Buyer's Guide: Security Awareness Training (SAT) Platforms

Executive Summary

For a security leader buying security awareness training (SAT), the first decision is what the program has to prove. A platform built for compliance schedules courses and phishing tests and produces completion records. A platform built for behavior change scores each person’s risk, coaches people at the moment they make a mistake, and sends employees’ phishing reports to the team that removes the threat. Most platforms now claim both, so the demo has to show which one the product does well.

Three questions narrow the shortlist. Which email security product do you run? Does your security operations team want employees’ phishing reports, and can it handle them? Do you need risk scores built from other tools’ signals, or are simulation and training results enough?

The eight platforms in this guide take seven approaches. Some are training and simulation libraries. Some are awareness modules sold by an email security vendor. Others start from phishing reporting and removal, from gamified simulation, or from risk signals in other security tools. One comes from a training institute.

This guide sets out what NIST, CISA, the FBI and two federal rules say about awareness programs and AI-written phishing, all from their own pages. It then compares what each vendor’s own pages state, lists what to test, and explains how pricing works.

What Do NIST, CISA and the Regulators Expect From a Security Awareness Program?

NIST. NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program, was published in September 2024 and supersedes SP 800-50 (2003) and SP 800-16 (1998). NIST states that the publication provides guidance for federal agencies and organizations to develop and manage a life cycle approach to building a Cybersecurity and Privacy Learning Program (CPLP). NIST states that the program should encourage behavior change as part of risk management and lead to developing a privacy and security culture in the organization. NIST states that the guidance includes suggested metrics and evaluation methods to regularly improve and update the program as needs evolve. A program built on this guidance needs a platform that reports behavior over time, not only who finished a course.

Phishing simulation. NIST describes embedded phishing awareness training programs as programs in which simulated phishing emails are sent to employees, designed to prepare them to combat real-world phishing scenarios. NIST describes the NIST Phish Scale as a method created for implementers of cybersecurity awareness and phishing training programs to rate an email’s human phishing detection difficulty. Click rates from two campaigns cannot be compared unless the emails were equally hard to spot. Ask each vendor how it rates the difficulty of its templates, and whether you can rate your own.

CISA. CISA states that, according to the FBI’s 2024 Internet Crime Report, phishing topped the list of the five most reported cybercrimes, with 193,407 complaints. CISA states that threats evolve constantly, so once-a-year training is not enough. CISA advises making sure employees know to whom and how to report suspicious emails or phishing attempts. CISA advises that staff verify a message that feels off or unexpected, but not by replying or using any phone number or link in the message. CISA states that you do not need to create training materials from scratch, and that your IT provider, trade association or nonprofit may offer no-cost materials. CISA states that its phishing guide was created by CISA, NSA, FBI and MS-ISAC to outline phishing techniques malicious actors commonly use and to provide guidance for both network defenders and software manufacturers.

Regulation. The HIPAA Security Rule sets a standard to implement a security awareness and training program for all members of the workforce, including management. The HIPAA Security Rule lists four addressable implementation specifications under security awareness and training: security reminders, protection from malicious software, log-in monitoring and password management. The FTC Safeguards Rule calls for policies and procedures that ensure personnel are able to enact the information security program, including security awareness training that is updated as necessary to reflect risks identified by the risk assessment. Sector rules and contracts add their own requirements. Collect the ones that apply to you before the demo, and ask each vendor to show the report you would give an auditor for each.

How Does Generative AI Change Phishing, and How Do Awareness Platforms Respond?

What changed. On December 3, 2024, the FBI issued an alert titled Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud. The FBI states that generative AI reduces the time and effort criminals must expend to deceive their targets. The FBI states that generative AI tools can correct for human errors that might otherwise serve as warning signs of fraud. The FBI states that criminals use AI-generated text to appear believable to a reader in furtherance of social engineering, spear phishing and financial fraud schemes. The FBI states that criminals can use AI-generated audio to impersonate public figures or personal relations to elicit payments. The FBI states that criminals generate videos for real time video chats with alleged company executives, law enforcement, or other authority figures.

What that does to the old advice. CISA lists poor grammar and sentence structure, misspellings, and inconsistent formatting as indicators of a possible phishing attempt. CISA states that phishing scams are getting harder to spot, and that attackers may include personal or company-specific details to make fake messages appear real. A course that tells people to look for spelling mistakes leaves them unprepared for a message with none. CISA’s advice to verify a request through a known contact method does not depend on how the message was written. CISA defines phishing as a form of social engineering that uses email or malicious websites to solicit personal information by posing as a trustworthy organization. CISA defines vishing as social engineering that uses voice communication. CISA defines smishing as a form of social engineering that exploits SMS, or text, messages.

How vendors say they respond. KnowBe4 states that it offers AI-generated and personalized phishing and vishing simulations. Mimecast states that customizable phishing templates can be created with the Engage AI Generator, and simulations tailored by attack type, industry, and difficulty. Mimecast lists 200+ training modules on AI threats, phishing, malware and more, available in 27 languages. Hoxhunt states that it delivers phishing simulations across email, SMS, phone calls or Teams, using AI to mimic real-world attacks. Proofpoint states that ZenGuide can turn phishing attacks detected in an organization’s environment into safe simulation templates with AI ThreatFlip Workflow. Abnormal lists phishing, credential-harvesting, BEC, QR code and vendor-fraud simulations built from the real attacks Abnormal stops.

Phishing that reaches the inbox. Cofense states that it identifies coordinated phishing attacks using AI trained on real-world threats and patterns. Cofense lists replicating real-world threats, including smishing, vishing, and QR-code phishing, to help employees recognize and respond to evolving attack methods. Cofense states that its automated quarantine removes all variants across inboxes. Ask every finalist which of these functions are in the package you are quoted, and which need a separate product.

A simulation built from a real attack your filters caught tests people on the threats aimed at them. It also shows people messages your filters already stop, so ask how the vendor chooses which real attacks to reuse.

What Should a Security Awareness Training Platform Do?

Every platform in this guide sends simulated phishing and assigns training. They differ in four places: where simulations come from, how training is targeted, what happens to an employee’s report, and what the platform measures.

Targeting. Abnormal states that employees who interact with simulations more often get more frequent training and video lessons, while those who spot threats receive fewer. KnowBe4 states that Real-Time Coaching delivers contextual guidance in Slack, Google Chat and Microsoft Teams when it detects risky behavior. Mimecast states that it delivers context-aware nudges via email, Slack, or Teams to encourage safer behaviors in real time. Hoxhunt states that its simulations are personalized to each employee based on department, location, and more. Ask how often a person can be targeted before the program becomes noise, and who can change that limit.

Measurement. KnowBe4 states that its SmartRisk Engine analyzes user behavior to generate a dynamic Risk Score for every employee. Proofpoint states that ZenGuide applies a Detect, Intervene, Change Behavior, and Evaluate framework. Cofense states that its Command Center has a Competency Dashboard that measures secure behavior against relevant phishing threats at the employee and organizational level. SANS offers workforce security culture and knowledge assessments to establish a baseline and measure progress over time. SANS publishes a Security Awareness & Culture Maturity Model for moving a program in stages from compliance-focused to long-term, sustainable culture change. Ask each vendor which inputs feed its score, and whether you can see why a person’s score changed.

Reporting and response. Cofense lists one-click reporting into a global intelligence network. Hoxhunt states that its AI-powered detection and analysis resolves false-positive reports and categorizes incidents. Decide who triages reports, and how the person who reported hears back, before you switch the button on.

Delivery and records. Infosec states that SCORM as a service packages let you deliver Infosec IQ training from your learning management system. Infosec states that Infosec IQ reporting provides training documentation for HIPAA, PCI-DSS, SOC 2, CMMC and other frameworks. SANS lists over 50 training modules across 6 tracks, translated into over 34 languages. Abnormal states that its organization-specific security-awareness videos come with quizzes and are available in 30+ languages. If your training must sit in the corporate learning system, test the SCORM package there, with completion records flowing back.

Vendors in Security Awareness Training (SAT) Platforms

Representative vendors include Abnormal AI, Cofense, Hoxhunt, KnowBe4, Living Security, Mimecast Engage, Proofpoint Security Awareness (ZenGuide) and SANS Security Awareness. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors

The approaches below follow one question: what the awareness product is sold with.

A training library and simulation platform. KnowBe4 announced the completion of its acquisition by Vista Equity Partners. KnowBe4 states that its Phish-Prone Percentage, the share of employees likely to click a phishing link, drops from an industry average of 33.1% to 4.1% within one year. Infosec Institute was acquired by Cengage in 2022 and is part of the Cengage Work business unit. Infosec states that Infosec IQ offers a library of 2,000+ phishing templates.

An awareness module from an email security vendor. Proofpoint describes ZenGuide as delivering targeted, risk-based security awareness training. Proofpoint states that Human Risk Explorer correlates signals across data, awareness and threat risk, including user behavior, business role, access, phishing performance and attack exposure. On May 17, 2022, Mimecast announced the completion of its acquisition by funds advised by Permira. Mimecast states that Mimecast Engage provides visibility into human risk through the Human Risk Command Center. Mimecast lists 17+ integrations, including CrowdStrike, Okta and Netskope. If you already run one of these vendors’ email security, ask what its awareness module reads from it, and what it would cost to buy the module alone.

Coaching built from attacks the email security product blocks. Abnormal states that AI Phishing Coach uses the real attacks Abnormal stops and dynamic risk analysis to create simulations and training. The simulations depend on what the vendor’s own email security detects, so this approach fits organizations that run that product.

Phishing reporting and removal, with training. Cofense states that Cofense Phishing Training uses real phishing data for adaptive simulations and awareness programs.

Gamified, adaptive simulation. Hoxhunt states that it applies gamification and automated personalization at scale.

A human risk platform that reads other tools. Ashley and Drew Rose founded Living Security in 2017, and its first product was a cyber escape room. Living Security states that it reads signals from the security tools you already run to reveal human and agent risk. Living Security launched the AI-native Living Security Platform in 2026; its AI security analyst, Livvy, recommends the next step, and a person approves before playbooks act. Living Security publishes its Human Risk Management Framework, the signals, cohorts, playbooks and maturity model behind the platform, open under CC BY 4.0.

A training institute’s program. SANS states that its phishing platform offers pre-configured or customizable phishing tests, just-in-time training, and automated remedial courses.

Eight platforms across seven approaches; Proofpoint and Mimecast share one. The approaches were selected first, and the eight platforms are the ones the previous edition of this guide covered. A place in this table cannot be bought. This edition’s roster check also covered Infosec IQ, MetaCompliance, CultureAI and Hornetsecurity, and any of them can make its own case in the Spotlight below.

How Is Security Awareness Training Priced?

One of the eight publishes a list price on its own pages. KnowBe4 lists SAT Foundation from $2.40 per seat per month for 25 to 50 seats down to $1.63 for 501 to 1,000 seats, and SAT Advanced from $3.75 down to $2.79, on a 3-year term. Prices are per seat per month, so multiply by 12 and by your headcount, and check which content level the price covers.

Hoxhunt prices per employee, and its quote depends on how many employees you have and which capabilities you need. No price appears on the other six vendors’ pages cited in this guide.

If you buy awareness training from your email security vendor, ask for the awareness module priced alone and in any bundle, so you can see what the bundle discount depends on.

Count every seat the vendor will bill: contractors, seasonal staff and shared mailboxes. Add the internal time to run campaigns, answer reports and chase overdue training when you compare three-year cost.

How long does implementation take for Security Awareness Training (SAT) Platforms?

Set a baseline before training starts, and keep the email security and security operations teams in the rollout from the first week.

What should you ask vendors about Security Awareness Training (SAT) Platforms?

Ask each finalist to answer in writing and to show each answer in a pilot with your own users.

Related Resources