- Compare like with like: price model, minimum seats, contract length, setup time and which email provider you use matter more to a small team than the length of a feature list.
- Each option below is described only from its own website or documentation, with a link and the date we checked it.
- Prices and terms change. Confirm every detail with the provider before you buy.
A small team of 5–50 people usually needs security awareness training that is quick to set up, works with the email it already uses, has a clear monthly or annual price, and produces simple records for an insurer or client. Many well-known platforms are built for larger organisations with security staff, seat bands and multi-year terms. Neither approach is wrong; the right choice depends on your size, your email provider and how much time you can give it.
What is KnowBe4?
KnowBe4 is a security awareness and human risk platform whose website says it is used by more than 70,000 organisations. Its products include Security Awareness Training, compliance training, real-time coaching, email security and incident response tools. Its pricing page publishes list prices (MSRP) per seat per month on a 3-year term, in seat bands from 25–50 upwards; in GBP, the 25–50 band is listed at £1.85 per seat per month for SAT Foundation and £2.89 for SAT Advanced, marked “Pricing as per May 2026”, with a quote for 1,001 seats or more.
Sources: knowbe4.com and KnowBe4 SAT pricing page, as of 9 Nov 2026. KnowBe4 states that list pricing may change at any time and may vary by region.
If you're a team of fewer than 25 people, ask KnowBe4 directly how they would price your team, as the pricing page doesn't state a minimum.
How should a 10-person team compare security awareness training?
A 10-person team should compare security awareness training on eight practical criteria, not on feature counts. Use this table as a checklist when you speak to any provider, including us.
| Criterion | Why it matters for a small team | What to ask |
|---|---|---|
| Price model and minimums | Per-seat pricing with a minimum band can mean paying for seats you don't use. | Is it per user or flat? Is there a minimum number of seats? Are prices published? |
| Setup time | There's often no IT team, so whoever runs it is also doing a day job. | How long from sign-up to the first training or practice email? Is a sales call or onboarding needed? |
| Email providers supported | Practice emails and report buttons depend on your mail system. | Does it work with Microsoft 365, Google Workspace or whatever you use, and which features need which provider? |
| Training formats | Short, practical formats are easier to fit into a small team's week. | Videos, quizzes, simulations, drills? How long does each take? Is new content added? |
| Practice phishing | Practice turns knowledge into habit. | Are practice emails included? What happens when someone clicks? Are texts or calls simulated? |
| Reporting button | Reporting fast matters more than never clicking. | Is there a report button for your mail client, or another way to report? |
| Evidence for insurers | Insurance forms and client questionnaires often ask about staff training. | What reports can you download, and do they show completion and results over time? |
| Contract length | Small businesses change quickly. | Monthly, annual or multi-year? What happens if your headcount changes? |
For more on what good training looks like, see our guides to security awareness training for small businesses and phishing simulation for small businesses.
What are the alternatives to KnowBe4 for small businesses?
Seven options that small businesses commonly consider alongside KnowBe4 are listed below, in no particular order of merit. Each entry states only what the provider says on its own website or documentation, with the date we checked. We haven't tested these products and make no claim about their quality.
| Option | Who it says it's for | How it's delivered | Prices public? |
|---|---|---|---|
| Huntress Managed SAT | Companies of all sizes | Hosted service, direct or via MSPs and resellers | No, on request |
| usecure | MSPs and IT teams | Hosted service | No, on request |
| Phished | Businesses; also MSPs | Hosted service | Plan names listed; see their site |
| Hoxhunt | Enterprise | Hosted service | No, quote after a scoping call |
| Microsoft Attack simulation training | Microsoft 365 organisations with the right licence | Built into Microsoft Defender for Office 365 | Licence-based; see Microsoft |
| GoPhish | Anyone testing exposure to phishing | Free, open-source software you run yourself | Free |
| Lureproof | Teams of 5–50, mainly UK | Hosted service | Yes |
1. Huntress Managed SAT (formerly Curricula)
- Audience: its product page says it is designed for companies of all sizes.
- Delivery: training content and phishing simulations; you can buy directly from Huntress or through an MSP, reseller or channel partner, and a free trial is offered.
- Pricing: not listed. The pricing page describes a per-learner, per-month subscription billed annually, with volume tiers that start at 50 learners.
Sources: product page, pricing page, free trial page (“formerly Curricula”), as of 9 Nov 2026.
2. usecure
- Audience: its website describes it as human risk intelligence for MSPs and IT teams.
- Delivery: a hosted platform with one plan of core features, plus an optional breach-monitoring add-on.
- Pricing: not listed (“Request pricing”). For MSPs the page states per-user, per-month pricing with no minimum licences and monthly billing; for IT teams, per-user, per-month pricing billed annually, with multi-year discounts.
Sources: usecure.io and pricing page, as of 9 Nov 2026.
3. Phished
- Audience: businesses, with a multi-tenant option and partner programme for MSPs. Its website gives an address in Leuven, Belgium.
- Delivery: a hosted security awareness platform; its site lists integrations including Microsoft 365 and Google Workspace, and an assistant for checking links and attachments in Outlook and Gmail.
- Pricing: the pricing page lists three plans (Core, Advanced and All-in-One) with a currency selector. Check the page for current prices.
Sources: phished.io and pricing page, as of 9 Nov 2026.
4. Hoxhunt
- Audience: its homepage says it is built for enterprise.
- Delivery: a hosted human risk platform; its site says simulations can be delivered across email, SMS, phone calls or Teams.
- Pricing: not listed. The pricing page says pricing is per employee, with a quote after a 30-minute scoping call.
Sources: hoxhunt.com and pricing page, as of 9 Nov 2026.
5. Microsoft Defender for Office 365 Attack simulation training
- Audience: organisations on Microsoft 365. Microsoft's documentation says it requires a Microsoft 365 E5 or Defender for Office 365 Plan 2 licence; E3 customers get a limited trial subset.
- Delivery: run from the Microsoft Defender portal, with simulated phishing (including QR code payloads), assigned training modules and reports.
- Pricing: part of the licences above rather than a separate price; see Microsoft's licensing pages.
Source: Microsoft Learn, Get started using Attack simulation training (page dated 3 Jul 2026), as of 9 Nov 2026.
6. GoPhish
- Audience: its website describes it as an open-source phishing framework for testing an organisation's exposure to phishing.
- Delivery: software you download and run yourself (binaries for Windows, macOS and Linux, or a Docker container). You set up, host and run campaigns.
- Pricing: free, under the MIT licence.
Sources: getgophish.com and GoPhish on GitHub, as of 9 Nov 2026.
7. Lureproof (that's us)
- Audience: small teams of 5–50 people, mainly in the UK. It isn't designed for larger organisations.
- Delivery: a hosted service that works with any work email provider. Staff take a monthly hands-on assessment (about 15 minutes, 7 stages, including a pre-scripted live-attack practice chat) and weekly 60-second drills. Practice phishing emails are live for Google Workspace only; Microsoft 365, Zoho and other providers are coming soon. It doesn't send practice texts or make practice calls. Report button for Gmail and Zoho Mail, plus a forward-to-report address. PDF reports, and a monthly board report on the Business plan.
- Pricing: public. Free for up to 5 people; Team £29.99/month for up to 25; Business £49.99/month for up to 50. Monthly, no annual contract, no per-seat pricing. The assessment, drills and leaderboard are on Team and Business.
- Worth knowing: Lureproof is new; it launched in November 2026.
Source: Lureproof pricing and About Lureproof.
Which is right for you?
The right security awareness training for a small business depends mostly on your size, your email provider and who will run it.
- You already have Microsoft 365 E5 or Defender for Office 365 Plan 2. Check Microsoft's Attack simulation training first, since it's part of what you pay for.
- An MSP or IT provider looks after you. Ask what they already offer; several of the options above sell through partners.
- You have technical skills and time, and want to run tests yourself. GoPhish is free, but you host and manage it.
- You have hundreds of staff or a security team. Platforms built for enterprise, including KnowBe4 and Hoxhunt, are designed for that scale.
- You're a team of 5–50 who wants a flat monthly price and no contract. Compare the options with published pricing and short terms, and try the free tiers or trials before deciding.
Whichever you pick, test it with the reporting flow your staff will actually use, and check whether it gives you the records you need for Cyber Essentials, insurers and clients.
If you're a small team and want to try Lureproof, it's free for up to five people, and our free security training is open to anyone without signing up.
FAQ
Is there a free alternative to KnowBe4?
Yes, in two senses. GoPhish is a free, open-source phishing framework you download and run yourself, so the cost is your time and hosting rather than a licence. Some paid services also have free plans or trials: for example, Lureproof is free for up to 5 people, and Huntress offers a free trial of its Managed SAT. Check each provider's site for current terms.
What should a small business look for in security awareness training?
Start with the price model and any minimum number of seats or contract length, then check that it works with your email provider, how long setup takes, what the training actually involves, whether staff get a simple way to report suspicious emails, and what records you can show an insurer or client.
Can I run phishing simulations with Microsoft 365?
Microsoft's own Attack simulation training is part of Microsoft Defender for Office 365. Microsoft's documentation says it needs a Microsoft 365 E5 or Defender for Office 365 Plan 2 licence, with a limited trial subset for E3 customers. If you're on a different plan, a third-party service may suit you better.
Do I need phishing simulations to pass Cyber Essentials?
No. Cyber Essentials covers technical controls and doesn't require security awareness training or phishing simulations. Training still helps, because several of those controls depend on people doing the right thing, and insurers and clients often ask about it.
KnowBe4, Huntress, usecure, Phished, Hoxhunt, Microsoft, Microsoft 365, Microsoft Defender and GoPhish are trade marks of their respective owners and are used here only to identify their products. Lureproof is not affiliated with, sponsored or endorsed by any of them. Information about other providers comes from their public websites as of 9 November 2026 and may have changed; please check with each provider. Spotted something out of date? Email hello@lureproof.com and we'll correct it.