A fully automated security awareness program takes roughly 1-2 hours of admin time per month for a typical 50-200 seat business: reviewing the risk dashboard, checking completion, and clearing overdue learners. The same program run on a manual platform - spreadsheets, hand-built campaigns and copy-paste reports - costs closer to a working day a month.
TL;DR
- A manual program costs about a working day a month; an automated one fits into 1-2 hours.
- Four jobs dominate the admin load: enrolment, reminders, campaigns and reporting.
- Directory sync removes enrolment work; scheduled campaigns remove campaign work.
- Auto-remediation turns phishing clicks into assigned training without a follow-up email.
- Most admin time is really reporting time - pick a report you can send untouched.
What does a training program cost in admin time each month?
Four jobs make up essentially all of the recurring admin load on a security awareness program. The table below shows each one under a manual setup and an automated one:
| Monthly job | Manual platform | Automated platform |
|---|---|---|
| Enrol new starters, remove leavers | Manual list edits each month | Directory sync handles both automatically |
| Remind overdue learners | Chasing emails by hand | Reminders fire on schedule |
| Launch phishing campaign | Built and sent per group, every month | A year of campaigns scheduled from one setup |
| Chase and remediate clickers | Individual follow-up emails | Clickers auto-enrolled into a course |
| Reporting for management or clients | Spreadsheet assembly | Branded PDF generated on a schedule |
The manual column is where a working day a month goes. The automated column is where 1-2 hours goes. Both columns run the same program - the difference is what the platform does without being asked.
Job 1: enrolment and leavers
This is the job that quietly breaks manual programs. People join, leave and change roles every month, and every change touches the training list. A platform that syncs with Microsoft 365 or Google Workspace enrols new hires automatically - with a welcome email - and removes leavers without an admin touching a list (Cyber Aware documents this on its awareness training page).
If you run a manual process today, time this task once. The result usually shocks people who assumed it was only ten minutes: the list is never in one place, contractors sit in a second spreadsheet, and the leaver you removed is still receiving phishing simulation emails.
Job 2: reminders
Overdue courses need chasing, and chasing is emotionally expensive work that produces nothing. Platforms schedule due and overdue reminder emails on a cadence you set once, so the admin never sends one. On Cyber Aware, an overdue course adds +2 points to the learner's Human Risk Score and +0.2 per overdue day, capped at 30 days - so the follow-up conversation, when needed, is about a number rather than a nag (human risk reporting).
Job 3: phishing campaigns
The highest-variance job. Building each campaign by hand - pick the date, the sending group and the template, then send per segment - is real work every month across every client. The automated pattern is to schedule a year of varied campaigns from one setup conversation, then let difficulty ramp itself.
Anyone who clicks is auto-enrolled into the failed-phishing course, and the results compile into a branded PDF that auto-sends to admins when the campaign completes (phishing simulations). That one design removes both the build time and the chase time.
Job 4: reporting
Reporting is the job people underestimate. A monthly summary to leadership - or, for MSPs, a client report per tenant - involves pulling completion, click trends and risk scores into something presentable. Automated platforms generate it: dashboards plus a branded PDF export on a schedule, with no spreadsheet in between.
If your current reporting takes more than 30 minutes a month, that alone can justify a platform switch. Compare what vendors actually deliver with our platform comparison.
Where the remaining time actually goes
Even fully automated, three things still need a human:
- Reading the dashboard - 10-15 minutes a month to check completion, click trends and who needs help.
- Clearing exceptions - staff without email accounts, contractors, shared mailboxes; expect a short list.
- Deciding the next topic - platforms can auto-add a new course monthly, but someone should sanity-check it against the phishing results.
That is the honest 1-2 hours. Everything outside this list is either automatable or should be questioned.
How to audit your own admin load
Time yourself across one month on the five jobs in the table. If the total lands near a working day, automation pays for itself in recovered hours before you count the click-rate improvement. If it already fits in two hours, your problem is not admin time - look at content quality and simulation cadence instead.
FAQ
Is monthly admin really lower than annual admin? Yes. A monthly cadence spreads small tasks evenly and keeps them automatable; an annual burst piles enrolment, reminders, campaigns and reporting into one window where nothing can be automated gracefully.
Does automation remove the need for a human owner? No - it removes the mechanical work. Someone still needs to read the numbers and act on them; that is the 1-2 hours.
What is the first thing to automate? Enrolment. Directory sync is a one-time setup that removes a task you would otherwise do forever.
How do MSPs keep admin time down across many clients? Multi-tenant dashboards, scheduled per-client PDF reports and auto-enrolment across tenants - the same automation applied per client, from one console.
Can we automate billing or CRM follow-ups too? Yes, through integrations and Zapier-style connectors: new clients create deals, completed assessments trigger tasks, and billing syncs with your PSA. That work sits outside training itself but comes off the same admin budget.
One last thing
The admin time you save is not the real prize - the cadence is. A program that runs monthly on autopilot changes behaviour in a way a quarterly manual push never does, because the staff see it constantly and the admin never falls behind.