Security Awareness Training Pricing 2026: Per-User Costs Compared

Short answer: Security awareness training is priced per user, and published list prices for self-serve platforms sit in the low single-digit US dollars per user per month, with some of the cheaper tiers needing a multi-year term. The larger cost is running the programme: building campaigns, chasing results and following up. A managed programme puts that work inside the price. All figures below are dated and sourced.

What are you paying for in security awareness training?

A security awareness programme has four parts, and vendors bundle them differently, so compare the parts rather than the headline rate.

• Training content. Short modules on phishing, passwords, safe browsing, data handling and, increasingly, deepfake and voice-phishing scenarios. A bigger content library usually sits in a higher tier.
• Phishing simulation. Fake phishing emails sent to staff to measure who clicks and who reports. Some vendors include it in every tier, others sell it as an add-on.
• Reporting. Click and report rates by department, trends over time, and evidence an insurer or auditor will accept.
• Administration. Someone has to choose templates, schedule campaigns, enrol new joiners, remind people who have not finished and handle the results. This is the cost that licence prices do not show.

Brocent offers this as a managed service through its security awareness training pricing page and also resells a named platform, described on the KnowBe4 pricing page. The two are different products, and this guide helps you compare them with other options.

How much does security awareness training cost per user?

Pricing is quoted per user (or seat) per month or year, usually on a minimum term, and falls as the number of seats rises. The figures below are the ones Brocent publishes or has reviewed, with their dates, so you can see the shape of the market. They are list prices, not quotes.

Self-serve platform list prices

• KnowBe4 SAT Foundation: US$1.97 per seat per month.
• KnowBe4 SAT Advanced: US$3.19 per seat per month.
• KnowBe4 PhishER Plus (reported-message triage, stand-alone or add-on): US$1.50 per seat per month.

These are KnowBe4's published list prices, shown per seat per month on a three-year term and excluding tax, from a pricing page dated May 2026. The two training tiers are the 101 to 250 seat band; PhishER Plus is listed for 101 to 500 seats. Seat bands, terms and currency change the price, so treat them as a reference and confirm before buying.

Across the USD-priced self-serve platforms Brocent reviewed in July 2026, published list prices fell between roughly US$1.50 and US$4 per user per month, depending on tier and term; one platform lists in pounds sterling and another quotes a per-contract annual figure. Some vendors publish no standing list price at all and quote per contract, particularly when training is bundled with email security. Where a vendor does not publish a figure, this guide gives none.

Managed programme prices

Brocent's published managed rates, as shown on its pricing page in October 2026, are per user per month:

• Quarterly cadence: US$2.50 per user, for up to 25 seats with a minimum of 10.
• Monthly cadence: US$2.00 per user, for 26 to 150 seats.
• Enterprise and multi-department: from US$1.50 per user, for 150 seats and above.
• One-off campaign, no subscription: from US$300 for a quarterly-style campaign and from US$500 for a monthly-style campaign.

In a managed programme a named engineer selects templates, sends the campaign and delivers a per-department results report, so the price covers the administration as well as the licence. A minimum of 10 seats applies.

Is phishing simulation an extra cost?

It depends on the vendor and the tier. Many platforms include simulated phishing in their standard tiers, while some treat reported-message handling, advanced reporting or larger content libraries as paid extras. When you compare quotes, write down three things for each: whether simulation is included, how many campaigns per year are allowed, and whether the results report is included. Brocent's managed tiers include the campaign and the report. A one-off phishing test (English) is available for firms that want a benchmark before committing to a programme.

Managed or self-run: what is the real cost?

A licence price compares platforms. A programme price compares ways of working. Self-running means someone on your team does the administration, and their time has a cost even when it does not appear on an invoice.

Managed vs self-run compared

• Self-run on a platform. Lower licence cost and full control of content and timing. You supply the time to pick templates, schedule, chase completions and produce the report. If that person leaves, the programme often stops.
• Managed service. A higher or similar per-user price that includes the administration. You review and approve, and the provider runs the campaigns and reports. Continuity does not depend on one employee.
• Free or minimal tier. Useful for a first look or for a very small team, but limited content and reporting rarely satisfy an insurer or auditor on their own.

To estimate the hidden cost, multiply the hours your administrator spends each month by their loaded hourly cost. As an illustration only, if running campaigns, chasing completions and reporting takes six hours a month and the loaded cost is US$40 an hour, the time costs US$240 a month, which can exceed the licence itself for a small team. Replace these numbers with your own.

What do insurers and regulators actually ask for?

Cyber insurance proposal forms commonly ask whether staff receive security awareness training, how often, and whether phishing simulations are run. Auditors ask for evidence: who was trained, when, and what the results were. Regulated firms have further expectations. Financial regulators such as the HKMA and the MAS set cybersecurity and technology risk expectations that commonly include staff awareness training, so check the circulars that apply to your licence.

The practical answer is to keep records. Choose a programme that produces dated reports of who completed training, click and report rates by department, and the trend over several campaigns. A single annual course with no testing rarely satisfies a careful underwriter.

What would it cost for 50, 150 and 300 users?

The calculations below use the published rates above and show their arithmetic. They exclude tax and any one-off set-up, and they assume the rate that applies to each seat band.

• 50 users, Brocent managed monthly cadence. 50 x US$2.00 = US$100 a month, or US$1,200 a year.
• 150 users, Brocent managed monthly cadence. 150 x US$2.00 = US$300 a month, or US$3,600 a year.
• 300 users, Brocent managed enterprise cadence. From 300 x US$1.50 = US$450 a month, or US$5,400 a year, with the final rate set in the quote.
• 150 users, KnowBe4 SAT Foundation list price. 150 x US$1.97 x 12 = US$3,546 a year, before the administration time described above.
• 150 users, KnowBe4 SAT Advanced list price. 150 x US$3.19 x 12 = US$5,742 a year.

The self-serve figures apply to the 101 to 250 seat band, so they are shown only for 150 users. Add the time cost of running the platform to compare like with like.

How often should staff be trained?

Run phishing simulations quarterly as a baseline, and monthly for higher-risk groups such as finance, HR and executives. Short, frequent training works better than one long annual course, because people learn from being caught and from timely examples. New joiners should be trained within their first weeks. Whatever cadence you choose, schedule it for the full year and record it.

Is a free tier enough?

For a first look or a team of a few people, a free or entry tier is a reasonable start. It is rarely enough on its own for a firm that must show an insurer or auditor evidence, because content, simulation and reporting are limited. Treat it as a pilot and set a date to move to a full programme.

What makes a security awareness programme work?

Price buys access to a programme, but results come from how it is run. Five habits separate programmes that change behaviour from those that only tick a box.

• Start with a baseline. Run an initial simulation before any training so you know where you stand. Without a baseline, you cannot show improvement to an insurer, an auditor or your board.
• Train in short, frequent bursts. A few minutes each month is remembered better than a long annual course, and it keeps security visible.
• Tailor to role. Finance staff face invoice fraud, HR sees fake CVs and executives are targeted with impersonation. Content and simulation themes should match the risks each group actually meets.
• Make reporting easy. A one-click report button, and a quick, friendly reply to the person who reports, matters more than punishing people who click.
• Close the loop. Follow up with those who clicked, with short additional training rather than blame, and repeat the test later to confirm improvement.

Which metrics should you track?

Ask each vendor or provider to report the same measures, so campaigns can be compared month to month.

• Click rate. The share of recipients who clicked a simulated phishing link. It should fall over time.
• Report rate. The share who reported the email. This is the more important number, because a high report rate means people act as a human alarm.
• Time to report. How quickly the first reports arrive, which tells you how fast a real attack would be spotted.
• Repeat clickers. The small group who click again and again. They need targeted help rather than more of the same.
• Training completion. The share who finished assigned modules by the deadline, and how many reminders it took.
• Trend by department. Differences between teams show where to focus effort.

Dated reports of these measures are what an auditor or insurer will ask to see, so confirm that your programme produces them without extra work.

What should you ask a vendor before you buy?

Use the same questions with every quote so that price differences can be traced to real differences in what is included.

• Term and renewal. What is the minimum term, what is the price after the first term, and how do you leave?
• Seat bands. Which band does our headcount fall in, and what happens to the price if we grow or shrink?
• Simulation. Is phishing simulation included in this tier, how many campaigns per year, and can we customise templates?
• Content. How large is the training library, is it available in the languages our staff use, and how often is it refreshed?
• Reporting. Which reports are included, can we export them, and are they accepted by our insurer?
• Administration. Who selects templates, sends campaigns and follows up with people who have not finished?
• Support. Who do we call when something goes wrong, and in which language and time zone?
• Data. Where is our staff data stored and who can access it?

How should you treat staff who keep clicking?

Repeat clickers are a small group, and how you handle them decides whether staff trust the programme. Avoid public shaming or disciplinary action for a simulated click, because it discourages reporting and teaches people to hide mistakes. Instead, offer short targeted training, a brief conversation and a retest. If a person still clicks after several rounds, consider additional controls such as stricter email filtering, multi-factor authentication or limited access to sensitive systems, rather than relying on awareness alone.

How do you introduce a programme without upsetting staff?

Announce the programme before the first simulation, explain that its purpose is to build skill rather than catch people out, and tell staff how to report suspicious messages. Brief managers so they can answer questions. Share overall results, such as the improvement in report rates, rather than individual names. Programmes introduced openly are accepted more easily and produce better data than those that feel like a trap.

Case study: a 90-person firm's first programme

*This is an illustrative example, not a named client.* A 90-person Hong Kong professional-services firm was asked by its insurer for evidence of annual training and phishing tests. It compared a self-serve platform with a managed programme, estimated six hours a month of administration for the self-serve option, and chose the managed monthly cadence so that no single employee carried the programme. The first quarter's report showed click rates by department and gave the insurer the dated evidence it asked for.

Frequently asked questions

How much does security awareness training cost per user?

Published USD self-serve list prices run from about US$1.50 to US$4 per user per month depending on tier and term, and Brocent's managed programme is listed from US$1.50 to US$2.50 per user per month depending on cadence and seat band. Check the current figures on the pricing page.

Is phishing simulation extra?

Sometimes. Some tiers include it and others charge for it or limit the number of campaigns. Ask whether simulation, the training library and the results report are all included.

Is a free tier enough?

Usually not for a firm that must show an insurer or auditor evidence. It is a reasonable pilot, but content and reporting are limited.

How often should we train?

Quarterly simulations are a sensible baseline, with monthly for higher-risk teams, plus training for new joiners in their first weeks.

Does it satisfy cyber insurance?

A documented programme with dated reports usually answers the training questions on an insurance form, but each insurer sets its own requirements, so check yours.

Should we run it ourselves or use a managed service?

Self-running costs less in licence fees but needs regular administrator time. A managed service includes that time and does not depend on one person. Estimate the hours before deciding.

How is this different from a KnowBe4 alternative?

A KnowBe4 alternative post compares platforms. This guide compares prices and the cost of running a programme. For platform alternatives, see KnowBe4 alternatives for APAC security awareness training.

Is there a minimum number of users?

Platforms often set seat minimums or sell by band, and managed services usually set a minimum too. Brocent's managed programme has a minimum of 10 seats. For a team smaller than that, a one-off campaign or an entry tier on a self-serve platform may be a better starting point.

How long does it take to start a programme?

A managed programme can usually run its first baseline simulation within a few weeks of agreeing scope, once the user list and sending domains are ready. A self-serve platform can be configured faster, but the first campaign still needs templates, a user list and a plan, so allow time for them.

Next steps

See Brocent's managed rates on the security awareness training pricing page, compare named platforms on the security awareness vendors page, and read how a Hong Kong firm handled it in security awareness training after a phishing incident. Awareness training sits inside Brocent's managed IT security services. For a quote based on your seat count, talk to a consultant.