Phishing Training Cost: Free vs Per-Seat vs In-Person

Phishing training cost for a Massachusetts employer runs from nothing, using free federal guidance, to between $19.56 and $45 per employee a year on KnowBe4's published per-seat list prices, with managed programs and in-person sessions quoted per engagement. Seat count, contract term and the staff hours spent in training move the total more than the course itself does.

This is the buyer's layer under does security awareness training work, which sets out the research on whether training changes behavior. That evidence is taken as given here. What follows compares what each option costs, what it buys, and where the free ones stop.

Where can a Massachusetts employer find free phishing training?

Four federal sources cost nothing and need no account. The Federal Trade Commission's Cybersecurity for Small Business guidance, updated in January 2026, covers eight topics, including how to protect a business from phishing. The National Institute of Standards and Technology keeps a Small Business Cybersecurity Corner page on phishing that explains how to spot a suspicious request and verify it through known contact details, with a recorded video session attached.

CISA, the federal cybersecurity agency, publishes a Cybersecurity Awareness Month 2026 toolkit with graphics and presentations an organization can use to build its own campaign for staff. CISA also wrote Phishing Guidance: Stopping the Attack Cycle at Phase One (October 2023) with the National Security Agency, the FBI and MS-ISAC, the information-sharing center for state and local governments. Its section for smaller organizations says small businesses "are encouraged to implement commercial phishing awareness training programs to employees" and points to the free NIST material alongside.

The Commonwealth runs its own program, and it is not open to private employers. The Executive Office of Technology Services and Security runs a free Cybersecurity Awareness Program, with training and simulated phishing, for cities, towns, school districts, retirement boards and similar public bodies, and participants need an email address on their own government domain. What a private employer's staff can use is the free home course open to any Massachusetts resident, which a memo of November 17, 2025 from the Public Employee Retirement Administration Commission says is reached by emailing [email protected].

Free material is content without a program. None of the federal sources sends a simulated phishing message to your staff, tracks who finished what, or produces a dated record. Someone inside the company has to schedule it, deliver it, chase completions and file the evidence, and that person's hours are the real price. The mechanics that free material teaches well are laid out in how phishing actually works and how to spot it.

What do per-seat phishing training platforms charge?

Per-seat platforms bundle a course library with simulated phishing and completion reports, billed for each person enrolled. KnowBe4 posts its list prices (MSRP) on its own pricing page, which makes it a usable public reference point. As read on October 24, 2026, its SAT Foundation tier lists at $2.40 per seat per month for 25 to 50 seats, falling to $1.63 at 501 to 1,000 seats, and its SAT Advanced tier runs from $3.75 down to $2.79, all on a three-year term.

Annualized, that is $28.80 down to $19.56 per seat a year on Foundation and $45.00 down to $33.48 on Advanced. A 40-person firm in the smallest band would list at $1,152 a year on Foundation. A 400-person company in the 251 to 500 band would list at $8,640 on Foundation or $14,208 on Advanced. The smallest band pays about 47% more per seat than the 501 to 1,000 band for the same tier, so the smallest firms pay the most per person for identical software.

Read these as one vendor's list prices, not a market average and not a quote. The rates assume a three-year commitment, so ask for the one-year figure before comparing. Add-ons, including compliance content and third-party integrations, carry their own per-seat prices on the same page.

Scale changes the arithmetic. Massachusetts funded its 2023 municipal round with $250,000 in capital funds from the 2022 General Governmental Bond Bill to train more than 50,000 employees across 177 municipalities and school districts, according to the Executive Office of Technology Services and Security's February 2023 announcement. That works out to under $5 per employee for a buyer of 50,000 licenses, against $28.80 at list for a buyer of 40. The license is one line among several, which is the argument in the sticker price is the smallest line item in technology adoption.

What do managed programs and in-person sessions add?

A managed program puts someone outside the company in charge of running the platform: choosing and scheduling simulations, chasing completions, reading results and reporting them to leadership. It is quoted per client, either per seat on top of the license or as a monthly fee. No neutral, dated public benchmark for managed pricing could be verified as of October 2026, so treat any provider's figure as that provider's quote.

What managed buys is operating time. Someone has to decide that accounts payable gets a payment-change lure in March and that new hires get the onboarding module in their first week. That is the work that turns a license into a program, and it is the part that lapses first when nobody owns it.

In-person sessions are priced on preparation and time in the room. The cost drivers are scoping, building examples from the messages your own staff receive, the number of sessions needed to reach every shift, travel, and the hours of everyone attending. A session for the front desk of a Worcester clinic and one for the purchasing team of a Shrewsbury manufacturer are different jobs with different preparation.

In person earns its cost when the problem is in the room: a shared workstation, a front desk that takes walk-in requests, a crew that does not sit at email all day. Remote sessions cover most other cases with no travel line, and they can be recorded for the next hire. What on-site help buys over remote is weighed in a technology partner in Worcester and Shrewsbury, and why short role-specific sessions land better than a company-wide module is the point of building a security culture.

What drives phishing training cost up or down?

Six things, and the largest of them never appears on an invoice.

• Seat count. Per-seat bands reward size, so a 30-person firm pays more per person than a 600-person one for the same tier, so ask whether each contractor with a company mailbox counts as another seat.
• Contract term. Published list prices like the one above assume a multi-year commitment, so ask what a shorter term or a mid-term rise in headcount does to the rate.
• Channels covered. Email simulations are the baseline, so ask whether text and phone simulations are included, because smishing and vishing reach staff outside the inbox.
• Role-specific content. A module for accounts payable on business email compromise takes more work to build or buy than a generic annual course, and it is the part that matches what that role receives.
• Staff time. A one-hour annual module for 40 people is 40 staff hours of payroll before anyone counts the coordinator, and short sessions spread through the year use the same hours with less disruption to the day.
• Records. A format that produces dated completions per person saves the hours of rebuilding them later, though a completion rate shows attendance and says little about behavior, the trap described in why your team games every metric.

The rule itself sets no budget. Section 17.03(1) of 201 CMR 17.00, as published on mass.gov, makes the required safeguards appropriate to the size, scope and type of business and to "the amount of resources available to such person." Section 17.03(2)(b) then lists ongoing employee training among the safeguards a program must evaluate, without naming a format, a vendor or a price. Who the rule covers and what else a written program must contain are set out in Massachusetts WISP requirements under 201 CMR 17.00.

Resources are a factor in what counts as appropriate, not an exemption from it. Nothing in the text requires a paid product, so free material can carry a small firm's training if someone owns it and keeps the record.

What should you ask before buying phishing training?

Five questions separate a price from a program, and each works for a platform, a managed provider or a trainer coming in person.

1. Ask what counts as a seat. Shared mailboxes, contractors and seasonal staff may or may not be billed, and headcount changes mid-term need a stated rule.
2. Ask for the price on a one-year term. Set beside the three-year rate, it shows what the longer commitment saves each year.
3. Ask which channels the simulations use. Email only, or text and voice as well, and what the second and third channels add to the bill.
4. Ask who runs the program week to week. Name the person, inside or outside the company, who schedules campaigns, reads results and follows up with staff.
5. Ask what record you will hold at the end of the year. Dated completions per person, in a file you can keep without the vendor, are what a review or an investigation will ask for.

The last question matters most on the day you change vendors. A training history that lives only in the vendor's dashboard can leave with the contract, which is exactly what vendor contract exit terms should settle before signing.

For a firm of a few dozen people, free federal material, a named internal owner and one or two short role sessions a year are a sound start. A platform earns its price once simulations and records are needed at a scale nobody can run by hand.

Not sure? Check before you act

Whichever option you pay for, the habit it should leave behind is the one in how to check if a message is a scam, and it costs nothing to teach.

1. Pause first. A deadline inside a message is pressure, and pressure is the tactic.
2. Read the sender's address and each link's domain one character at a time. On a call or a text, treat the caller ID or the number shown as unverified.
3. Find the company or person yourself. Call back on a number you already hold, never the one supplied in the message.
4. Screenshot it and ask your company's approved AI assistant whether the company is real, the domain matches and the request fits a known scam. Crop out customer and personal data, never upload the attachment, and treat the reply as a second opinion.
5. Report it through the channel your company set up. A report that turns out to be harmless still helps whoever reads the next one.
6. Call the bank if money moved or a login was entered. Ask for a recall, then file a complaint at ic3.gov.

Where we sit

Kief Studio runs team sessions on this subject, so read the in-person and managed sections knowing which side of the table they come from. Sessions start from the requests your staff receive and end on the one check each role makes. They are remote by default, and in-person sessions in Central Massachusetts are scoped in advance.

Kief Studio uses custom pricing, set by what the work is for, how large the business is, what it needs and which technology it already runs. Between sessions, kief.dev's free phishing analyzer checks a suspicious link without a signup. This is general information, not legal advice.

Choosing a program now? Tell us how many people you have, which roles handle money or data, and what you use today, and we will suggest the lightest option that fits, free ones included. Start on the consulting page or contact Kief Studio directly.

Related reading

• Suspicious email at work? What to do, step by step
• The cost of a data breach in Massachusetts
• What is business email compromise? How to stop it
• How phishing actually works and how to spot it

Frequently Asked Questions

Does 201 CMR 17.00 require phishing simulations?

No. The text of 201 CMR 17.00 on mass.gov never mentions phishing or simulations. Section 17.04(8) requires education and training of employees on the proper use of the computer security system and the importance of personal information security, and leaves the method to the business.

Do temporary and contract workers need security training in Massachusetts?

Yes, at a business covered by 201 CMR 17.00. Section 17.03(2)(b) names "ongoing employee (including temporary and contract employee) training," so seats or sessions should be budgeted for temps and contractors as well as permanent staff.

How often should employees review phishing training?

At least once a year. CISA's 2023 phishing guidance, written with the NSA, the FBI and MS-ISAC, advises smaller organizations to require an annual review of phishing training material and to close each cycle with a check that employees retained it.

What should a phishing training record show for a Massachusetts WISP?

Each person's name, the date, the topic covered and how it was delivered, kept in a file the business controls. A dated record across several years is what shows the training was ongoing rather than a single onboarding event.

Should phishing training cover text messages and phone calls?

Yes, wherever staff use phones for work. Text and voice scams reach people outside the email filter, so a program limited to email simulations leaves the channels employees answer on the move untested, and the budget should allow for them.

Who should own phishing training at a small company?

One named person, usually in operations, with time set aside to schedule sessions, chase completions and keep records. Without an owner, free material goes unused and a paid platform runs on its default settings, which rarely match what any one role receives.

Is in-person phishing training better than online training?

Not by format alone. In person suits teams that share devices or work away from email, and online suits spread-out staff and new hires. The examples used and how easy reporting is afterward decide more than where the session happens.