human risk reduction

Security awareness training

Behavior change that holds under real pressure — not a once-a-year checkbox. Phishing simulations, department tracks, role-based paths, and framework-mapped completion records.

Training that actually changes behavior

Most security awareness programs are compliance theater — a module people click through once a year. We build programs designed around behavior change: phishing simulations with real feedback loops, department-specific content that feels relevant, and metrics that show whether it is actually working.

Platform license for awareness training tools (KnowBe4, Proofpoint, etc.) is client-paid where applicable. ISPH configures and manages the program.

Pricing tiers

Starter

$900–$1,600

per month · ~4–5 hrs/month · Launch: 1–2 weeks

Overage: $185/hr · Platform license (KnowBe4, Proofpoint, etc.) client-paid

Monthly security awareness module (pre-built, industry-relevant)
Monthly phishing simulation (standard template)
Completion tracking and compliance reporting
Annual policy acknowledgment
GRC platform evidence sync (Drata or Vanta)

Growth · Most popular

$1,600–$2,600

per month · ~7–9 hrs/month · Launch: 1 week

Overage: $185/hr

Everything in Starter
Department-specific training tracks (engineering, finance, HR, operations)
Bi-monthly phishing simulations (intermediate campaigns)
Monthly security newsletter (pre-templated, customizable)
Training effectiveness metrics (click rates, completion, trends)
New hire onboarding security training
Quarterly awareness program report

Professional

$2,600–$4,200

per month · ~11–15 hrs/month · Launch: 5–7 days

Overage: $195/hr

Everything in Growth
Role-based training paths (admin, developer, exec, operations)
Advanced phishing simulations (spear phishing, vishing awareness)
1 custom training module per quarter
Insider threat awareness module
Framework-mapped training records (SOC 2, HIPAA, ISO 27001)

Enterprise

$4,200–$7,500+

per month · ~18–25 hrs/month · Launch: 3–5 days

Overage: $225/hr

Everything in Professional
Fully branded white-labeled training program
Custom content development (unlimited modules/year)
Executive and board security briefing (annual)
Red flag / incident reporting culture program
Security champions program design and management
Annual benchmark against industry standards
Regulatory training compliance documentation (HIPAA, GDPR, SOC 2)

Bundle recommendation

Bundle with Policy and Procedure Development — training is most effective when staff are trained on the policies they are acknowledging
Add tabletop exercises to stress-test whether training has changed behavior when it matters most

Training is most effective when staff know the policies they are acknowledging.

Bundle with Policy and Procedure Development — and add tabletop exercises to stress-test whether the training has changed behavior.