For MSPs
How should MSPs price security awareness training?
Updated
Short answer
Most MSPs price security awareness training in one of three ways: bundled into a managed security plan, sold as a separate add-on, or included only in a higher tier. Charging per user keeps price tied to cost and risk, while a flat per company fee is simpler to quote. Whichever you pick, price from your own cost, delivery time and target margin, not from a competitor's list.
What are the main pricing models for security awareness training?
There are three common packaging choices. They are not mutually exclusive: many MSPs bundle training into one plan and sell it as an add-on to clients on other plans.
- Bundled: training is part of your managed services or managed security price. The client sees one line item.
- Add-on: training is a separate, optional line item the client can accept or decline.
- Tiered: training appears only in your higher plan (for example a "security" or "compliance" tier), giving clients a reason to upgrade.
When should training be bundled into a managed plan?
Bundling works when you want every client protected and you would rather not have the training conversation one client at a time. It also helps when you take on security responsibility in your contracts, because untrained staff are your risk too.
The trade off is margin visibility. Once training is inside a bundle, its cost is easy to forget when you review pricing, so track it as its own cost line internally even if the client never sees it.
When does an add-on make more sense?
An add-on suits clients who are price sensitive, or MSPs whose plans are already sold and hard to reprice. It lets the client opt in when a trigger appears, such as an insurance renewal or a compliance review.
The risk is low uptake. Optional services get declined, and the clients who decline are often the ones who most need it. If you go this route, attach the offer to a specific event so it is a timely decision rather than a vague extra.
Should you charge per user or per company?
Per user pricing keeps your revenue in line with your cost when your vendor bills you per user. It also scales naturally as a client hires, and it is easy to explain: more staff means more people to train.
A flat per company fee is simpler to quote and suits very small clients where per user maths produces awkward small numbers. It can squeeze your margin when a client grows, so set a headcount range the flat fee covers and review it at renewal.
- Per user: tracks cost, scales with headcount, needs an accurate user count each month.
- Per company: simple to quote, predictable for the client, needs a headcount ceiling.
- Hybrid: a base fee per company plus a per user charge above a set number of staff.
How do you work out your margin?
Start from your real costs, not from what others charge. Your price needs to cover the platform cost plus the time your team spends on setup, monthly checks, client questions and reporting.
Write the numbers down per client so you can see which clients are profitable.
- Platform cost: what your vendor charges you, usually per user per month.
- Setup time: connecting the client's directory, whitelisting simulation emails, agreeing rules with the owner.
- Ongoing time: reviewing results, answering staff questions, chasing incomplete training.
- Reporting time: preparing QBR slides and insurance or compliance reports.
- Target margin: the gross margin you aim for on managed services generally.
What pricing mistakes should MSPs avoid?
The most common mistake is giving training away for free to win a deal and never repricing it. Clients then see it as worthless, and you carry the cost indefinitely.
- Do not set a price that ignores your own delivery time.
- Do not lock in long contracts at a price you cannot adjust when your vendor cost changes.
- Do not forget to bill for new hires if you charge per user. Sync users from the client's directory so counts stay accurate.
- Do not compete only on price. Clients pay for the reports and the effort you save them.
- Check what the client already owns. Microsoft's Attack simulation training requires Microsoft 365 E5 or Defender for Office 365 Plan 2, so clients without one of those licences do not have it. Check before you quote.
How does your vendor's billing affect your pricing?
Your own price is easier to manage when your vendor bills the same way you do. Per user vendor billing with no minimum seats suits per user client pricing, and a monthly term means you are not locked in if a client leaves.
NetMinder bills MSPs per active user, monthly, with no minimum seats and no contract, and the MSP's own staff are free. Pricing is agreed on a call rather than published, so you can match it to whichever model above you use with your clients.