Why do two companies quote $3,000 and $30,000 for what sounds like the same phishing simulation tool? That question stops a lot of security teams cold. The answer usually isn’t that one vendor is gouging and the other is generous. It’s that “phishing simulation pricing” hides a pile of variables: how you buy it, who counts as a user, what’s bundled in, and how much of the work you do yourself. Understanding those variables before you take a demo call is the difference between a fair deal and a renewal surprise. This guide breaks down how the pricing actually works, where costs creep in, and what to check before you sign.
What “Phishing Simulation Pricing” Really Covers
Phishing simulation is the practice of sending fake phishing emails to your own employees to see who clicks, who reports, and who hands over credentials. It’s a staple of security awareness programs, and government frameworks like the NIST Cybersecurity Framework treat awareness training as a core safeguard rather than a nice-to-have. That matters for budgeting: you’re not buying a novelty, you’re buying a control that auditors and insurers increasingly ask about.
The confusion starts because vendors sell very different things under the same label. Some sell a standalone simulation engine. Others bury simulation inside a much larger human risk management platform that includes training libraries, reporting dashboards, and integration with your email stack. The price reflects the box you’re actually buying, not the feature you searched for.
A useful mental model: the sticker price is rarely a single number. It’s a bundle of four cost layers.
| Cost layer | What it includes | How it’s usually priced |
|---|---|---|
| Platform subscription | Simulation engine, templates, reporting | Per user, per year, tiered |
| Training content | Courses, microlearning, policy tools | Bundled or add-on |
| Add-ons | Custom landing pages, extra templates, API access | Fixed fee or tier upgrade |
| Services | Managed campaigns, consulting, onboarding | Day rate or annual contract |
The Per-Seat Model: The Most Common Way You’ll Pay
Most recurring phishing simulation platforms price per user, per year, often with tier breakpoints based on employee count. A 150-person company and a 5,000-person enterprise rarely see the same rate per head, and the smaller buyer often pays more per seat because they can’t hit volume discounts.
Two traps show up here constantly.
First, “user” is a slippery word. Does a user mean a licensed mailbox? An active employee? A contractor with a login? A shared inbox? Vendors define this differently, and the definition can swing your bill by double digits. Always ask for the exact definition in writing.
Second, tier cliffs. A vendor might price 1–250 users at one rate and 251–500 at a lower rate. If you’re at 248 employees, you may be quoted the higher tier even though you’re nowhere near the next band. Ask whether pricing is banded or graduated, because banded pricing punishes you for being one person over a line.
Why Per-Seat Pricing Isn’t the Whole Story
Here’s the part that bites finance teams: the per-seat number is the visible cost. The real cost of a phishing program includes labor. Someone has to build campaigns, whitelist sending domains, review results, and chase the people who clicked. That work doesn’t appear on the invoice, but it’s real.
A practical rule from the field: if nobody owns the program internally, you’ll either under-use the tool or pay the vendor for managed services. Both outcomes change your effective price. Before comparing quotes, decide whether you’re buying software or software plus a team.
This is the same lesson that shows up across SaaS buying generally. The listed price is a starting point, not the total. If you’ve ever compared subscription tiers on something like Leonardo AI’s pricing plans and features, you’ve seen how feature gating quietly reshapes the “cheap” tier into something that doesn’t do what you need.
Bundling: When Simulation Comes Free (Sort Of)
Many vendors now sell simulation as part of a broader awareness platform. On paper, simulation looks “included.” In practice, you’re paying for the platform, and simulation is one module among many.
Bundling is often good value if you actually need the other modules. It’s poor value if you only want simulations and end up paying for a training library nobody completes. Ask a blunt question: what would this cost if I removed simulation? If the answer barely changes, simulation isn’t really the product you’re buying.
There’s a security angle to bundling too. Vendors that run simulations also handle employee data and email infrastructure, which makes them a target. The same phishing awareness you’re teaching staff applies to your vendor risk review. Understanding what spear phishing is helps here, because the most convincing attacks are the ones that mimic your own tools and vendors. A simulation vendor with weak controls is an ironic liability. (Phishing)
Add-Ons and the Hidden Cost Creep
Add-ons are where budgets quietly expand. Common ones include:
- Custom landing pages that mimic your real login screen, often priced per template or per campaign.
- Extra template libraries beyond the default set.
- API and SIEM integration for feeding results into your security stack.
- Reporting modules with executive dashboards, sometimes a separate SKU.
- Managed campaign services, where the vendor runs simulations for you.
None of these are inherently bad. The mistake is assuming they’re included. A common pattern in practice is a buyer signing a three-year deal based on the base tier, then discovering mid-term that reporting exports are gated behind an upgrade. Get the full feature list mapped to tiers before you negotiate, and ask specifically which features are “included at all tiers.”
Free Tiers, Trials, and the Evaluation Trap
Several vendors offer free tiers or trials, usually capped by user count or campaign volume. These are genuinely useful for testing deliverability and template quality. They’re less useful for judging total cost, because the caps tend to expire exactly when your program starts to matter.
A practical evaluation approach that works in the real world:
- Run a trial campaign against a small, consenting group, ideally IT and a friendly department.
- Check whether simulated emails actually land in inboxes rather than spam filters.
- Verify the reporting you get without an upgrade.
- Ask what happens to your data and campaign history if you leave.
- Get a written quote for your actual headcount, not a “starting at” figure.
That last point matters more than people expect. Many vendors don’t publish list prices at all and quote custom rates, which means two buyers with identical headcounts can pay very different amounts depending on timing and negotiation. Treat any published figure as a lead to verify, not a fact to budget against.
What the Frameworks Say (and Don’t Say)
Government and standards guidance is useful for justifying spend, but it rarely sets prices. NIST’s guidance on building security awareness programs, and resources from bodies like CISA, describe what a program should include: recurring training, realistic simulations, reporting mechanisms, and measurement. They don’t tell you what to pay.
That’s actually helpful. It means you can frame the purchase around program requirements rather than vendor features. If your auditor wants evidence of recurring simulation and tracked completion, you now have a defensible reason to buy the reporting module instead of arguing about it later. The UK’s NCSC has published similar practical guidance on phishing and simulated phishing exercises, again focused on method rather than cost.
For context on how pervasive the threat is, the APWG Phishing Activity Trends Reports track phishing volumes over time. They’re industry research rather than government data, but they’re widely cited and useful for building the internal business case.
Comparing Quotes: A Practical Checklist
When quotes land, compare them on these dimensions rather than the headline number:
| Question | Why it matters |
|---|---|
| How is a “user” defined? | Changes your bill directly |
| Is pricing banded or graduated? | Avoids tier cliffs |
| Which features are gated by tier? | Prevents mid-term upgrades |
| What’s the contract length and renewal uplift? | Multi-year deals hide increases |
| Is onboarding and support included? | Services often cost extra |
| What’s the exit and data-portability process? | Avoids lock-in |
A useful habit: normalize every quote to cost per user per year, all-in, including any add-ons you know you’ll need. That single number makes wildly different proposals comparable, and it exposes the vendor whose “cheap” base tier balloons once reporting is added.
Common Mistakes Buyers Make
A few patterns show up again and again, and they’re avoidable.
Buying on the demo, not the invoice. Demos show the best-case configuration. Ask to see the tier you’re actually buying.
Ignoring the labor cost. A tool nobody runs is a wasted subscription. Budget time for campaign management or budget for managed services.
Skipping the consent and policy conversation. Simulated phishing touches employee trust. Loop in HR and legal early, and be transparent about the program’s purpose. Programs that feel punitive backfire; programs framed as help tend to get better reporting rates.
Forgetting the phishing basics internally. Your simulation program only works if staff understand the underlying threat. A short primer on what phishing is and how to recognize it makes the simulations land better, because people have a framework for what they’re seeing.
Over-buying on day one. Start with a tier that covers your headcount and core reporting, then upgrade when you have data showing you need more. Vendors will happily sell you the top tier; your job is to buy the tier you’ll actually use.
Where the Money Actually Goes
Strip away the marketing and phishing simulation pricing reflects four things: the size of your workforce, how much of the platform you use, how much labor you outsource, and how hard you negotiate. Vendors with published list prices tend to be simpler to compare; vendors with custom quotes tend to reward preparation. Neither is automatically cheaper.
The practical takeaway is to treat pricing as a design decision, not a shopping decision. Decide what your program needs to prove, map those requirements to features, normalize every quote to an all-in per-user figure, and negotiate the renewal terms before you sign the first contract. Do that, and the gap between the $3,000 quote and the $30,000 quote usually becomes obvious, and usually defensible.
Conclusion
Phishing simulation pricing isn’t mysterious once you know what’s inside it. Per-seat subscriptions dominate, bundling muddies comparisons, add-ons inflate the real number, and labor is the cost nobody puts on the quote. The buyers who get fair deals aren’t the ones who negotiate hardest on day one. They’re the ones who define “user” precisely, map features to tiers, normalize quotes to an all-in per-user figure, and check renewal terms before signing. Do that groundwork, and you’ll pay for the program you actually run rather than the one the demo showed you.
Frequently Asked Questions
How much does phishing simulation typically cost per user?
Most vendors price per user per year, but published rates vary widely and many quote custom pricing. Rather than anchoring on a headline figure, ask each vendor for an all-in cost per user per year that includes the reporting and support you need. That normalized number is the only fair comparison.
Is phishing simulation usually sold on its own or bundled?
Both models exist. Standalone simulation tools are common, but many vendors now bundle simulation into broader security awareness or human risk platforms. Bundles can be good value if you’ll use the training and reporting modules, and poor value if you only want simulations. Ask what the price would be without simulation to find out what you’re really paying for.
Do free trials or free tiers tell me anything about real pricing?
They tell you about deliverability, template quality, and basic usability, which are genuinely useful. They rarely tell you about total cost, because free tiers are usually capped by user count or campaign volume and expire before your program matures. Use trials to test the product, and written quotes to budget.
Why do two companies with the same headcount get different quotes?
Several reasons: timing, contract length, negotiated discounts, how “user” is defined, and whether services are included. Vendors that don’t publish list prices quote case by case, so identical headcounts can produce very different numbers. Normalizing to an all-in per-user figure and comparing contract terms side by side closes most of that gap.
What hidden costs should I watch for?
The biggest are add-ons gated behind higher tiers, such as custom landing pages, advanced reporting, and API access. Onboarding and managed campaign services are often priced separately too. The other hidden cost is internal labor: someone has to build campaigns and review results, and that time is real even though it never appears on the invoice.
Does compliance guidance require me to buy a specific tool?
No. Frameworks and government guidance describe what a security awareness program should include, such as recurring training, realistic simulations, and measurement, but they don’t mandate vendors or set prices. That’s useful: you can justify the purchase around program requirements and evidence, then choose the tool and tier that meet them at a fair cost.
