Security Awareness Training
A Cyber SaaS Analysis 2026
Threat Context
How attackers use AI against your people, and why training is falling behind.
Security Outcomes Video
What Australian IT leaders prioritise when choosing a security awareness training solution.
Product Landscape
20 leading platforms benchmarked on The Tekspace Cyber Continuum™.
Category Findings
Key takeaways, future outlook, and how to act on this research.
The real problem with security awareness training happens before the product is chosen.
Cyber training programs are typically evaluated and purchased by IT and cybersecurity teams. Criteria is technical, shaped by vendor demos, largely disconnected from the people in the business: what shifts their behaviour and fits into busy days?
If this vital human question is skipped in selection, no feature list alone will deliver lasting change. This report shows why teams need executive sponsorship, and effective socialisation.
Without these foundations, adoption stays low regardless of which platform is selected. Teams go back to market blaming the product for what the program never delivered.
Meanwhile, attackers study supply chains and org charts, and use AI to produce requests near-indistinguishable from legitimate ones.
The capacity of any workforce to absorb, retain, and act on security knowledge under pressure has a ceiling. Beyond it, the responsibility shifts to the defence-in-depth layers that wrap around your people: email security, endpoint controls, identity management.
This report is produced in collaboration with Parabellum, Byte and CodeBlue New Zealand. We examined 20 platforms, assessing the cyber curriculums that deliver lasting change.
This report finds that people are not the problem. They can be a solution with the right training solution.
Threat Context
Insights from 
Security awareness training is growing the skills gap
Many organisations still train staff once a year1: a short module, filed for audit. It satisfies the checkbox. It does not change behaviour. A 2025 study of more than 19,500 health workers found that staff who had recently completed their training were no less likely to fail a phishing test than staff who hadn't.2
A University of Adelaide review of 42 phishing-training studies found gains lasted six months at most. Brief refreshers stretched that to 12.3
Phishing was how attackers got in for 38% of the incidents reported to the ACSC in 2024-25.4 The skills gap between staff and attackers keeps widening. AI widens the gap further. Hoxhunt’s research found AI-written phishing is now 24% more effective than phishing written by people. In 2023 it was 31% less effective.5
The awareness-action gap
Before training, Australian and New Zealand staff click phishing tests at the third highest rate of any region in the world.6 Knowledge-based training alone can't close the gap between knowing and doing. In Proofpoint's 2024 survey, 72% of Australian workers admitted to a risky action at work, and 98% of them knew it was risky and did it anyway.7
Legacy modules can inform, but they can't change behaviour under pressure, deadline, or the authority cues modern social engineering exploits.
Training can’t teach beyond the inbox. Tekspace’s Email Security research found phishing is the single biggest cause of cyber breaches reported to the OAIC.8 But the attack surface has moved past the inbox, and training hasn't followed.
Deepfakes compound the risk: Mastercard-commissioned research found one in five Australian businesses had received a deepfake threat in the previous 12 months,9 yet only 4 of the 20 training platforms we assessed can simulate a deepfake of your own people.
Attacks moved past the inbox
Rise in voice phishing across the second half of 2024, worldwide.10 Only 6 of the 20 platforms we assessed can simulate a phone attack.
Scam texts blocked by Australian telcos in 2024.11 Only 8 of the 20 platforms we assessed simulate SMS phishing.
Platforms we assessed that simulate QR code phishing. Three of the four in our top tier do; below it, few do.
The regulatory cost of inadequate training
Across the regulated economy, the bar for adequate training has moved from completion to demonstrated behaviour change. For the first time ever, cybersecurity training is now a business obligation, not an IT task. When a breach happens, businesses face a greater financial cost from the government than the APTs.
Penalties now reach the training program
The maximum civil penalty for a serious or repeated privacy interference, or 30% of adjusted turnover if that's greater.
The maximum daily penalty for non-compliance with a critical infrastructure risk management program, across the Act's 11 regulated sectors.
Requires APRA-regulated entities to test their information security controls and report material failures to the Board. APRA’s guidance (CPG 234) adds periodic testing of staff understanding, social engineering included.
Australian Clinical Labs: first civil penalty in Privacy Act history. $4.2M for failing to protect personal information, plus $1.6M for failing to assess and notify the breach. The court cited no formal cybersecurity training for key IT staff.
Oxfam Australia's undertaking mandates an ongoing privacy and information security training program for staff, contractors and volunteers, with regular refresher training required.
Sources: Privacy Legislation Amendment Act 2022; Security of Critical Infrastructure Act 2018; CPS 234 Information Security; OAIC media release; Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224; OAIC enforceable undertaking.
Compliance sets the floor, not the goal. Shift the target to sustained behavioural change, and the human layer moves from liability to a functioning part of the organisation's cyber strategy.
Security Outcomes
With the threat context as a backdrop, what do information technology professionals prioritise when considering a new security awareness training solution?
What matters in your assessment? Whatever the domain, a security product earns its place against the same four outcomes. Choose each to see how we assess the security awareness category.
Trains people against every channel attackers use, at their own level.
- Simulation coverage across email, SMS, voice, QR and deepfake lures
- A reporting button in the mail client so staff can flag what they spot
- Adaptive difficulty that responds to how each person performs
Product Landscape
This is a crowded category: we screened more than 70 vendors offering some level of training. We’ve ranked the 20 platforms that deliver phishing simulation, in-email reporting and awareness education on the Tekspace Cyber Continuum™ to show what makes the top platforms so effective for buyers.
Focused
-
Hacker Rangers
-
ID Agent
-
CyberHoot
-
Boxphish
-
Riot
-
Mimecast
Features
- Phishing Simulations
- Training Content Library
- Interactive Training Modules
- Continuous Assessment
- Performance Reporting
- Platform Customisation
- Security Baselining
- AI-Generated Simulation Content
- Gamification
- White-Label Branding
- Behavioural Risk Scoring
- In-Email Report Button
Broad
-
Huntress
-
usecure
-
SANS Institute
-
Ninjio
-
MetaCompliance
-
Infosec IQ
-
Barracuda
-
Immersive Labs
-
SoSafe
-
Proofpoint
Features
- Advanced Analytics & Dashboards
- Adaptive Learning Engine
- Smishing Simulation
- Single Sign-On
- LMS & Third-Party Integration
- Multilingual Content
- Policy & Compliance Management
- Multi-Tenant Management
- REST API
- SIEM Integration
Comprehensive
-
Hoxhunt
-
Adaptive Security
-
Phished
-
KnowBe4
Features
- Vishing Simulation
- QR Code Phishing (Quishing)
- Dark Web & Breach Monitoring
- AI-Powered Spear Phishing Personalisation
- Automated Risk-Based Simulations
- Custom Scenario Builder
- Threat Intelligence Reporting
- Role & Industry-Specific Content
- Autonomous Phishing Simulation Orchestration
- Geo-Contextual Simulation Targeting
- Content Authoring Tools
- Hands-On Labs & Skills Assessment
- Structured Learning Paths
- Deepfake Simulations
- Data Sovereignty
We collated 380+ unique vendor features across the twenty vendors, normalising them down to 37 scored capabilities in 9 capability groups, each group sitting under one of the four outcomes above. A weighted scoring model then produces a single maturity score per vendor: a picture of feature depth, not just feature count.
Want to know which of these fits your environment? We help with that.
A logo on a chart does not tell you whether the content will land with your people, in their languages and their roles, or just record another completion.
Book your sessionCategory Findings
Start with the learning model, not the feature list.
The quickest way to assess a platform's maturity is how it teaches.
- Library:
- Platforms built like a library hand administrators a content catalogue and hope for the best.
- Exam:
- Others work like an exam, training only on failure.
Neither reliably changes behaviour. The model that produces measurable change is a curriculum, sequenced content that:
- builds foundations first
- repeats the basics
- layers complexity
- adapts to each person's skill level and susceptibility traits
IT teams often find this approach too simple. That is their lens, not their workforce's.
With automated set ups or smart baselining the best platforms deliver value from day one, not after six months is spent setting up the curriculum.
Because a platform is only half the investment. Without executive support, without socialising why it's being done, without normalising failure, adoption will be low regardless of platform.
And it is why teams go back to market blaming the solution.
An opportunity to reimagine your training
Once-off induction sessions and annual modules are not delivering the outcomes Australian organisations need.
Technical controls handle what they can. Between what technology covers and what falls through the cracks, a well-run training program is the highest-return investment most organisations have not yet made properly.
If your current program is not producing measurable behaviour change, we can help. We will map your program against the outcomes in this report, identify the gaps, and match you with the platform best suited to your people, your compliance obligations, and your risk profile.
Addendum
Credits
In launching this report, the Tekspace would like to acknowledge contributions from the following teams and individuals.
Contributors
- Lead Analysts — Frank De Pasquale, CEO at Tekspace.
- Threat Context — Martin Dybalski, Director; Stuart Shanahan, Director of Technical Services; and Kris Bowen, Senior Offensive Security Consultant, all at Parabellum.
- Security Outcomes — Mathew Jose, Chief Information Security Officer at CodeBlue New Zealand; and Stacy Gurrie, Chief Executive Officer at Byte.
- Research and analysis by the Tekspace Research team.
References
- Carlopio, J. (2023), One-off, once-a-year, ‘tick-the-box’ compliance-oriented cyber security training is not doing the job: a report on Australian organisations’ cyber culture 2022, AusCERT 2023.
- Ho, G., Mirian, A., Luo, E., Tong, K., Lee, E., Liu, L., Longhurst, C.A., Dameff, C., Savage, S. and Voelker, G.M. (2025), Understanding the Efficacy of Phishing Training in Practice, IEEE Symposium on Security and Privacy.
- Marshall, N., Sturman, D. and Auton, J.C. (2024), Exploring the evidence for email phishing training: a scoping review, Computers & Security 139, p.12.
- Australian Signals Directorate (2025), Annual Cyber Threat Report 2024-25, p.33.
- Hoxhunt (2025), AI-powered phishing outperforms elite red teams in 2025.
- KnowBe4 (2025), Phishing by Industry Benchmarking Report: Australia and New Zealand 2025, p.4.
- Proofpoint (2024), Proofpoint: 71% of Australian employees willingly gamble organisational security (2024 State of the Phish).
- Office of the Australian Information Commissioner (2025), Notifiable Data Breaches Report: July to December 2024, Table 3.
- Mastercard (2024), as reported by Technology Decisions, Australian businesses falling victim to deepfakes.
- CrowdStrike (2025), CrowdStrike Releases 2025 Global Threat Report.
- National Anti-Scam Centre, ACCC (2025), Targeting scams: report of the National Anti-Scam Centre on scams data and activity 2024, p.9.
Security Awareness Training category
What this report does and doesn’t claim to cover, how we compare products fairly, and what to do if you still have questions.
Scope
This report evaluates platforms delivering phishing simulations, in-email reporting, and cybersecurity awareness education. It does not cover standalone email security gateways, broader governance/risk/compliance platforms, or physical security awareness programs.
Twenty-three vendors were researched. Three were excluded as out-of-category following technical review, leaving 20 platforms in the final evaluation.
Feature Granularity Model
We compare products at what we call Level 2: The Functional Group: specific enough to be meaningful, broad enough to compare very different products fairly, without losing sight of how they’re meaningfully different.
Further questions
Why isn't annual or compliance-driven training enough on its own?
Most organisations still train staff once a year with a single module that satisfies a regulatory checkbox but proves attendance, not behaviour change. As this report's threat context shows, any improvement from one-off training measurably fades within months, while attackers increasingly use AI to produce phishing that is more convincing than anything a once-a-year module prepares people for.
How is this different from a one-off phishing simulation or a training content library?
A single simulated phishing test or a library of modules staff pick through on their own proves attendance, not behaviour change. The platforms in this report run a continuous, sequenced curriculum that adapts to each person's risk profile instead, which is the model most training programs have not yet adopted.
How were the 20 vendors in this report actually compared?
We normalised the market to a shared set of scored features and assessed each vendor at what we call the Functional Group level: specific enough to be meaningful, broad enough to compare very different products fairly. See Feature Granularity Model above for how that scale works.
What happens if I want another vendor assessed?
Get in touch. This report focuses on solutions widely regarded as market leaders or strong emerging players, not every product on the market, and we are glad to look at ones we have not yet covered.
Disclaimers
Findings reflect our professional judgement at the time of publication, based on the data available to us. Product capabilities and roadmaps change, so organisations should treat this report as a guide to practical decision making, not as a substitute for their own due diligence.
If you have identified errors in this report, or wish to have another product assessed, please contact our team.
Contact our teamFocused
-
Hacker Rangers
-
ID Agent
-
CyberHoot
-
Boxphish
-
Riot
-
Mimecast
Features
- Phishing Simulations
- Training Content Library
- Interactive Training Modules
- Continuous Assessment
- Performance Reporting
- Platform Customisation
- Security Baselining
- AI-Generated Simulation Content
- Gamification
- White-Label Branding
- Behavioural Risk Scoring
- In-Email Report Button
Broad
-
Huntress
-
usecure
-
SANS Institute
-
Ninjio
-
MetaCompliance
-
Infosec IQ
-
Barracuda
-
Immersive Labs
-
SoSafe
-
Proofpoint
Features
- Advanced Analytics & Dashboards
- Adaptive Learning Engine
- Smishing Simulation
- Single Sign-On
- LMS & Third-Party Integration
- Multilingual Content
- Policy & Compliance Management
- Multi-Tenant Management
- REST API
- SIEM Integration
Comprehensive
-
Hoxhunt
-
Adaptive Security
-
Phished
-
KnowBe4
Features
- Vishing Simulation
- QR Code Phishing (Quishing)
- Dark Web & Breach Monitoring
- AI-Powered Spear Phishing Personalisation
- Automated Risk-Based Simulations
- Custom Scenario Builder
- Threat Intelligence Reporting
- Role & Industry-Specific Content
- Autonomous Phishing Simulation Orchestration
- Geo-Contextual Simulation Targeting
- Content Authoring Tools
- Hands-On Labs & Skills Assessment
- Structured Learning Paths
- Deepfake Simulations
- Data Sovereignty
We'll connect you with the right people
Vendors see your organisation's size and industry, never your name or contact details.
By making an enquiry you agree to Tekspace contacting you about it and sending related research. Unsubscribe any time. Privacy