1 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
What does a phishing simulation cost? The pricing models, the cost drivers and how to compare two quotes
Every phishing simulation quote is built from the same handful of variables: how you pay, how many people, how many campaigns, which channels, and how much is done for you. Once you can see those variables, you can read any proposal and spot what is missing. This guide explains the mechanics; HackersHub quotes every engagement on scope and does not publish prices.
Phishing simulation cost in short
The structure of the price, without a price list. This is how every quote on the market is assembled.
- Three pricing models exist: a per-user-per-year platform licence, a per-campaign managed service, and a bundle of awareness training plus simulation. Most quotes are one of these with add-ons.
- The drivers that move the number: number of users, campaigns per year, languages, custom pretexts versus templates, voice and SMS channels, depth of reporting, integration with your mail platform and identity provider, and onboarding effort.
- What is usually excluded: lookalike domains and landing pages, allow-listing support, works-council and legal preparation, the report button, debrief workshops, awareness content, and the second wave that proves whether anything changed.
- Compare quotes on the written scope, the campaign count, the named people doing the work, the metrics reported (report rate, not just click rate) and the exclusions, never on the headline figure.
- The cost of not testing is described by the Verizon Data Breach Investigations Report and the UK National Cyber Security Centre in consistent terms: phishing and stolen credentials remain among the most common ways in, and the first report from an employee is often the earliest detection an organisation has.
- HackersHub does not publish prices. Every phishing simulation is scoped in a short call and quoted in writing with the campaign plan, the channels, the named lead and the deliverables.
Why there is no single price for a phishing simulation
Ask three providers what a phishing simulation costs and you will get a per-seat licence, a fixed fee per campaign and a bundle that includes an e-learning library. None of them is wrong; they are selling different things. A platform licence sells you software and templates, and you run the campaigns. A managed campaign sells you the work: pretext design, infrastructure, sending, measurement and debrief, performed by people. A bundle sells you a training programme in which simulation is the measuring instrument. The first question in any comparison is therefore not how much, but which of these three am I buying.
The second reason is that the effort behind a simulation varies more than the software does. A generic lure sent to two thousand mailboxes from a template takes a fraction of the effort of a targeted spear-phishing wave against a finance team, built from open-source research, delivered from a registered lookalike domain, followed by a voice call from a tester playing the supplier. The first is a measurement of baseline susceptibility. The second is a rehearsal of the attack most likely to cost you money. They do not cost the same and should not be quoted the same.
The three pricing models compared
Each model fits a different situation. Mixed models (a licence plus a managed executive campaign, for example) are common and perfectly reasonable.
| Model | How you pay | Fits when | Watch out for |
|---|---|---|---|
| Per user per year (platform licence) | Tiered price per mailbox, billed annually, usually with volume bands | You have an internal team to run campaigns, a large headcount and a need for continuous low-intensity testing | Headcount growth raises the bill; templates are shared with every other customer and get recognised; your team owns the legal and infrastructure work |
| Per campaign (managed service) | Fixed fee per campaign or wave, scoped on audience, channels and difficulty | You want realistic, targeted scenarios run by testers, a credible baseline, and no infrastructure to maintain | Fewer touchpoints per year unless you buy several waves; make sure the debrief and the report button are in scope |
| Bundled awareness plus simulation | Annual programme fee covering content, assignment, simulations and reporting | You need an auditable programme for NIS2, ISO 27001 or DORA and want one supplier accountable for the metrics | Simulation can become a tick-box inside the bundle; check who designs the pretexts and whether difficulty rises over time |
The eight cost drivers
Every quote is some combination of these. If a proposal does not say where it stands on each, ask before comparing it with another.
1. Number of users and target groups
Licences scale with mailboxes. Managed campaigns scale less with headcount and more with the number of distinct audiences: a finance wave, an executive wave and an all-staff baseline are three scenarios, not one.
2. Campaigns per year and cadence
One baseline tells you where you stand; a quarterly or monthly rhythm tells you whether training works. More waves cost more, but the second wave is the one that produces a trend, and a trend is what the board and the auditor want to see.
3. Languages and regions
Dutch and English are standard. Each additional language needs native-quality pretexts and landing pages, and sometimes separate sending infrastructure and data-residency arrangements for the collected results.
4. Custom pretexts versus templates
A template lure costs almost nothing and is recognised by anyone who has seen it at a previous employer. A pretext built from your suppliers, your tools and your announcements takes research and design time, and is the only kind that resembles the attack you will actually receive.
5. Voice, SMS and QR channels
Vishing calls are performed live by a tester and priced per call block. Smishing needs sending numbers and consent handling. QR and physical drops need design and logistics. Each channel is an add-on because each is real work, not a checkbox.
6. Reporting depth
A dashboard export takes minutes. A report that separates click, credential entry and report rate by department, maps the result to your risk register, and gives the board three decisions, takes analyst time. Ask which you are buying.
7. Integration
Single sign-on and user provisioning from your identity provider, a report button in Outlook or Gmail, routing of reports into your SOC tooling. Integration reduces manual work every campaign but costs effort at onboarding, and some vendors price it separately.
8. Onboarding, infrastructure and allow-listing
Registering lookalike domains, warming sending infrastructure, configuring allow-lists so the mail filter does not quietly swallow the exercise, and agreeing the data-protection and works-council terms. Invisible when done well, and the usual reason a first campaign is delayed when it is not.
What is usually not included
The gap between two quotes is often in the exclusions rather than the headline. Check each of these against every proposal.
- Lookalike domain registration and landing-page hosting, or the right to use your own domain for the exercise
- Allow-listing and mail-flow support with your email security vendor
- Legal and works-council preparation: processing agreement, retention period, no-blame policy
- A report button for the mail client and a triage process for what comes back
- The teaching moment: the landing page shown after a click and the follow-up content
- Debrief workshops for high-risk groups and a board-level readout
- Awareness content between campaigns, unless you are buying a bundle
- A second wave or a retest to confirm whether behaviour changed
- Voice, SMS, QR and on-site components beyond email
Effort by campaign type
The relative effort behind common scenarios. Effort, not money: multiply by the provider's day rate or licence band to sanity-check a quote.
| Campaign type | Relative effort | What moves it |
|---|---|---|
| All-staff baseline from a template | Low | Headcount, allow-listing, reporting depth |
| All-staff baseline with a custom pretext and landing page | Low to medium | Research on your organisation, lookalike domain, teaching page |
| Targeted spear-phishing wave (finance, HR, executive assistants) | Medium | Open-source research per group, multiple pretexts, timing |
| Business email compromise scenario with payment-change request | Medium to high | Supplier impersonation, thread hijack realism, coordination with finance leadership |
| Vishing block against the help desk or finance | Medium to high | Number of calls, live tester time, scripting and consent handling |
| Multi-channel campaign (email, voice, SMS, QR) run as an adversary would | High | Scenario design, infrastructure for each channel, deconfliction with the SOC, full debrief |
How to compare two quotes that look nothing alike
Put both proposals through the same questions. Price differences nearly always come from a difference on one of these.
- Which pricing model is this: licence, managed campaign, or bundle, and what happens to the price if headcount changes
- How many campaigns or waves per year, against which audiences, at which difficulty levels
- Who designs the pretexts and who runs the campaign: named testers or a template engine
- Which channels are included: email only, or voice, SMS, QR and physical as well
- Which metrics are reported: click rate alone, or click, credential entry, report rate and time to first report, by department
- Is the teaching moment included, and is there a report button and a triage process
- Who handles allow-listing, domains, data protection and the works council, and is that time in the price
- Is a debrief included, for whom, and does the proposal say what happens with the repeat clickers
- Is there a second wave, and does the price per wave fall once onboarding is done
The cost of not testing
The Verizon Data Breach Investigations Report has, year after year, placed phishing and the use of stolen credentials among the most common initial actions in confirmed breaches, and has attributed a majority of breaches at least in part to a human element. The UK National Cyber Security Centre, in its guidance on defending against phishing, describes a layered defence in which trained users who report quickly are one of the layers, alongside filtering, hardened accounts and detection, and it notes that an organisation's users are often the first to spot a campaign that technical controls missed. Neither source gives you a price; both describe where the money goes when nobody has rehearsed the attack.
In practice the bill for an untested organisation arrives as a business email compromise payment that is not recovered, an account takeover that leads to a ransomware deployment, or a data breach that triggers the 72-hour notification duty under GDPR Article 33 and, for essential and important entities, the 24-hour early warning under NIS2 Article 23. Incident response, forensics, legal advice, customer notification, regulatory correspondence and management time follow. A phishing simulation does not prevent all of that. It tells you, before the real attack does, which group would have clicked, who would have entered credentials and whether anyone would have reported in time for the security team to act.
Where the money is wasted, and where it is not
The expensive mistake is not a high price per campaign. It is paying for campaigns that teach nothing: a template lure everyone recognises, a click rate reported without a report rate, a licence that runs twelve identical waves while the finance team is never tested with the scenario that actually threatens them. The second expensive mistake is the opposite: a low-priced tool bought to satisfy an auditor, run once, with results nobody acts on, so that the exercise is repeated from scratch next year.
Money spent on a realistic pretext for the groups with payment or admin authority, on the report button and the triage behind it, and on a debrief that changes a procedure, is the part of the spend that returns value. That is where HackersHub puts the hours.
How HackersHub quotes a phishing simulation
We do not publish prices because we do not sell a fixed product. A short scoping call establishes who should be tested, against which scenarios, over which channels and how often, and whether the exercise stands alone or measures an awareness programme. You receive a written scope with the campaign plan, the channels, the named lead tester, the metrics we will report and what is included in onboarding, legal preparation and debrief. Our testers hold OSCP as a baseline, with OSWE and CREST certifications on the team, and a 4.9/5 rating across 127 reviews. Compare the scope line by line with any other proposal; that is what it is for.
Frequently asked questions
Related reading
- Phishing simulation services by HackersHub
- How to run a phishing simulation campaign step by step
- Phishing awareness training for employees: what works
- Security awareness training: what works in 2026
- Business email compromise explained (free awareness library)
- How much does a penetration test cost in 2026?
- Social engineering testing: voice, SMS and on-site
Want a phishing simulation quote you can compare line by line?
A 20-minute scoping call gives you a written campaign plan, the channels, the named lead tester and the metrics we report. No price list, no surprises. Talk to an expert.