Insurers ask whether you train staff, and phishing is how most small business attacks start. But training is also the layer with the weakest evidence. This guide gives you prices, the catch in the fine print, and an honest read of the research.
Key takeaways
- Price per user is $10 to $45 a year, but minimums can make a 10-person team pay for 25 or 50 seats.
- Training alone is weak protection. A UC San Diego Health study of more than 19,500 employees found no significant benefit from annual training.
- Technical controls come first. MFA, EDR and a password manager limit the damage when someone does click.
- Buy it anyway. Insurers and customers ask for evidence of training, and well-run programs can still help when they are short, frequent and relevant.
On this page: Why it matters · Prices · Seat minimums · Does it work? · How to choose · Run a program · FAQ
Why does a small business need security awareness training?
Verizon’s 2026 Data Breach Investigations Report says the human element was involved in 62% of breaches. Most attackers who target small businesses do not break in; they ask. A fake invoice, a fake login page or a call from “the CEO” only works if someone acts on it. Cyber insurers and larger customers also ask whether you train staff: see cyber insurance requirements.
How much does security awareness training cost?
| Provider | Price per user a year | Minimum | Notes |
|---|---|---|---|
| Infosec IQ | $10 to $15 | $1,500 contract | Phishing simulation needs a higher tier |
| Hook Security | about $12 to $48 ($1 to $4 a month) | None stated | Vendor’s own estimate of typical pricing |
| Arctic Wolf | $15 to $35 | None published | Includes a managed concierge program |
| NINJIO | $18 to $24 | None published | Reseller-listed |
| KnowBe4 | $19.56 to $45 | 25 seats, 3-year term | Foundation $19.56 to $28.80; Advanced $33.48 to $45 |
| Huntress Managed SAT | about $25 ($2.08 per learner a month) | 50 seats for direct customers | Volume discounts at 100 learners |
| Hoxhunt | No per-user rate | $10,000 a year | Adaptive phishing simulation |
| Proofpoint, SoSafe, Cofense, ThreatCop | Quote only | n/a | Not published |
Sources are listed below. KnowBe4, Infosec IQ, Arctic Wolf, NINJIO and Hoxhunt figures come from a pricing comparison site that verified them in September 2026; Huntress and Hook figures come from the vendors. None are independent measurements.
What does it cost for a team of 10?
Minimums change the math. Using the list prices above, if the minimum is enforced:
| Option | Minimum applies | Approx. annual cost |
|---|---|---|
| Hook Security, 10 users | None stated | $120 to $480 |
| KnowBe4 Foundation, 25 seats | 25 seats | $489 to $720 |
| KnowBe4 Advanced, 25 seats | 25 seats | $837 to $1,125 |
| Huntress Managed SAT, 50 seats | 50 seats | about $1,248 |
| Infosec IQ | $1,500 contract | $1,500 |
These are our calculations from list prices, not quotes. Ask each vendor whether they sell through an MSP or reseller with lower minimums for small teams. Our cost guide includes training in a full 10-employee budget.
Does security awareness training actually work?
Less than vendors suggest. In a randomized study published in September 2025, researchers followed more than 19,500 employees at UC San Diego Health for eight months across 10 phishing campaigns. According to HR Dive’s coverage, they found no significant difference in phishing susceptibility between people with no training and those who had recently completed annual training. Training delivered right after a click reduced clicks by about 2%. About 75% of employees spent a minute or less on the training, and the researchers concluded that, as administered, none of the training types were effective. They recommended technical protections such as two-factor authentication and password managers that only fill on the correct website.
That is one study of one health system, and it tested particular programs. It does not prove that all training is useless. It does say that a once-a-year video is not a control you can rely on. So:
- Treat training as one layer, never the only one.
- Make sure MFA and endpoint protection are in place first.
- Make reporting easy, and reward people who report.
How do you choose a training provider?
- Check the minimums and the contract term before the rate (KnowBe4 lists a three-year term).
- Ask what is included: phishing simulations, the content library, reporting you can show an insurer.
- Ask about mobile and SMS lures. Verizon’s 2026 report says mobile phishing simulations had engagement rates 40% higher than email simulations.
- Ask for a trial or a pilot with a few staff before you sign.
- Ask whether your MSP resells it. Resellers can have lower minimums.
If you already pay an MSP or a managed security provider, check whether training is bundled: small business cyber security services.
How to run a training program that does something
- Start with the three scams that cost small businesses money: fake invoices and payment changes, fake sign-in pages, and impersonation of the boss. See business email compromise and how to spot a phishing email.
- Keep sessions short and frequent (a few minutes a month) rather than one long annual module.
- Add a payment-change rule: no bank details change without a call-back on a known number.
- Make reporting one click (a report button, or one agreed address).
- Keep records: who was trained, when, and the topics. Insurers and customers ask.
- Back it with controls: AI phishing and deepfake scams will get past some people however good the training is.
Frequently asked questions
How much does security awareness training cost per user?
Published list prices run from about $10 to $45 per user a year, depending on the provider and plan. Minimum seat counts and contract terms can raise the real cost for small teams.
What is the best security awareness training for a small business?
It depends on your size and budget. KnowBe4, Infosec IQ, Huntress, NINJIO and Hook Security all publish or report pricing; compare minimum seats, contract length and what reports you get.
Is security awareness training required for cyber insurance?
Many insurers ask about it on applications, but requirements vary by insurer. See our guide to cyber insurance requirements.
Does phishing training reduce risk?
Evidence is mixed. A 2025 study of more than 19,500 employees found no significant benefit from annual training, and about a 2% reduction from training given right after a click. Use it alongside MFA and endpoint protection.
How often should employees be trained?
Short, frequent sessions are more practical than one long annual course. The research above does not prove an ideal schedule, so measure reports and incidents rather than completion alone.
Can I do security awareness training for free?
You can run your own short sessions using free material, and some password managers and MFA products add protection that does not depend on people. Paid platforms mainly add simulations, content and reporting.
Sources
- Verizon: 2026 Data Breach Investigations Report (human element 62%); Help Net Security summary (May 25, 2026)
- HR Dive: Employees don’t learn anything from phishing training, research says (Sept 23, 2025), reporting a UC San Diego Health study released Sept 17, 2025
- Security Awareness Pricing: 9 vendors compared (verified Sept 2026)
- Huntress: Pricing (checked Oct 9, 2026)
- Hook Security: Best Security Awareness Training for Small Business (vendor blog; typical pricing per the vendor)
Last updated October 9, 2026. Prices are list prices from vendors or comparison sources and change often. SMB Security HQ provides general information, not legal, financial or professional security advice. We have not hands-on tested these products. See our Affiliate Disclosure and How We Test.
Written by SmbSecurity team. Reviewed by Nhon Dang, CTO Sunteco cloud.
