornetsecurity Security Awareness Service is an automated awareness training programme from Hornetsecurity, now part of Proofpoint. Its Spear Phishing Engine sends targeted simulations at graded levels of difficulty, its Awareness Engine gives each user as much e-training as they need and no more, and the Employee Security Index (ESI) tracks progress on the Awareness Dashboard.
What the Security Awareness Service is
The Security Awareness Service is Hornetsecurity's answer to a familiar problem: most organisations know they should train staff, but few have the time to plan campaigns, chase completions and work out whether anything is improving. The service is designed to run itself. Once users are loaded, it sends simulated phishing, rolls out short e-training to the people who need it and reports on progress, with very little day-to-day effort from your IT team.
Proofpoint completed its acquisition of Hornetsecurity on 8 December 2025, and Hornetsecurity now runs as a dedicated Proofpoint business unit focused on managed service providers and small and mid-sized businesses, with continuity of service and support. You will see it described as "Hornetsecurity by Proofpoint".
It can be bought on its own or alongside Hornetsecurity's email security. New to the subject? Start with what security awareness training is, then see how a phishing simulation programme works.
The building blocks
The service has four core components, plus a portal for staff:
| Component | What it does |
|---|---|
| Spear Phishing Engine | Generates realistic, individually tailored phishing simulations at different levels of difficulty, including fake login pages and file attachments with macros |
| Awareness Engine | Hornetsecurity calls it the technological heart of the service: it decides how much e-training each user receives, based on their level |
| Employee Security Index (ESI) | A benchmark that measures how securely employees behave and steers who needs more training |
| Awareness Dashboard | The admin view: key figures for training groups and employees, ESI history and forecast, and configuration |
| User Panel | One place for each employee's e-tutorials, video clips, refresher modules, quizzes and feedback on their own simulations |
Hornetsecurity describes its Spear Phishing Engine as AI-powered and patented, and the learning content and e-tutorials are available in multiple languages. Ask us to confirm the languages you need before you commit.
How the Spear Phishing Engine grades attacks
Rather than sending everyone the same template, the engine sorts its scenarios into levels according to how much effort a real attacker would need to prepare them. Hornetsecurity's fact sheet lists seven levels:
| Level | Type of simulated attack |
|---|---|
| 1 | Mass phishing, such as a generic order or delivery notice |
| 2 | Spear phishing that appears to come from a senior executive |
| 3 | Spear phishing that uses targeted information about your organisation |
| 4 | Messages that reference the recipient's job, colleagues and managers |
| 5 | Messages from spoofed domains |
| 6 | Messages that include an email reply history |
| 7 | Messages that draw on hidden reading of a mailbox |
The fact sheet marks levels 6 and 7 as planned for later expansion and says they will need Hornetsecurity's Spam and Malware Protection or 365 Total Protection. We will tell you which levels are live for your tenancy when we set the service up.
Grading matters for two reasons. Hornetsecurity's ESI white paper describes each employee receiving randomly selected scenarios from different levels at random times, so people meet a realistic mix of crude and convincing lures rather than learning to spot one template. And results can be compared fairly over time, because each level is measured against an expected tolerance. That comparison is what feeds the Employee Security Index.
Needs-based e-training
The Awareness Engine is built around a simple rule: every user gets as much training as necessary and as little as possible. In practice that means:
- Auto Training Mode: learning content is rolled out automatically to users and groups when they need it
- Single User and Productivity Booster: people with greater learning needs receive more intensive training, while those already at a very good level are trained less
- Manual Training Mode: administrators can still push specific modules to chosen groups or users, for example a payment-fraud refresher for finance
- Automatic onboarding: new users join the programme automatically when directory synchronisation (LDAP or Active Directory) is in place
- Gamification in the User Panel to encourage people to do their best
This approach suits busy teams. Strong performers are not forced through modules they do not need, and the people most likely to be caught get more attention. For new starters, combine it with a short security induction.
Licensing and options
The Security Awareness Service is licensed per user, and we supply it on monthly terms. There are two common ways to buy it:
| Option | Suits |
|---|---|
| Security Awareness Service on its own | Organisations using another email security product that want Hornetsecurity's simulations and ESI reporting |
| 365 Total Protection Plan 4 (Compliance & Awareness) | Microsoft 365 customers who want email security, backup, compliance tools and awareness training from one vendor |
The 365 Total Protection range has four plans: Plan 1 Business, Plan 2 Enterprise, Plan 3 Enterprise Backup and Plan 4 Compliance & Awareness. Only Plan 4 includes the Security Awareness Service. Packaging can change, so we confirm exactly what is included when we quote. Pricing depends on user numbers and term, so ask us for a quote. To understand what drives the cost of any platform, see how much security awareness training costs.
Who it suits and how we run it
The Security Awareness Service tends to suit organisations that:
- Want a programme that runs itself, with training targeted automatically
- Value a single benchmark they can report to the board, insurers or auditors
- Already use, or are considering, Hornetsecurity 365 Total Protection for Microsoft 365
- Want realistic spear phishing that goes beyond generic mass templates
If you already use Proofpoint Essentials for email, compare the two Proofpoint options on Hornetsecurity vs Proofpoint Essentials. For every vendor side by side, see platforms compared.
As part of our managed security awareness training we can:
- Load your users and groups, with directory sync for automatic onboarding
- Configure delivery so simulations reach inboxes without weakening your email security
- Run a baseline period so the ESI reflects where you really start
- Agree any manual modules for high-risk teams such as finance and executives
- Review the Awareness Dashboard with you each month and act on low scores
- Report ESI history and forecast to your board or insurer each quarter
Contact us for a demonstration, a quote or a neutral view on whether it is the right fit.
Explore Hornetsecurity
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Hornetsecurity part of Proofpoint?
Yes. Proofpoint completed its acquisition of Hornetsecurity on 8 December 2025. Hornetsecurity operates as a dedicated Proofpoint business unit focused on managed service providers and smaller businesses, and its products, including the Security Awareness Service, continue to be sold and supported.
Do I need Hornetsecurity email security to use the Security Awareness Service?
No. The service can be bought on its own. Hornetsecurity's fact sheet says the most advanced simulation levels, which are planned for later expansion, will need its Spam and Malware Protection or 365 Total Protection.
What is the Employee Security Index?
The ESI is Hornetsecurity's benchmark for employee security behaviour. It is calculated from how people respond to graded phishing simulations and is used to steer each person's training. Read our Employee Security Index explainer.
Is the Security Awareness Service included in 365 Total Protection?
It is included in 365 Total Protection Plan 4, Compliance & Awareness. With the lower plans it is bought separately. Ask us which option is better value for your user numbers.
How do new starters get enrolled?
With directory synchronisation (LDAP or Active Directory) in place, new users are onboarded automatically. Without it, users are added in the control panel. We set this up as part of our managed service.