Insights / Costs

What does security awareness training cost a company?

Updated: August 2026 · about 4 min read

The spread is enormous: from a few złoty to several hundred per employee. The difference does not come from the quality of the content but from the delivery model — and from the cost of people's time, which nobody usually counts.

Three models and their real rates

Where these ranges come from: this is our own estimate, not a published market study. We base it on our own workshop price list (3,400 PLN for a group of up to 15, i.e. about 227 PLN per participant) and on the quotes clients show us when they ask. The platform rate comes straight from our price list.

Let us work it through on a real example

A company with 60 employees. Classroom training at 250 PLN per person is 15,000 PLN for one session a year. On top of that, 3 hours × 60 people = 180 working hours that nobody puts on an invoice, and that cost real money.

The same company on the platform, in the 51–100 user band, pays 24 PLN net per person per month — 17,280 PLN a year, or 14,688 PLN paying a year up front with the 15% discount. For that it gets not one session but a year-round programme: 24 modules, exams, certificates, phishing simulations and a report for the audit.

The cost of doing nothing — the only figure the act names

When comparing offers it is worth measuring them not only against each other but against the cost of having no programme. Since 3 April 2026, educating personnel is a statutory duty (Art. 8(1)(2)(i) of the Polish Act on the National Cybersecurity System), and failure to perform it means a fine borne personally by the head of the entity.

For a manager earning 20,000 PLN a month, the ceiling is 60,000 PLN — out of their own pocket, independently of the fine on the company. That is more than four years of the training programme for a sixty-person team. We go through the provisions in the article on the training duty under the Polish NIS2 act.

Then there is the cost that cannot be budgeted in advance: downtime after an incident, data recovery, legal handling and lost customer trust. One successful ransomware attack can cost a multiple of the annual training budget.

What actually drives the price of a platform

• Number of users — the biggest factor. The per-person rate falls with scale, so the price band can shift with a handful of extra accounts.
• Billing period — annual billing is usually cheaper than monthly; with us it means a 15% discount on the annual amount.
• Feature scope — training alone costs less than a package with phishing simulations and compliance reporting.
• Number of languages — in an international organisation the alternative to one multilingual platform is a separate programme in every country, which usually costs several times more.
• Integrations — SSO, automatic account provisioning and exporting reports into internal systems are sometimes charged separately.

Five pricing traps

The most common reasons the invoice turns out higher than the quote:

• Licence minimums — an attractive per-person rate, but with a minimum of a hundred accounts. With a thirty-person team you pay for seventy you never use.
• Setup fees — a one-off implementation charge, sometimes comparable to a year's subscription.
• Paid content updates — the catalogue as of the purchase date is included, but new modules on AI or deepfakes are a separate line item.
• Capped phishing campaigns — the package covers two campaigns a year while the recommended cycle is quarterly; every further one is chargeable.
• Reports on request — if you cannot download the audit report yourself and have to ask the vendor, you pay not only in money but in time during the audit.

What to ask a vendor before you compare prices

• Is knowledge verification included? Without an exam you have no evidence for a NIS2 audit.
• Are phishing simulations included? They are the only way to measure whether the training changed anything.
• Can you download the report yourself? If you have to ask the vendor, an audit will cost you days.
• How many languages? In an international company the alternative is a separate programme per country.
• What happens with staff turnover? Someone joining in March should enter the path immediately, not wait a year for the next session.

KS-CYBER price list

We bill per user per month, with no setup fee. The plan (Starter with campaign and module limits, or Professional with no limits and a monthly audit report) is chosen separately from the number of people, and the rate falls with headcount:

Paying a year up front is 15% cheaper. Free trial: 14 days for 10 users, no payment card.

How to plan the annual budget

A simple approach that holds up in front of a board: work out the cost per employee per month and set it against a line everyone recognises. For a company in the 51–100 band that is 24 PLN net a month on Starter (30 PLN on Professional) — less than the typical office coffee bill per person.

Two items are worth adding to the budget because they are usually forgotten: the time of the person responsible for launching the programme (about fifteen minutes for onboarding here, though a custom content catalogue and SSO integration add a few hours) and a reserve for turnover — new employees join during the year and have to complete the path too.

Frequently asked questions about cost

Can we test it before buying? Yes — the trial covers 14 days for three users, with no payment card and no installation.

What about a team under ten people? The rate is 39 PLN net per person per month on Starter (49 PLN on Professional), with no licence minimum — you pay for as many users as you actually have.

Does the price rise as the company grows? The unit rate falls with the number of users, so the cost per person goes down. When you cross a threshold the whole rate changes, not only for the new accounts.