I received a nonprofit quote from KnowBe4 for about $2,800 over three years for 30 users. I'm mainly looking for phishing simulations and security-awareness training. Is that already a competitive price, or are there less expensive services worth considering? I'm also interested in how pricing changes as the organization grows and whether vendors have minimum-seat requirements.
5 Answers
There are several competitors worth getting quotes from, including Huntress Security Awareness Training, Ninjio, usecure, CanIPhish, Keepnet, Boxphish, BullPhish, and Phished. Huntress has worked well for some teams that wanted a simpler platform, while Ninjio focuses heavily on training videos and simulations. Product quality and administration vary, so ask for a trial before committing.
If you already have Microsoft 365, check which licensing tier you’re using. Microsoft’s higher-end plans include phishing simulations and security training, although they cost more overall and include many other security features. For Microsoft 365 Business customers, a dedicated third-party platform may still be the better value.
We’re on a Business plan, so a third-party service probably makes more sense. I also didn’t realize Microsoft included training and simulations in some of its enterprise plans.
One caveat: Microsoft’s training tools may not be as flexible for recurring automated campaigns. Some organizations have found the scheduling and automation less convenient than KnowBe4.
You may also want to ask whether your managed service provider already bundles awareness training into its services. Some MSPs include phishing tests and training as part of a broader security package. There are self-hosted and very inexpensive options too, but they generally require more setup and ongoing administration.
That works out to roughly $2.60 per user per month, which is pretty reasonable—especially with a nonprofit discount. At only 30 users, many providers charge a minimum platform fee, so switching vendors may not reduce the total by much. Compare the nonprofit pricing, renewal terms, and what happens if your headcount increases during the contract.
That makes sense. I hadn’t considered that we might be paying a vendor minimum rather than strictly paying per user.
For comparison, Microsoft Defender Attack Simulation Training is another option, but it usually requires the appropriate licensing and may cost more than your current quote when purchased separately. Proofpoint and some bundled email-security offerings can be considerably more expensive. For 30 users, $2,800 over three years sounds competitive if the automation, content, reporting, and renewal pricing meet your needs.
We had a poor experience managing Ninjio and eventually moved to Huntress. The difference in usability and support was significant for us.