Security awareness training pricing 2026: KnowBe4 publishes rates from $19.56, ThreatCop publishes the widest capability coverage, and 4 vendors publish no price at all
Two axes, not one. Price transparency and capability coverage turn out to be almost unrelated in this market, and buyers who shortlist on the first axis alone consistently mis-scope the second. KnowBe4 and Infosec IQ publish rate cards. Arctic Wolf, NINJIO and Hoxhunt surface only through resellers. Proofpoint, SoSafe, ThreatCop and Cofense won't name a number at all — and the broadest attack-vector and AI-simulation coverage in this comparison belongs to one of them. Both axes are below, sourced and dated.
What does security awareness training cost per user in 2026?
Published and reseller-listed list prices run $10.00 to $35.00 per user per year. Two vendors publish a rate card on their own website. Three are visible only through resellers and marketplaces. Four require a sales call before they will name a number.
The 3.5× gap between the cheapest published rate and the top of the sourced range is real, and the matrix below shows where each option lands. Quote-only vendors get a contact link, not an inferred rate.
Security awareness training cost calculator
Set your headcount and programme requirements. Vendors are ranked by published capability coverage, not by price — the cheapest platform that cannot do what you need is not a saving. The calculator runs on published and clearly-sourced list prices only; vendors with no verifiable number keep their coverage rank and show no price.
| RANK | VENDOR | ANNUAL | PER USER/YR |
|---|---|---|---|
| 1 | ThreatCopQUOTE65 of 75 capabilities published, 8 qualified. Pricing not publicly disclosed. We do not infer a rate. | — | — |
| 2 | KnowBe4PUBLIC45 of 75 capabilities published, 14 qualified. SAT Advanced at the 251–500 seat band (3-year term, per KnowBe4, May 2026). SAT Advanced adds the 1,000+ Advanced Training Library and unlimited Smart Groups; APIs, webhooks and security roles ship on both plans. | $17,760 | $35.52 |
| 3 | ProofpointQUOTE34 of 75 capabilities published, 20 qualified. Pricing not publicly disclosed. We do not infer a rate. | — | — |
| 4 | Infosec IQPUBLIC33 of 75 capabilities published, 19 qualified. Higher tier applied: phishing simulation and full analytics are not on the entry rate card. | $8,000 | $16.00 |
| 5 | HoxhuntNO RATE31 of 75 capabilities published, 22 qualified. Publishes a $10,000/year contract floor and no per-user rate. At 500 seats the floor alone is $20.00/user/yr. | — | — |
| 6 | SoSafeQUOTE28 of 75 capabilities published, 25 qualified. Pricing not publicly disclosed. We do not infer a rate. | — | — |
| 7 | CofenseQUOTE19 of 75 capabilities published, 22 qualified. Pricing not publicly disclosed. We do not infer a rate. | — | — |
| 8 | Arctic WolfSOURCED18 of 75 capabilities published, 22 qualified. Midpoint of the sourced $15.00–$35.00/user/yr list band for this headcount. Managed delivery is embedded in the price whether or not you want it. | $12,000 | $24.00 |
| 9 | NINJIOSOURCED11 of 75 capabilities published, 14 qualified. Reseller-listed entry rate; the published range runs to $24.00/user/yr. Phishing simulation is bundled on request, not on the listed rate — confirm inclusion before comparing. | $9,000 | $18.00 |
How we calculate. Annual = headcount × the list rate for that vendor's published volume band, with contract minimums enforced. Reporting depth selects the tier that actually carries those capabilities on each vendor's own rate card. Phishing simulation moves Infosec IQ to its higher tier; it is already bundled on every KnowBe4 tier. Managed delivery and non-English content do not add invented fees — they flag which vendors can meet the requirement in-tier and which push you to a quote. Full methodology and sources →
The three-band answer
Almost every awareness procurement lands in one of three headcount bands, and the vendor shortlist changes completely between them. The band most buyers are in is the middle one, 250 to 2,000 seats, where a published $12–$15 rate and a sourced $28 rate produce a 2.3× spread on identical scope.
Minimums decide it
KnowBe4 enforces a 25-seat floor and Infosec IQ a $1,500 minimum contract value, so your effective per-user rate is set by the minimum, not the rate card. At 40 seats Infosec IQ costs $37.50/user before a single feature is compared. Free tiers and MSP-bundled programmes are genuinely competitive here.
Per-user math matters
Infosec IQ $12–$15, KnowBe4 SAT Foundation $19.56–$25.56, KnowBe4 SAT Advanced $33.48–$40.80, NINJIO $18–$24, Arctic Wolf $18–$28. This is where the plan choice is the swing factor: SAT Advanced costs roughly 55–70% more per seat than SAT Foundation at the same headcount — and that premium buys the 1,000+ Advanced Training Library and unlimited Smart Groups, not the APIs or reporting, which ship on both.
Quote-only territory
Every published rate card stops here. KnowBe4 and Infosec IQ both route 5,000+ seats to sales; Proofpoint, SoSafe, Hoxhunt, ThreatCop and Cofense were never on a rate card to begin with. Aggregated contract data suggests 40–60% off list is achievable at this scale with a multi-year commitment.
All 9 vendors at a glance
Ordered by published capability coverage across the 75-point matrix below — full capabilities score 1, qualified ones 0.5. Price is shown alongside the rank, never as the rank. Every figure carries its evidence class, and we do not infer numbers for vendors that publish none.
| VENDOR | COVERAGE | EVIDENCE | ENTRY RATE | MINIMUM | PHISHING SIM | FREE TIER | MANAGED |
|---|---|---|---|---|---|---|---|
| ThreatCopStartup / Scaleup / Enterprise | #165 + 8◌ | QUOTE | Quote only | None published | Included | None | Yes, add-on |
| KnowBe4SAT Foundation / SAT Advanced | #245 + 14◌ | PUBLIC | $19.56–$45.00 | 25 seats | Included, both plans | Free phishing test | Via MSP partner |
| ProofpointSecurity Awareness Training | #334 + 20◌ | QUOTE | Quote only | None published | Included | None | No |
| Infosec IQInfosec IQ (Cengage) | #433 + 19◌ | PUBLIC | $10.00–$15.00 | $1,500 contract | Higher tier | Free trial | No |
| HoxhuntHoxhunt Human Risk | #531 + 22◌ | SOURCED | $10,000/yr floor | $10,000/yr | Included, adaptive | None | Partial |
| SoSafeEssential / Advanced / Enterprise | #628 + 25◌ | QUOTE | Quote only | None published | Included | None | No |
| CofensePhishMe | #719 + 22◌ | QUOTE | Quote only | None published | Included | None | No |
| Arctic WolfManaged Security Awareness | #818 + 22◌ | SOURCED | $15.00–$35.00 | None published | Included | None | Yes, concierge |
| NINJIONINJIO AWARE | #911 + 14◌ | SOURCED | $18.00–$24.00 | None published | Bundled on request | Free trial | No |
Attack-vector coverage: what you can actually simulate
Price per user is only half the comparison, and vendor columns here are ordered by the same coverage score used everywhere else on this page. A platform that simulates email phishing and nothing else is not comparable to one that runs vishing, smishing, WhatsApp, QR and callback scenarios — and buyers routinely discover the gap after signing. Coverage reflects each vendor's own published capability documentation. An empty cell means we found no published claim, not that the capability is absent.
| ATTACK VECTOR | ThreatCop | KnowBe4 | Proofpoint | Infosec IQ | Hoxhunt | SoSafe | Cofense | Arctic Wolf | NINJIO |
|---|---|---|---|---|---|---|---|---|---|
| Email phishing | ● | ● | ● | ● | ● | ● | ● | ● | ● |
| Attachment-based | ● | ● | ● | ● | ○ | ○ | ● | ○ | — |
| QR code (quishing) | ● | ● | ● | ○ | ● | ○ | ● | ○ | — |
| Callback phishing | ● | ● | ○ | — | ○ | — | ○ | — | — |
| Vishing (voice) | ● | ○ | ○ | ○ | — | — | — | — | — |
| SMiShing (SMS) | ● | ○ | ○ | ○ | — | ○ | — | — | — |
| WhatsApp / chat | ● | — | — | — | — | — | — | — | — |
| Ransomware simulation | ● | — | — | — | — | — | — | — | — |
| USB drop test | — | ● | — | ○ | — | — | — | — | — |
| Deepfake / AI voice | ○ | ○ | ○ | — | ○ | — | — | — | — |
● published capability ○ add-on, higher tier or regional — no published claim found
The four vendors that won't quote a price
Proofpoint, SoSafe, ThreatCop and Cofense all require a sales conversation before naming a number. We do not infer rates for them from historical deals or competitor pricing. Each entry links to the vendor's own contact page.
Three packages (Startup, Scaleup, Enterprise) with documented feature allocation and managed-service quantities, but no published per-user rate in any territory.
CONTACT SALES →Security Awareness Training is sold alongside the email-security stack and priced inside that bundle. No standalone rate card exists on any Proofpoint property.
CONTACT SALES →Publishes an Essential / Advanced / Enterprise package structure with feature lists and no numbers. Marketplace listings show "Contact Us" against every tier.
CONTACT SALES →PhishMe is quoted per seat against SOC-integration scope. Nothing published; renewals are negotiated against reported-phish volume rather than headcount.
CONTACT SALES →What opacity actually costs you
A quote-only vendor cannot be shortlisted on price, which means it cannot be eliminated on price either — so it stays in the evaluation, consuming three to six weeks of security and procurement time before anyone learns whether it was ever affordable. Buyers who require a written list rate in the RFI stage routinely cut their evaluation cycle in half.
Why per-user prices vary 3.5×
On 1,000 seats with full analytics, Infosec IQ lists roughly $12,000/year while Arctic Wolf Managed Security Awareness lists as high as $35,000. Both are called security awareness training. Four things drive the gap.
Tier gates the analytics, not the training
Both KnowBe4 plans include unlimited phishing tests, the full reporting and webhook APIs, security roles and Smart Groups. What SAT Advanced actually adds over SAT Foundation is the 1,000+ Advanced Training Library and unlimited (rather than limited) Smart Groups — a 55% to 70% premium for content depth, not reporting infrastructure.
Managed vs self-run is a service line, not a feature
Arctic Wolf's rate embeds a concierge team that designs and runs the programme. KnowBe4 and Infosec IQ assume you have an admin with time. Comparing the two rates without pricing 4–8 hours of internal admin per month understates self-run by $8–$20 per user per year at small headcounts.
Volume bands are steep and cliff-edged
Infosec IQ drops from $15 to $10 per learner between 100 and 2,000 seats — a 33% cut. Crossing a band boundary by ten seats can cost less in total than staying below it. Check the band table before you finalise headcount.
Contract length is where the discount lives
Published KnowBe4 rates assume annual billing; three-year terms carry documented discounts that are explicitly not available at renewal. Aggregated transaction data puts real-world mid-market discounts at 22–35% and enterprise at 40–60%, almost all of it tied to multi-year commitment.
Full feature matrix
All nine vendors across 75 capabilities, each scored at its highest published tier and ordered by coverage. The count under each vendor is full capabilities, then qualified ones. Two vendors document their packaging in enough detail for a tier-by-tier breakdown — those are the second and third tabs. Sections expand.
| FEATURE | ThreatCop65 + 8◌ | KnowBe445 + 14◌ | Proofpoint34 + 20◌ | Infosec IQ33 + 19◌ | Hoxhunt31 + 22◌ | SoSafe28 + 25◌ | Cofense19 + 22◌ | Arctic Wolf18 + 22◌ | NINJIO11 + 14◌ |
|---|---|---|---|---|---|---|---|---|---|
| ▾ Attack vectors & simulation | |||||||||
| Email phishing simulation | ● | ● | ● | ● | ● | ● | ● | ● | ● |
| Unlimited simulation campaigns | ● | ● | ○ | ● | ● | ○ | ○ | ○ | — |
| Attachment-based phishing | ● | ● | ● | ● | ○ | ○ | ● | ○ | — |
| QR code phishing (quishing) | ● | ● | ● | ○ | ● | ○ | ● | ○ | — |
| Callback phishing | ● | ● | ○ | — | ○ | — | ○ | — | — |
| Vishing (voice) | ● | ○ | ○ | ○ | — | — | — | — | — |
| SMiShing (SMS) | ● | ○ | ○ | ○ | — | ○ | — | — | — |
| WhatsApp / chat phishing | ● | — | — | — | — | — | — | — | — |
| Ransomware simulation | ● | — | — | — | — | — | — | — | — |
| USB drop test | — | ● | — | ○ | — | — | — | — | — |
| Custom landing pages | ● | ● | ● | ● | ○ | ○ | ● | ○ | — |
| Custom SMTP / sender domain | ● | ● | ● | ● | ○ | ○ | ● | — | — |
| Reply tracking on simulations | ● | ● | ○ | ○ | ○ | — | ● | — | — |
| Report-phish button | ● | ● | ● | ● | ● | ● | ● | ● | — |
| ▾ AI capabilities | |||||||||
| AI prompt-based template generation | ● | ● | ○ | — | ● | ○ | — | — | — |
| AI-selected templates per user | ● | ● | ○ | — | ● | ○ | — | — | — |
| AI-recommended training per user | ● | ● | ○ | ○ | ● | ● | — | ○ | — |
| Conversational AI WhatsApp phishing | ● | — | — | — | — | — | — | — | — |
| Conversational AI vishing and callback | ● | — | — | — | — | — | — | — | — |
| AI versus IVR vishing mode selection | ● | — | — | — | — | — | — | — | — |
| Cloned-voice / AI voice manager | ● | — | — | — | — | — | — | — | — |
| AI vishing usage-minute metering | ○ | — | — | — | — | — | — | — | — |
| Deepfake attachment scenarios | ○ | ○ | ○ | — | ○ | — | — | — | — |
| Video deepfake generation | ○ | — | — | — | — | — | — | — | — |
| Natural-language AI reporting | ● | ○ | — | — | ○ | — | — | — | — |
| MCP-assisted campaign creation | ● | — | — | — | — | — | — | — | — |
| AI content and speech studio | ○ | — | — | — | ○ | — | — | — | — |
| AI-generated awareness creatives | ○ | — | — | — | — | ○ | — | — | — |
| AI chatbot for learners | ● | — | — | — | — | — | — | — | — |
| ▾ Content & learning | |||||||||
| Automated training campaigns | ● | ● | ● | ● | ● | ● | ○ | ● | ● |
| Adaptive, risk-based training | ● | ● | ● | ○ | ● | ● | ○ | ○ | ● |
| Micro-learning video library | ● | ● | ● | ● | ● | ● | ○ | ● | ● |
| Interactive SCORM courses | ● | ● | ● | ● | ○ | ● | — | ○ | ○ |
| Gamification and leaderboard | ● | ● | ○ | ○ | ● | ● | — | ○ | ○ |
| Games (puzzle, role-based, escape room) | ● | ○ | — | — | ○ | ○ | — | — | — |
| Posters, wallpapers, infographics | ● | ● | ● | ● | ○ | ● | — | ○ | ○ |
| Newsletters and comic strips | ● | ● | ○ | ● | — | ○ | — | — | — |
| Multi-language content | ● | ● | ● | ● | ● | ● | ○ | ● | ● |
| Co-branding | ● | ● | ● | ● | ● | ● | — | ○ | ○ |
| Completion certificates | ● | ● | ● | ● | ○ | ● | — | ○ | ○ |
| Knowledge assessments and quizzes | ● | ● | ● | ● | ● | ● | ○ | ● | ● |
| Custom content upload | ● | ● | ● | ● | ○ | ○ | — | — | — |
| Manager escalation with reminders | ● | ○ | ○ | ○ | ○ | ○ | — | ○ | — |
| Training enforcement (AD blocking) | ● | — | — | — | — | — | — | — | — |
| ▾ Reporting & analytics | |||||||||
| Single dashboard, simulation + training | ● | ● | ● | ● | ● | ● | ○ | ● | ● |
| Per-user risk score | ● | ● | ● | ● | ● | ● | ○ | ● | ● |
| Industry benchmarking | ○ | ● | ● | ○ | ● | ● | ○ | ○ | — |
| Repeat-offender reporting | ● | ● | ● | ● | ● | ○ | ● | ○ | — |
| Geo-location click analytics | ● | ○ | ○ | ○ | — | ○ | ○ | — | — |
| Executive PDF reports | ● | ● | ● | ● | ● | ● | ● | ● | ○ |
| Custom report builder | ● | ○ | ○ | ○ | ○ | ○ | ○ | — | — |
| Scheduled report delivery | ● | ● | ● | ● | ○ | ● | ● | ○ | — |
| Multilingual report exports | ● | — | ○ | — | — | ○ | — | — | — |
| Reporting and webhook APIs | ● | ● | ● | ● | ● | ● | ● | ○ | — |
| Smart / dynamic groups | ● | ● | ● | ○ | ● | ○ | ○ | ○ | — |
| ▾ Administration & identity | |||||||||
| SSO / SAML | ● | ● | ● | ● | ● | ● | ● | ● | ● |
| Two-factor authentication | ● | ● | ● | ● | ● | ● | ● | ● | ○ |
| AD / SCIM user provisioning | ● | ● | ● | ● | ● | ● | ● | ● | ○ |
| Google Workspace sync | ● | ● | ● | ● | ● | ● | ○ | ○ | ○ |
| JumpCloud AD sync | ● | ○ | — | — | — | — | — | — | — |
| On-prem directory sync agent | ● | ○ | ○ | ○ | — | ○ | ○ | — | — |
| Nested groups and hierarchy | ● | ● | ○ | ● | ○ | ○ | ○ | — | — |
| Department and location attributes | ● | ● | ● | ● | ● | ● | ● | ○ | ○ |
| Role-based admin access (IAM) | ● | ● | ● | ● | ○ | ○ | ● | ○ | — |
| Audit trail with old/new values | ● | ○ | ○ | ○ | ○ | ○ | ○ | — | — |
| Teams / Slack notifications | ● | ○ | ○ | ○ | ● | ○ | ○ | — | — |
| On-premise deployment option | ○ | — | — | — | — | — | ○ | — | — |
| ▾ Delivery & support | |||||||||
| Cloud SaaS delivery | ● | ● | ● | ● | ● | ● | ● | ● | ● |
| Managed / concierge programme | ○ | ○ | — | ○ | ○ | ○ | ○ | ● | — |
| Dedicated customer success manager | ● | ○ | ○ | ○ | ● | ● | ○ | ● | ○ |
| Email support, 8×5 | ● | ● | ● | ● | ● | ● | ● | ● | ● |
| Phone support, 8×5 | ● | ● | ● | ○ | ○ | ○ | ○ | ● | ○ |
| Tool operation training | ● | ● | ● | ● | ● | ● | ● | ● | ○ |
| Managed content production quota | ● | — | — | — | — | — | — | ○ | — |
| Published per-user rate card | — | ● | — | ● | ○ | — | — | ○ | ○ |
Each vendor is scored at its highest published tier — KnowBe4 SAT Advanced, ThreatCop Enterprise, SoSafe Enterprise and so on — so this is a ceiling comparison, not a like-for-like price-tier comparison. Columns are ordered by coverage: full capabilities score 1, qualified capabilities 0.5. ● published capability · ○ add-on, higher tier, region-limited or otherwise qualified · — no published claim found, which is not the same as absent. Coverage is not quality: a vendor can publish nine simulation channels and run all of them badly.
Per-vendor dossiers
In coverage order, same as everywhere else on this page. Each dossier carries the pricing model explainer, full rate table, a worked example at three headcounts, and the source URL with retrieval date.
Methodology
Every figure on this site is classed by where it came from, and the class travels with the number everywhere it appears.
Public means the vendor states the rate on a page it controls. Sourced means the rate appears in a named reseller listing, cloud marketplace, review-platform pricing page or aggregated contract dataset — useful, but one step removed. Quote-only means we found no verifiable number and refuse to manufacture one.
Prices are per user per year in USD, billed annually, at list. Where a vendor quotes per user per month we multiply by twelve and say so. Where a vendor publishes only a contract floor we show the floor and leave the per-user cell empty. Volume bands are reproduced as published, never interpolated between them.
Rates are re-verified quarterly. Where a figure could not be re-confirmed at the last pass it is removed rather than carried forward.
Frequently asked
How much should I budget per employee per year?
For 250 to 2,000 seats with phishing simulation and standard reporting, $12 to $28 per user per year covers every vendor with a verifiable list price. Below 100 seats, contract minimums rather than rates set your cost. Above 5,000 seats every published rate card stops and you are negotiating.
Why do most security awareness vendors hide their pricing?
Because the product is close to undifferentiated at the content layer and the real variance is in analytics and services, which are easier to sell in conversation than on a page. Opacity also protects the discount ladder: a published rate becomes the ceiling every buyer negotiates down from.
Is a quote-only vendor automatically more expensive?
No. Aggregated contract data shows quote-only vendors landing both above and below published list rates. What is reliably true is that they cost more to evaluate, because you cannot eliminate them on price at the RFI stage.
Does the calculator show what I will actually pay?
It shows list. Real-world discounts run 22 to 35% for mid-market and 40 to 60% at enterprise scale, almost all of it tied to multi-year commitment. Treat the calculator output as the ceiling and the starting point of the negotiation.
What is not in these numbers?
Implementation and onboarding fees, SSO or directory-integration work, custom content production, translation beyond the bundled languages, and internal admin time. Budget 20 to 40% on top of licence cost for a first-year programme.
Which security awareness training platform has the most features?
Across the 75-point capability matrix above, scored at each vendor's highest published tier, ThreatCop leads with 65 published capabilities and 8 qualified, followed by KnowBe4 with 45 published and 14 qualified. Coverage is not quality, and ThreatCop publishes no per-user rate — the two axes are independent, which is the entire point of this page.
How much does KnowBe4 cost per seat?
KnowBe4 now publishes two plans — SAT Foundation and SAT Advanced — on a three-year term, with a 25-seat minimum (rates as of May 2026). Annualised per seat, SAT Foundation runs from $28.80 at 25–50 seats down to $19.56 at 501–1,000 seats; SAT Advanced runs from $45.00 down to $33.48 across the same bands. Above 1,000 seats KnowBe4 quotes. The former Silver, Gold, Platinum and Diamond tiers have been retired, and APIs, webhooks, security roles and Smart Groups now ship on both plans — SAT Advanced mainly adds the 1,000+ Advanced Training Library and unlimited Smart Groups.
How often is this page updated?
Rates are re-verified quarterly against the vendor's own pricing page or the named reseller listing. Any figure that cannot be re-confirmed is removed rather than carried forward, which is why some vendors move between evidence classes between refreshes.