Cyber Aware and Infotrust both answer the question "how do we stop staff clicking dangerous emails" — but with two different products. Cyber Aware is a self-serve human-risk platform: monthly story-driven training, automated phishing simulations and framework evidence at a published per-seat rate. Infotrust is one of Australia's largest listed cyber security providers — it trades on the ASX as ITS — and sells awareness training as one line inside a managed-services relationship spanning managed SIEM, XDR, incident response and penetration testing. This head-to-head compares the two across cadence, price, evidence and scope for 2026.
TL;DR
- Choose Cyber Aware for a programme that runs itself: monthly campaigns from one setup, per-seat pricing with no seat minimums, Essential 8 and SMB1001 evidence out of the box.
- Choose Infotrust when the organisation is already buying managed security operations and wants awareness consolidated under the same Australian provider.
- Cadence: Cyber Aware builds a full year of monthly training and simulation campaigns from one setup; Infotrust delivers training as a service line inside an engagement.
- Price: Cyber Aware publishes per-seat rates; Infotrust quotes every engagement.
The two companies in one paragraph each
Cyber Aware is an Australian-built self-serve platform for security awareness training and phishing simulation. Its 120+ story-driven videos — each followed by a comprehension quiz — are assigned monthly, its 100+ phishing templates are refreshed weekly with AI-generated variants, and anyone who clicks a simulated phish is auto-enrolled into a remediation course the same day. Reporting turns overdue courses, failed quizzes and phishing clicks into a single human risk score per learner, exportable as branded PDFs, and the programme maps to Essential 8 and SMB1001 by default. Pricing is per seat with no seat minimums.
Infotrust is a listed Australian cyber security provider formed from more than a decade of legacy firms — Spirit Managed Services, Intalock Cyber Security and InfoTrust — with over 110 cyber security professionals and a 24/7 Security Operations Centre in Sydney, a finalist for SOC Provider of the Year at the Australian Cyber Awards 2025. In February 2026 it divested Nexgen Australia for $50 million to sharpen itself into a dedicated, sovereign security and managed-technology provider. Its portfolio spans managed SIEM, extended detection and response, incident response, penetration testing and compliance consulting, with data security awareness training offered as a service extension.
Head-to-head
| Dimension | Cyber Aware | Infotrust |
|---|---|---|
| What it is | Self-serve human-risk platform | Listed security provider with a managed services portfolio |
| Training content | 120+ story-driven videos with quizzes, assigned monthly | Data security awareness training as a service extension |
| Simulation cadence | Automated monthly campaigns from one setup | Delivered and scoped per engagement |
| Remediation | Same-day auto-enrolment in a failed-phishing course | Handled within the managed engagement |
| Framework evidence | Essential 8 and SMB1001 mapped out of the box | Compliance consulting services; no published training mapping |
| Pricing | Published per-seat rates, no seat minimums | Quote-based; not published |
| Best fit | Organisations needing a monthly programme without a services contract | Organisations already buying managed security operations |
Where Cyber Aware wins
Cadence that does not depend on an engagement. Cyber Aware's model is one setup producing a full year of monthly training assignments and phishing campaigns, running regardless of anyone's contract calendar. Infotrust's awareness training sits inside a managed-services relationship — it exists when the engagement exists.
Published pricing. Cyber Aware is per-seat with no seat minimums, so cost tracks headcount as people join and leave. Infotrust does not publish rates; every engagement is quoted.
Framework evidence by default. Cyber Aware maps to Essential 8 and SMB1001 out of the box — the frameworks Australian organisations, auditors and insurers ask about. Infotrust delivers compliance consulting, but no out-of-the-box training-to-framework mapping is published for its awareness line.
No credential harvesting. Cyber Aware's simulations report who clicked and who reported without collecting anyone's password.
One setup, nothing to forget. Cyber Aware's automation assigns monthly training and runs simulation campaigns without anyone building them: templates refresh weekly with AI-generated variants, enrolment syncs from the directory, and a click triggers same-day remediation automatically. The failure mode of most awareness programmes is not a bad module — it is a campaign that quietly stops happening after quarter two. Automation removes that failure mode entirely.
Where Infotrust wins
Security operations depth. A 24/7 Sydney SOC, managed SIEM, XDR and incident response are services Cyber Aware deliberately does not offer — awareness only, by design. An organisation that wants detection, response and training from one listed provider gets that from Infotrust.
Sovereign Australian capability at scale. More than 110 security professionals, ASX-listed governance and a deliberate post-divestment positioning as a sovereign provider — relevant for government agencies and enterprises with onshore requirements.
Compliance consulting. Infotrust's consultants work across compliance frameworks as a service. Cyber Aware evidences Essential 8 and SMB1001 automatically but does not consult an organisation through certification.
Which one fits your organisation
Choose Cyber Aware when: the buyer is an office manager, CFO or part-time IT lead with no security staff; the need is a standing monthly programme; the deliverable is evidence for auditors, insurers or tenders; and budget must scale with headcount. A security gap assessment answers first whether the human layer is even your biggest exposure.
Choose Infotrust when: the organisation already buys managed security operations — monitoring, SIEM, incident response — and wants awareness training consolidated with the same provider under one engagement.
For a school or education group specifically, the education-provider alternatives breakdown compares Infotrust against four platforms on exactly this trade-off.
FAQ
Which is better for a small business? Cyber Aware, in most cases. Per-seat pricing with no seat minimums keeps cost proportional to headcount, and the programme runs itself after setup. Infotrust quotes per engagement, which prices enterprise-first.
Is Infotrust Australian? Yes — it trades on the ASX as ITS, runs its Security Operations Centre in Sydney and positions itself as a sovereign Australian security provider, reinforced by the $50 million divestment of Nexgen Australia in February 2026.
Does Infotrust run phishing simulations? Infotrust offers data security awareness training within its managed service portfolio. It does not publish a self-serve simulation platform or per-user pricing — delivery is quoted per engagement.
How much does each cost? Cyber Aware publishes per-seat rates with no seat minimums. Infotrust's pricing is not published; managed security engagements are quoted.
Does Cyber Aware capture staff passwords in simulations? No. Reporting shows who clicked and who reported, without collecting anyone's password.
Which one produces Essential 8 evidence? Cyber Aware, out of the box — it is the only one of the two with a published training-to-framework mapping for Essential 8 and SMB1001 as of October 2026.
Can Cyber Aware replace Infotrust entirely? No — they cover different needs. Cyber Aware replaces only the awareness line: if the organisation needs managed SIEM, XDR or incident response, those remain separate services. The real question is whether awareness training should be bought inside that bundle or as a dedicated platform with published pricing and evidence of its own.
One last thing
Before either choice, run a security gap assessment. It frequently shows the missing control is a reporting cadence or a verification procedure, not the vendor — and a decision made on evidence beats one made on vendor noise.