Security awareness and phishing simulation

Security awareness and phishing simulation software runs simulated phishing campaigns against a client's staff, automatically enrolling anyone who clicks into short training on what they missed, and tracks how susceptibility changes over repeated campaigns. A training content library covers broader security topics beyond phishing, and a phish-reporting button, usually a mail client add-in, lets users flag suspicious email for review. Some products extend simulation to smishing, text message phishing, and vishing, voice phishing, beyond email alone. This category does not filter or block malicious email itself; that is email security, a separate category that some vendors also sell and sometimes bundle with training.

Pricing is per user per month or per year, usually with volume discounts at higher user counts. Compliance training modules for specific regulatory requirements are sometimes a separate add-on rather than included in the base price.

Phishing simulation campaigns and the training content library are the core of the category; check how varied and current the simulated phishing templates are, since a stale library trains users to recognise old tricks rather than current ones. Automated remediation training, enrolling a user in relevant training the moment they fail a simulation, keeps the response timely rather than delayed to a scheduled session. Client-facing reporting matters for showing a client measurable improvement, and Microsoft 365 and Google user sync reduces the manual work of keeping the enrolled user list current as staff join and leave. Gamification and multi-language content matter depending on the client base you serve.

PSA integration for billing helps reconcile per-user pricing against actual headcount each month, similar to other user-priced categories. User sync with Microsoft 365 or Google Workspace is the integration that matters most operationally, since manually maintaining enrolled user lists across many clients does not scale.

Ask about the contract term, whether pricing is annual or monthly, and what happens to a client's phishing simulation history and training records if you switch vendors. Ask whether compliance training modules for specific regulations are included or a separate cost.

A small MSP can typically run a lighter product with basic phishing simulation and default training content for a handful of clients without needing deep compliance modules. A larger MSP serving clients with formal training requirements or multiple languages in their workforce more often needs compliance modules, multi-language content and detailed client-facing reporting to satisfy those obligations.