Security awareness training

Content: short modules on phishing, business email compromise, password and passkey hygiene, multi-factor authentication fatigue, safe handling of personal data, physical security and reporting procedures. Good libraries offer role-specific content for finance, HR and executives, who face targeted attacks.

Simulation: realistic fake phishing emails, and increasingly SMS and voice simulations, sent to staff at random intervals. Results show who clicked, who entered credentials and — most importantly — who reported.

Reporting: a one-click report button in the email client that sends suspicious messages to the security team, closing the loop between training and real defence.

Measurement: dashboards tracking click rates, report rates and time-to-report by department over time.

KnowBe4 is unusual in publishing manufacturer's suggested retail prices. Its Foundation tier starts at $2.40 per seat per month for 25–50 seats and falls to $1.63 at 501–1,000 seats on a three-year term; the Advanced tier runs from $3.75 down to $2.79. Most competitors, including Hoxhunt, Proofpoint and Infosec IQ, quote by headcount.

Against IBM's 2025 global average breach cost of USD 4.44 million, programme costs are small, but the comparison only holds if training measurably changes behaviour. Budget for administrator time as well as licences.

Click rate is the familiar metric, but it is easy to manipulate by sending easier or harder simulations. Report rate — the share of people who report a simulated phish — and the speed of reporting are better indicators, because reporting is the behaviour that helps the security team stop real attacks.

Track trends per department over at least two quarters, keep simulation difficulty consistent, and compare with real incident reports.

Avoid punitive approaches. Shaming people who click reduces reporting, which is the opposite of the goal.

Simulations should resemble the attacks your organisation actually receives. Ask the security or IT team for recent examples of reported phishing and adapt them into templates: fake shared-document notifications, invoice requests, delivery notices, password-expiry warnings and messages impersonating executives. Vary the sender, timing and channel. Avoid templates that would cause real distress, such as fake bonus or redundancy announcements, which damage trust in the programme. Each simulation should include clues an attentive employee could spot — a mismatched sender domain, an unusual request, urgency — so the teachable moment after a click can point to them specifically.

The most valuable outcome of training is not fewer clicks but more reports. A single early report of a real phishing campaign can let the security team block it before others are affected. Encourage reporting by making it one click, responding quickly, thanking people publicly by team, and never penalising someone for reporting a legitimate email by mistake. Leaders should model the behaviour: when executives report suspicious messages and talk about it, staff follow.

Finance, HR, executive assistants, IT administrators and anyone with access to payments or sensitive data deserve additional, targeted modules. Business email compromise — where attackers impersonate executives or suppliers to redirect payments — relies on these roles. Training should cover verification procedures such as calling back on a known number before changing bank details, and should be reinforced with process controls like dual approval for large payments, because training alone does not stop a well-crafted attack.

Review the content library at least twice a year. Attack techniques change — QR-code phishing, MFA-fatigue prompts and AI-generated voice calls are recent examples — and outdated lessons lose credibility with staff.

Phishing: fraudulent messages that trick people into revealing information or running malware. Smishing and vishing: phishing by SMS and voice. Social engineering: manipulating people rather than systems. MFA fatigue: bombarding a user with login approval prompts until they accept one. Teachable moment: a short lesson shown immediately after someone clicks a simulation.

Report rate: the share of recipients who report a simulated or real phishing message. It is the metric most closely linked to how quickly a security team learns about real attacks.

Every number on this page links to the organisation that published it: an independent research firm, an official product or pricing page, a public filing, or official documentation. We do not publish our own estimates as facts, and where a figure is reported by the company it describes, it is labelled company-reported. Prices are taken from official vendor pages and change often, so open the linked source before relying on one. If a widely repeated figure could not be traced to a primary source, we left it out. Entries are reviewed when the underlying sources publish new editions, and the update date at the top of the page shows the latest review.