Knowledge base › Security awareness
What does security awareness training cost?
Last updated
At Lumyo you pay a fixed amount per employee, from € 1.50 per month for phishing simulations. The awareness training costs € 3 per employee per month, both together € 4.50. With other providers the price depends on the number of employees, the format of the training and whether phishing simulations are included. In this article we set out our rates and explain all the cost factors honestly.
What does security awareness training cost at Lumyo?
At Lumyo you pay a fixed amount per employee. These are our rates:
| What | Price | What you get |
|---|---|---|
| Awareness training | € 3 per employee per month (€ 36 per year) | Interactive modules of 10 to 15 minutes, knowledge tests, certificate and progress reporting |
| Phishing simulations | € 1.50 per employee per month (€ 18 per year) | 10 phishing campaigns spread over the year, with baseline, follow-up measurement and trend reporting |
| Training and phishing together | € 4.50 per employee per month (€ 54 per year) | Everything above, plus targeted training for employees who click on a simulation |
| Onboarding (one-off) | € 350 | One-off setup and coordination at the start, also when you take both |
Every annual programme has a minimum of € 250 per year. A worked example: for 40 employees, training and phishing together cost 40 × € 54 = € 2,160 per year, plus € 350 onboarding in the first year.
The training platform is in development; awareness training is available from launch. Phishing simulations can start now. A quote is free and without obligation.
What are the costs of security awareness training?
There is no fixed market price for security awareness training. On the one hand you will find cheap, off-the-shelf e-learning packages where you set everything up yourself; on the other hand there are fully managed, ongoing programmes with customisation, phishing simulations and reporting. The price also scales with the number of employees.
With many providers the price per person for small teams is higher due to fixed base costs; at larger numbers the cost per employee drops thanks to economies of scale. Blended or classroom programmes and customisation are higher. The Lumyo rates above are fixed.
Important perspective: the average cost of a data breach in 2026 was USD 4.99 million (IBM, Cost of a Data Breach 2026). That figure is pushed up by large organisations, but the cause is the same at any size: the human factor plays a role in 62% of data breaches (Verizon DBIR 2026).
See our approach to security awareness for SMEs or phishing training for more information.
Factor 1: number of employees
The number of employees is the most important price-determining factor. Most providers work with a rate per employee or with tiered volumes. More employees means a higher total price, but a lower price per person. For small teams the fixed base costs - setup, management and reporting - weigh relatively more heavily, which makes the price per employee higher there.
Small business (10-50 emp.)
Manageable and quick to roll out. The cost per employee is higher, but the total investment remains limited and easy to oversee.
Medium-sized business (50-250 emp.)
Here economies of scale apply. The price per employee drops and segmentation per department or risk group becomes more attractive.
Factor 2: e-learning versus classroom
The format of the training has a big influence on the price. E-learning is the most scalable and therefore the most affordable per employee: staff complete modules at a time that suits them, without travel time or scheduled sessions. Classroom or live training costs more per person because of the trainer's involvement and the fixed agenda, but offers room for interaction and customisation.
- E-learning: lowest cost per employee, flexible, highly scalable
- Classroom: higher cost per employee, valuable for specific groups such as management
- Blended: a combination of online modules and a few live moments, a popular middle ground
Factor 3: one-off or ongoing
A one-off training gives a short boost, but awareness fades if it is not maintained. An ongoing programme with periodic repetition and new topics costs more per year, but delivers structural results and fits the philosophy behind frameworks such as NIS2 and ISO 27001, which require demonstrably recurring training.
- One-off: lower cost, short-lived effect, no proof of improvement
- Ongoing: higher annual cost, lasting effect, demonstrable for audits
Factor 4: adding phishing simulations
Many organisations combine awareness training with phishing training and simulations. A phishing simulation increases the price per employee slightly, but provides a concrete baseline measurement and shows over time how much awareness has improved. That measurability is often exactly what auditors, insurers and clients want to see.
What is included?
When comparing quotes, pay close attention to what is in the price. A complete programme typically includes:
- Access to the e-learning modules for all employees
- Periodic repetition and new topics throughout the year
- Any phishing simulations with a baseline and follow-up measurement
- Progress reporting and registration of participation (evidence for compliance)
- Support with the rollout and attention to management
Cheap packages often leave out reporting, repetition or guidance. Factor those elements in when comparing, otherwise you are comparing apples with oranges.
Hidden costs and what to watch out for
The price per employee is not the whole story. When comparing providers, organisations quite often run into costs that are not immediately visible in the quote. So watch out for the following points, so you are not caught by surprise:
- Entry or licence fees: some platforms charge a fixed annual base price on top of the rate per employee, which weighs especially heavily for small teams.
- Management and setup: a cheap package can turn out expensive if you spend all your own time setting up, inviting and following up employees.
- Reporting as an extra charge: the very reporting you need for compliance is sometimes not in the base package.
- Contract term and notice period: watch out for multi-year contracts with automatic renewal; these can work out more expensive in the long run.
- Language and localisation: not every international platform offers fully localised content, which affects effectiveness and therefore value per euro.
The cheapest option on paper is therefore not always the most economical in practice. Look at the total cost over a year, including your own time, and weigh that against what you actually get back in training, repetition, measurement and reporting.
ROI: the cost of a data breach versus the cost of training
The most important question is not what training costs, but what it saves. The average cost of a data breach in 2026 was USD 4.99 million (IBM, Cost of a Data Breach 2026): recovery costs, lost revenue, fines and reputational damage. That average is pushed up by large organisations and says little about an SME, but the cause is the same. The human factor plays a role in 62% of data breaches (Verizon DBIR 2026), and phishing is the most common initial access route at 17% (IBM, Cost of a Data Breach 2026).
Awareness training costs a fraction of that amount per employee. If the training demonstrably lowers the chance of a successful incident, then a programme more than pays for itself by preventing a single data breach. Moreover, the reporting provides direct evidence for auditors, insurers and clients who ask for NIS2 or ISO 27001 conformity.
So do not write off the investment as a cost item, but as an insurance that also gives something back: fewer incidents, faster reporting when something does go wrong, and demonstrable compliance. Where a cyber insurance policy only pays out after the damage has been suffered, training reduces the chance that it comes to that at all. That combination usually makes awareness one of the most economical security measures per euro of risk saved.
Frequently asked questions about the costs
What does security awareness training cost at Lumyo?
Awareness training costs 3 euros per employee per month (36 euros per year). Phishing simulations cost 1.50 euros per employee per month (18 euros per year); together that is 4.50 euros per month (54 euros per year). On top of that comes a one-off onboarding fee of 350 euros, and every annual programme has a minimum of 250 euros per year. The training is available from the launch of the training platform.
What does security awareness training cost per employee?
At Lumyo from 1.50 euros per employee per month for phishing simulations, 3 euros for the awareness training and 4.50 euros for both together. With other providers the price depends on number, content and whether phishing simulations are included. Bespoke classroom training is higher.
Why do the prices of security awareness training vary so much?
Due to differences in the number of employees, format (e-learning, classroom or blended), one-off or ongoing, and whether simulations and reporting are included.
Is e-learning cheaper than classroom training?
Yes, per employee usually. Classroom costs more per person but is valuable for specific groups such as management.
What does adding phishing simulations cost?
At Lumyo 1.50 euros per employee per month (18 euros per year). It gives you a concrete baseline measurement and proof of improvement.
Does security awareness training pay for itself?
Usually yes: a prevented data breach quickly saves a multiple of the training costs.