A security awareness platform is the software that runs your staff security programme end to end: the training library, the phishing simulation engine, the one-click report button in every mailbox and the reporting that turns each person's behaviour into a score a manager can read. Most owners choose one once and live with it for years, so this guide sets out what a platform must include in 2026, the six criteria worth judging it on and what the published pricing says you should expect to pay.
TL;DR
- A security awareness platform combines training delivery, phishing simulation, one-click reporting and per-learner risk measurement in one system.
- The stakes: roughly 60% of breaches involve a human element — Verizon's 2025 DBIR analysed 22,052 incidents and 12,195 confirmed breaches (full report PDF).
- The payoff: phishing susceptibility falls from 33.2% before training to 4.2% after twelve months of sustained training and simulation — an 87% reduction (KnowBe4 2026 Phishing by Industry Benchmarking Report).
- Judge a platform on automation, local lure realism, measurement, evidence, safety and monthly effort — not on library size.
- Cyber Aware runs the fully automated model for Australian teams: security awareness training, phishing simulations and human risk reporting in one platform.
What a platform actually does
Under one login, four jobs run together:
- Training delivery. A library of short modules — phishing, credentials, payment fraud, data handling — assigned on a schedule, with quizzes and completion tracked per learner.
- Phishing simulation. Safe fake attacks sent on a calendar, with clicks and reports logged per person, and automatic enrolment of anyone who clicks into a short follow-up lesson the same day.
- Reporting. A report button in Outlook or Gmail so staff flag suspicious mail, plus dashboards that turn behaviour into per-learner scores.
- Evidence. Exportable completion records, click trends and risk scores — the pack cyber insurers, auditors and enterprise clients ask for.
A tool that does three of the four is a course library with a phishing gimmick bolted on. The fourth job is the one that pays for the subscription at renewal time.
Why the platform matters more than the content
The content is roughly the same everywhere — short video modules, a quiz, a simulation. What separates working programmes from stalled ones is the machinery that runs them:
- Cadence. KnowBe4's 2026 benchmark, built on 67.7 million simulated phishing tests across 14.5 million users, shows the big gains land between month three and month twelve of sustained training — exactly the window a manually run programme is most likely to lapse.
- Pressure. The same report records a 17.1% increase in phishing attacks since the second half of 2025, with AI-generated lures making templates harder for staff to spot. A static annual course cannot keep pace.
- The human share of risk. Verizon's 2025 DBIR again found a human element in roughly 60% of breaches — the layer no filter closes alone.
The stall pattern is predictable: the programme launches, the person running it has a busy month, the next simulation slips, and nothing reminds anyone. Automation is the feature that survives that month.
What a 2026 platform must include
- Directory sync. Enrolment from Microsoft 365, Google Workspace or an HR system, with new starters joining in week one and leavers dropping off automatically. A spreadsheet-managed list goes stale within a quarter.
- A self-scheduling campaign calendar. One setup should produce a year of simulation campaigns with rotating lure families and escalating difficulty.
- Auto-remediation. Clickers get a short targeted lesson the same day, not a warning email next week.
- Per-learner risk scoring. Click rate, report rate and completion rolled into one number per person per month — human risk reporting is the pattern to expect.
- Local content. Australian lures — tax office notices, myGov impersonation, delivery scams, local bank alerts — beat generic international templates for engagement.
- Exportable evidence. Per-learner completion with dates, mapped to the frameworks your auditors or insurers ask about.
The six criteria to choose on
- Automation depth. Ask: show me the campaign calendar you will run without me. If the answer involves a planning meeting, keep shopping.
- Lure realism for your region. Templates must match what your staff actually receive — check the library before the demo video.
- Measurement you can hand to a board. Click rate falling and report rate rising, as a per-team trend with a per-learner drill-down. Anything less is data nobody can act on.
- Evidence mapping. Essential Eight, ISO 27001 and SMB1001 all expect or assume staff awareness work. Confirm the export before you buy, not after the audit.
- Safety. Simulations should not capture real credentials, and click data should be a coaching input, never a wall of shame — punitive programmes kill the reporting habit, which is the metric that matters most.
- Monthly effort. A non-technical owner should run it in under an hour a month. If it needs IT staff to operate, it will die the first month that person is busy.
What it costs in 2026
Published bands put full awareness programmes at $10–$72 per employee per year, depending on tier and simulation features, with standalone simulation software around $16–$31. A 50-person business lands roughly $900–$1,800 per year at a mainstream tier; per-seat pricing with no minimums keeps the maths simple as headcount changes.
Set against what it protects, the annual line is small. IBM's 2026 Cost of a Data Breach Report puts the global average breach at USD 4.99 million, up 12% and a record high (IBM), while ASD's Annual Cyber Threat Report 2024-25 puts the average self-reported cost of a reported incident at $56,600 for an Australian small business. A year of training commonly costs a fraction of one near-miss.
How to evaluate a platform in a week
- Run a baseline simulation before announcing anything — the honest starting click rate is the number every later improvement is measured against.
- Pilot two platforms on the same 10–15 staff for one month, same lure difficulty.
- Check what happened without any admin input: were new hires enrolled, were clickers coached, did the report arrive?
- Request the evidence export — the file an auditor or insurer would receive.
- Decide on automation and evidence first, price second. Those two decide the outcome; price only decides the invoice.
The vendor-by-vendor side-by-side is on the comparison page, and a security gap assessment tells you whether the human layer is even your biggest exposure before you spend — most teams are surprised which half the answer lands in.
FAQ
What is a security awareness platform? Software that runs staff security training end to end: short modules, phishing simulations, a report button and per-learner risk reporting in one system.
How is it different from a training course? A course is completed once; a platform runs a monthly cycle of lessons, simulations, coaching and measurement, and keeps the evidence.
Do we need IT staff to run one? No — with directory sync, a self-building campaign calendar and automated reports, a non-technical owner runs it in under an hour a month.
How much does one cost in 2026? About $10–$72 per employee per year for full programmes; a 50-person team typically pays $900–$1,800 annually at a mainstream tier.
Can small businesses use one? Yes — self-serve platforms bill per seat with no minimums, and smaller teams usually see the fastest improvement because results are visible to everyone.
What should we measure after buying? Click rate falling, report rate rising, completion near 100%, and a shrinking repeat-clicker list — quarter over quarter.
One last thing
Do not buy on library size. A platform with 1,500 modules and no automation trains nobody; a platform with 120 relevant modules that enrols, simulates and reports by itself trains everyone. The machinery is the product.