Small MSPs sit between two prices: the platform seat cost per client, and the hours an unmanaged programme eats in admin. This article works through what a security awareness platform actually costs a small MSP in 2026, what it returns, and the break-even math — so the 'is it worth it' decision is arithmetic, not vibes.
What a platform costs a small MSP
The security awareness market runs roughly $0.50–$6.00 per user per month, with most organisations paying $1.50–$3.00. For a small MSP the published numbers look like this:
- KnowBe4 — SAT Foundation lists at $2.40/user/month for 25–50 seats, dropping to $1.63 at 501–1,000 seats, on 3-year list terms. Deeper white-labeling costs extra with a 1,000-seat minimum.
- Huntress SAT — $2.08/learner/month published, but tiers start at the 50–99 learner band on a standard 12-month term.
- Cyber Aware — per-seat with no minimums, so a 12-seat client is priced like a 120-seat client per seat.
On a 3-year commitment at $2–3 per seat, a small MSP reselling at $5–8 per seat per month carries a healthy margin — but only if the seat count is real and the admin hours are near zero. Pricing structures with seat minimums quietly exclude your smallest clients: a 15-seat accounting firm can't buy into a 50-learner band.
What the hours cost without one
The platform fee is rarely what kills the business case. Admin time is. Without automation, running awareness across even 10 small clients means:
- Enrolling and de-enrolling staff by hand every time a client hires or loses someone.
- Building a phishing campaign per client per month — picking templates, scheduling sends, compiling results.
- Chasing completions one reminder email at a time.
- Assembling reports for each client's quarterly review from screenshots and exports.
At an MSP billable rate of $100–150/hour, two hours a month of per-client admin across ten clients is $2,000–3,000 a month of capacity — most of it work a junior engineer resents. That is the real line item the platform competes against, not just the $2.40 per seat.
The revenue side
Awareness training is one of the few line items an MSP can attach to every client regardless of size, and it recurs monthly. The economics work when three things hold:
- You resell under your own brand. If the client sees the vendor's name on the portal, emails and reports, you're a reseller with a margin problem; if they see yours, you're their security partner. White-label depth varies wildly between platforms — check every touchpoint (the 2026 MSP comparison scores eight platforms on it).
- Setup and reporting run themselves. Auto-enrolment from Microsoft 365 or Google Workspace, a year of phishing campaigns scheduled from one setup, and client-ready reports generated on a schedule. The margin lives here.
- You can show progress. A human risk score per client turns 'we do some training' into a trend line a client renews on.
The break-even math for a 10-client MSP
Take a small MSP with ten clients averaging 25 seats — 250 learners total:
- Platform cost at ~$2.50/seat: $625/month.
- Resale at $6/seat: $1,500/month — $10,500/year gross margin before admin time.
- Admin time saved versus manual delivery: conservatively 15–20 hours a month across the client base, worth $1,500–3,000 at MSP rates.
Against that, the risk is churn and disengagement: a programme clients mute after three months earns nothing. That is why content cadence matters more than library size — short story-driven training modules on a steady monthly rhythm keep completion rates (and the recurring revenue) alive, while a 1,000-module library nobody opens doesn't.
One more revenue line small MSPs often miss: a framework-mapped gap assessment run alongside training turns the security conversation into a scoped project — patching, MFA rollouts, backup changes — that funds far more than the seats ever will.
When a platform is NOT worth it
Honesty makes the yes credible. Skip the platform if:
- You have fewer than three clients who would take it, and no pipeline to sell more — the admin savings haven't materialised yet.
- You won't commit to a monthly cadence. An annual-compliance-only deployment delivers neither behaviour change nor retention.
- The seat minimums or lock-in terms don't fit your client mix — a 3-year term at 50-seat minimums is a bet on clients you may not have.
FAQ
How much should an MSP charge clients for security awareness training?
Most MSPs bundle it into a per-seat managed rate of $4–8 per seat per month, or resell at a 2–3x markup on the platform seat cost. Anchor on the client's alternative: a standalone tool plus their own admin time.
Is white-labeling really necessary for an MSP reselling training?
Practically, yes. The client's staff see the portal, the emails and the certificates — if another brand appears there, you look like a middleman. Branding depth differs per vendor; verify every touchpoint before signing.
What's the minimum client size for this to make sense?
With per-seat, no-minimum platforms there's no floor — even a 5-seat client is margin-positive. With platforms that tier from 25–50 seats, your smallest clients either pay for unused seats or get left out.
Can we just use free phishing tools instead?
Free tools cover the send-a-fake-email part but not enrolment, remediation, reporting or the evidence trail clients (and their insurers) increasingly ask for. The hours they consume are the real cost.
How long until an awareness platform pays for itself?
With ten clients sold and a cadence running, most small MSPs cross break-even inside the first quarter — the platform fee is a fraction of the admin hours it replaces.
Sources
- Symbol Security: Security Awareness Training Cost — 2026 Pricing Guide — market range of $0.50–$6.00 per user per month
- KnowBe4: Security Awareness Training pricing — published list rates by seat band and term
- Huntress: Pricing — $2.08/learner/month with 50–99 learner tier bands
- Cyber Aware: Security awareness training ranked by price in 2026 — vendor-by-vendor published pricing