An MSP with fifteen clients and one person handling everything technical eventually faces the awareness-training question from two directions at once. Clients ask whether you can run their security training. Insurers and auditors increasingly ask whether the MSP itself runs one for its own staff. Either way, the question underneath is the same: does a platform earn its keep, or is it another subscription a small MSP carries because someone said it should?
TL;DR
- For MSPs, awareness training is usually worth it as a client-facing service line before it is worth it as an internal program — it is one of the few offerings clients can buy monthly.
- A platform pays for itself when it replaces spreadsheet-tracked compliance work the MSP is already doing unpaid.
- The wrong platform — one with no white-labelling or per-client reporting — costs more time than it saves.
- Self-hosted DIY options fail at the client-count level: ten clients means ten campaigns to configure and report on by hand.
- The internal-IT argument alone rarely justifies the cost for an MSP under about five staff.
The two cases for an awareness platform
MSPs evaluate awareness platforms for two different reasons, and the maths differs between them.
The internal case is the familiar one: your own staff hold admin credentials to dozens of client environments, so a phished MSP is a supply-chain event for every client at once. The Australian Signals Directorate's Information Security Manual sets out how organisations should assess managed service providers, and 2025's high-profile breaches of upstream IT providers have made clients ask harder questions during onboarding. A tracked awareness program is part of the answer you can show them.
The commercial case is the one small MSPs often underweight. Security awareness training is one of the few cyber services a small business client will buy as a predictable monthly line item. Antivirus and backup are already crowded, discounted, commodity conversations. Training is not: it is visible, it is reportable, and the client's own insurer keeps asking about it. An MSP that can deliver a quarterly simulation cycle and a clean monthly report has a recurring product, not a break-fix conversation.
What makes it worth it for an MSP specifically
Not every platform survives MSP reality. Four capabilities decide whether the subscription is an asset or overhead:
Multi-tenant management. You need one login where every client's users, campaigns and results live separately. Without true multi-tenancy, each client becomes a parallel spreadsheet exercise — and that is the cost that quietly kills the margin.
White-labelling. Training and reports issued under your brand reinforce the client relationship; reports branded with someone else's logo advertise to your client that you are reselling. If white-labelling matters to your positioning, see how Cyber Aware's white-label MSP model compares with other ways of delivering the same service.
Client-ready reporting. The monthly human-risk report is the product. If the platform generates a PDF your team can send without reformatting, an account with 20 clients costs minutes per month. If reporting means exporting CSVs and building slides, the platform is only half the tool.
Per-seat economics that survive small clients. A five-person client needs to be profitable at a small monthly fee. Platforms with high minimums or per-campaign charges break the maths at the low end of the market, which is exactly where most MSPs' clients sit.
When it is not worth it
The honest cases against:
- No clients asking for training. If your client base has never once asked about staff awareness, the commercial case is theoretical. Start with your own team using a free program, and revisit when two or more clients raise it.
- Under ten internal staff with no compliance pressure. For the MSP itself, free government training — Cyber Wardens' self-paced modules at cyberwardens.com.au — covers most of the internal need while you validate demand.
- No time to run it. An unmanaged platform is worse than none: campaigns nobody configures and reports nobody sends produce a subscription cost with no client-facing value. Budget roughly an hour per client per month before you commit.
The build-vs-buy trap
A competent technical team can always self-host a phishing simulation framework for $0 in licence fees. For a single organisation that is sometimes rational. For an MSP serving many clients it is a trap, because the cost scales with client count while the price stays at zero only in the licence line. Every campaign template, reminder and report becomes your problem, multiplied by clients who each want their own branding, schedule and board report. The time spent maintaining that pipeline is the margin you were chasing.
The middle path many small MSPs take: buy the platform for clients, keep the internal program on the same platform so your own compliance evidence comes free with the licence.
How to decide in a week
Run the decision as a small test rather than a debate:
- Ask your five largest clients whether training is on their insurance or audit checklist this year. Count the yeses.
- Pick a platform and price a pilot with two clients plus your own staff.
- Track the actual hours spent configuring, chasing completions and producing reports for one cycle.
- Compare those hours against the monthly fee you can charge.
If two or more clients say yes and the pilot cycle takes fewer hours than the revenue, the platform is worth it — and the pilot itself becomes your first deliverable. A structured way to frame the first client conversation is a cyber security gap assessment, which surfaces the training gap the platform then fills.
FAQ
Do clients actually pay for awareness training through an MSP? The ones with insurers, auditors or enterprise clients asking for evidence do — and that group grows every renewal season. The rest need to be shown a sample report before they will buy.
What is the minimum client size that works commercially? Five seats is the practical floor for most per-seat platforms. Below that, bundle training into a managed security retainer instead of billing it separately.
Should the MSP's own staff be on the platform too? Yes — it is both the compliance evidence clients ask for at onboarding and the first demo material you can show them.
Can we white-label the training and reports? Some platforms allow full white-labelling, some only logo swaps, some nothing. Confirm before subscribing, because rebranding reports by hand erases the margin on small clients.
Is self-hosted simulation software a viable free alternative? For one organisation, sometimes. Across many clients, the per-client configuration and reporting time exceeds what a platform subscription costs — which is the definition of not worth it.
One last thing
The MSPs who regret buying an awareness platform almost all bought it for their own staff alone. The ones who build a business around it sell the report, not the training — the client never has to open the platform, because the monthly human-risk summary is the thing they are actually paying for.