Security awareness platform

User management: directory sync with Microsoft Entra ID or Google Workspace so joiners are enrolled and leavers removed automatically, with groups for departments and roles.

Content library: video, interactive and micro-learning modules in multiple languages, plus policy acknowledgement tracking. Library size varies widely; relevance and freshness matter more than module count.

Simulation engine: template libraries for email, SMS and sometimes voice, with difficulty levels, localisation and scheduling. Adaptive platforms such as Hoxhunt adjust difficulty per individual.

Reporting add-in and triage: a report button that forwards suspicious mail, with automated analysis that tells users whether a reported message was a simulation, safe, or malicious.

Analytics and compliance evidence: dashboards for risk by group and exportable reports for audits.

Library-led platforms, typified by KnowBe4, offer very large content catalogues and administrator control over campaigns. Behaviour-led platforms, typified by Hoxhunt, emphasise automated, personalised simulations and gamified reporting. Email-security vendors such as Proofpoint connect training with threat data from their filtering products. Managed-service-oriented options such as Huntress are designed for managed service providers serving many small clients.

Pricing transparency is low: of the five we rank, only KnowBe4 publishes list prices. Ask every vendor for per-seat pricing at your exact headcount and term.

Simulations must reach inboxes, which means allow-listing the platform's sending servers in your email security. Plan this with your IT team, or test results will be distorted by filters. The report button must deploy to every mail client staff use, including mobile.

As reporting increases, the security team faces a new problem: a queue of reported messages, most of them harmless. Modern platforms address this by automatically analysing reported emails — checking links, attachments, sender reputation and similarity to known campaigns — and classifying them. Users receive feedback such as “this was a simulation, well done” or “this was safe” without waiting for a person. Genuinely malicious messages are escalated, and some platforms can remove the same message from other inboxes. Evaluate this capability carefully if you have a small security team, because it determines whether higher reporting creates value or workload.

Platforms process employee behaviour data — who clicked, who reported, how quickly — and sometimes email content. In many jurisdictions this requires transparency with staff and, in some workplaces, consultation with works councils. Decide in advance who can see individual-level results, how long data is retained, and how results will be used. Using the data for coaching rather than discipline supports both compliance and a healthy reporting culture. Ask vendors where data is hosted and whether they offer regional hosting.

Multinational organisations should check that training modules and simulations are available in every language their staff use, and that phishing templates are localised rather than literally translated, since attacks in a second language are less convincing and teach the wrong lesson. Accessibility matters as well: modules should support captions, screen readers and keyboard navigation so every employee can complete them.

Compare report rate, time-to-report and repeat-clicker numbers before and after rollout. Combine them with real incident data from the security team to show whether reported threats were caught earlier.

Phishing simulation: a safe, fake attack sent for training. Report rate: the share of recipients who report a simulation. Repeat clicker: someone who clicks multiple simulations. Allow-listing: configuring email security to deliver simulations. Business email compromise: fraud using impersonated email. Human risk management: measuring and reducing people-related security risk.

What is the per-seat price at our headcount and term, and what does renewal cost? Which content languages are supported? How are reported emails analysed, and can malicious messages be removed from other inboxes? Where is data hosted and for how long is it kept? Which directories and email platforms integrate natively? Can we export all results if we leave? What administrator time does a typical customer of our size spend per month? Written answers to these questions make proposals directly comparable and expose hidden costs early.

Ask for a reference customer in your sector and size band, and speak to their administrator rather than only the buyer, since the administrator lives with the platform every week.

Every number on this page links to the organisation that published it: an independent research firm, an official product or pricing page, a public filing, or official documentation. We do not publish our own estimates as facts, and where a figure is reported by the company it describes, it is labelled company-reported. Prices are taken from official vendor pages and change often, so open the linked source before relying on one. If a widely repeated figure could not be traced to a primary source, we left it out. Entries are reviewed when the underlying sources publish new editions, and the update date at the top of the page shows the latest review.