Budget for two line items, not one: the platform subscription and the internal time to run the programme. The second is where small businesses get caught out — a 20-person team can have a full programme running for roughly $1,000–$3,000 a year, set against an average self-reported cybercrime cost of $56,600 per incident for an Australian small business (ASD, Annual Cyber Threat Report 2024–25).
TL;DR
- Per-seat pricing for awareness platforms typically runs a few dollars per employee per month, with no minimums on platforms built for small teams.
- The hidden cost is internal time: 15–60 minutes a month depending on automation. Without it allocated, the programme dies by month three.
- ASD puts the average self-reported cybercrime cost to an Australian small business at $56,600 per incident in FY2024–25, up 14% year on year — a year of training costs 1–2% of that.
- The two traps: enterprise platforms with seat minimums a small team cannot meet, and "free" annual training that produces no evidence an insurer or client will accept.
What you are actually paying for
A security awareness programme has two cost centres, and conflating them is the most common budgeting mistake.
The platform. Training content, phishing simulations, per-person risk scoring and reporting. This is a subscription, priced per seat, and for platforms aimed at small and mid-sized teams it typically lands in the low single-digit dollars per employee per month. Comparison shopping is easy here — the platform comparison shows how the main options are priced and what sits behind the headline rate.
The internal time. Someone has to load the staff list, approve the monthly campaign, chase the two people who never finish their modules, and read the report. On platforms with automated enrolment and self-scheduling phishing campaigns this is realistically 15–60 minutes a month for a small team. On platforms without that automation, it is a part-time job — and it is the reason many small-business programmes quietly die after month three.
The number to hold in your head
ASD's Annual Cyber Threat Report 2024–25 puts the average self-reported cost of a cybercrime incident to an Australian small business at $56,600 — up 14% year on year. For a 20-person business, a full year of awareness training on a mid-range platform costs roughly 1–2% of that single-incident figure.
That is the entire budget argument. Not "training is good" — but that the spend needed to cut the odds of the most common attack path (a phishing email a staff member clicks) is trivially small against the cost of the incident it prevents.
What a realistic budget looks like
| Team size | Platform (per year, typical range) | Internal time (per month) |
|---|---|---|
| 5–10 staff | $600–$1,200 | 15–30 min |
| 11–25 staff | $1,200–$3,000 | 30–45 min |
| 26–50 staff | $3,000–$6,000 | 45–60 min |
Figures assume per-seat pricing on platforms without minimum-seat contracts. Enterprise platforms often quote $25–$50+ per user per year with minimum seat counts that make them a poor fit below 50 staff — free training options exist but usually produce no per-person evidence.
Where budgets go wrong
- Seat minimums. A platform that requires 50 seats for a 12-person team triples the effective per-person cost. Check this before the demo, not after the contract.
- Annual-only content. One long course per year feels cheaper but produces no behaviour change and no evidence trail. Monthly short modules with simulations cost about the same annually and are what insurers and framework assessors actually want to see.
- No budget for the admin time. If the person running the programme has no time allocated to it, the programme stops. Put the half-hour in the budget as real hours.
- Paying for reporting you don't use. Some platforms charge extra tiers for advanced dashboards. For a small team, per-person human risk reporting on a standard plan is enough.
What insurers and clients actually ask for
Cyber insurers increasingly ask for evidence that staff receive regular security awareness training, and client procurement forms in Australia frequently reference Essential Eight or SMB1001. A platform-based programme answers both with an export: who completed what, when, and what their phishing simulation results were. A spreadsheet of "we did a webinar in March" does not.
If framework evidence is part of why you are buying, check the platform maps its content to the framework you need — see best security awareness platforms for Essential Eight compliance for the short list.
FAQ
How much should a small business spend on security awareness training? For a 20-person team, expect roughly $1,000–$3,000 per year on the platform, plus about half an hour a month of internal time. Anything materially above that needs a specific reason — most small teams do not need enterprise tiers.
Is free training good enough? Free options (government resources, one-off webinars) are fine as a supplement. On their own they produce no completion records, no simulation results and no per-person evidence — which is what insurers and assessors ask for.
Do we have to buy a platform, or can we run it ourselves? You can run a programme manually with free content and a calendar reminder. It works — for about two months, until the chasing gets old and the cadence slips. A platform exists to keep the cadence running without you.
What is the most expensive mistake to avoid? Signing a 12-month contract at enterprise per-seat pricing with seat minimums before checking that a small-team platform would cost a quarter as much.
Does the budget include phishing simulations? On most awareness platforms, yes — simulations are part of the same subscription. Some vendors price them separately; check before comparing headline rates.
One last thing
The budget conversation is really a risk conversation. If the question is "can we afford $150 a month for training?" the honest comparison is against the $56,600 average cost of the incident that training exists to prevent — and against the hours an incident-response cleanup costs that no budget line currently covers.