Compare 16 security awareness training platforms for MSPs: multi-tenant management, pricing, and reporting, with a clear shortlist to evaluate first.
Imagine your MSP supports 20 clients and 1,000 employees with 2 technicians. On Monday, a new customer needs onboarding. On Tuesday, a finance director wants a different training schedule. By Friday, you need 20 client reports and an accurate seat count for billing. A platform can have excellent videos and still leave your team doing most of that work manually.
The best security awareness training platform for an MSP gives you control over that entire service: separate customer environments, reusable campaigns, client exceptions, clear license allocation, and reports you can deliver without rebuilding them every month.
Threatcop is our first shortlist choice for MSPs and MSSPs building a branded human-risk service around simulations, adaptive learning, and executive reporting. Its MSSP OEM model lets you bundle partner licenses into your services, retain your pricing and customer relationship, and use a multi-tenant platform with technical support. Your team remains responsible for the service you sell.
These are buyer-fit recommendations, rather than customer star ratings or results from hands-on platform testing. Product and partner terms below were checked on October 21, 2026. A public company subscription and an MSP purchase agreement can have different prices, minimums, and permissions.
Discover how Threatcop protects your workforce from modern cyber threats.
A useful comparison starts with the service you intend to deliver. Some MSPs need an operating platform; others want a provider to run a recurring awareness program. Others sell training inside a larger security bundle.
| Platform | Best shortlist fit | Commercial detail to establish | Most useful demo request |
|---|---|---|---|
| Threatcop | Own-brand human-risk service with simulations and adaptive learning | Partner license quote, minimums, included products | Run 2 clients with different learning and reporting requirements |
| usecure | Monthly usage-based awareness service | Monthly user count and optional breach-monitoring upgrade | Show a new starter, leaver, and monthly invoice |
| Phin | Automated recurring programs across clients | Monthly usage billing and license rules | Change one shared campaign while preserving a client exception |
| Huntress | Managed awareness with license allocation | Per-learner monthly unit, annual billing | Identify which recurring tasks Huntress runs |
| Hook Security | Outsourced recurring awareness operations | Separate MSP partner proposal | Show the managed monthly program and client report |
| CanIPhish | Multi-tenant simulation and training delivery | 100+ Enterprise users for ongoing partner features | Allocate licenses from a master subscription |
| PhishingBox | Flexible managed simulation and LMS service | Phishing-email units versus subaccount seats | Compare central delivery with client-access accounts |
| Infosec IQ | Shared curricula with delegated client administration | Platform versus optional managed-service scope | Export client reports and billable learner counts |
| KnowBe4 | Established partner ecosystem and structured administration | Bulk MSP versus per-customer arrangements | Demonstrate the exact client access model being quoted |
| Wizer | Short-form training and cross-client automation | MSP proposal rather than direct-company pricing | Deploy one assignment across clients, then handle an exception |
| Keepnet | Multichannel assessment and API-driven service workflows | Subscribed products, usage, and partner terms | Connect client licensing, invoicing, and reporting data |
| CyberHoot | White-label automated learning and phishing options | Included training and purchased phishing capabilities | Separate guided learning from attack-style testing |
| Breach Secure Now | Awareness inside a broader employee enablement service | Cybersecurity scope versus additional learning services | Show the cybersecurity-only client reporting workflow |
| BullPhish ID | MSP parent accounts with client-specific roles | Purchased bundle and contract terms | Give a client limited access without exposing other tenants |
| TitanHQ | Multi-tenant campaigns and automated monthly reports | SAT-only versus wider product bundle | Add a customer to a live program and generate its report |
| Guardz | Awareness within an integrated MSP security platform | Per-user plan and wider security coverage | Show the incremental training workflow and client-level reporting |
The first filter is operational fit. If the vendor cannot show how a technician moves between clients safely, applies an exception, and reconciles the invoice, a larger content library will not resolve those gaps.
Threatcop fits MSPs that want to retain the customer relationship while building a service around simulations and adaptive learning. Its OEM arrangement provides partner licenses, your own commercial packaging, multi-tenant management, onboarding support, and platform maintenance. Threatcop handles the platform and technical support; you manage customer relationships and service delivery.
2,000+ learning resources across 8 formats support personalized training through Threatcop’s US platform. TSAT assesses employee risk through simulations, while TLMS uses risk scores and learning requirements to assign training and track completion. That gives your vCISO a clear service narrative: assess a client, target learning, review progress, and agree the next action.
Pricing: Request an MSP/MSSP quote covering products, license commitments, usage allowances, and support. The public partner page does not provide a dollar buy rate or a complete permission matrix.
Buyer-fit advantage: You can sell a branded program rather than a standalone course subscription. During the demo, require 2 separate customer environments, an exception to a shared program, and a client-ready executive report. Confirm PSA connections, export fields, and exit procedures in your agreement.
usecure’s pricing separates the MSP model from internal IT purchasing. MSPs use monthly usage-based, per-user billing, with no minimum license requirement or long-term commitment stated on that page. Its uService administration supports multi-tenant management and white-labeling.
The core subscription combines uLearn training, uPhish simulations, uPolicy policy management, and uBreach Starter. Automated enrollment, personalized learning paths, and automated phishing support a repeatable service. uBreach Pro is an additional purchase, so compare the included breach-monitoring scope with what your sales proposal promises.
Pricing: Obtain the actual user rate and billing definition. Monthly flexibility is useful only when the count matches the users your clients are paying for.
Best for: An MSP onboarding small customers gradually and avoiding a large initial seat commitment. Ask for a sample month with 3 clients, a mid-month starter, a departing employee, and a suspended account. Confirm what appears on the bill and whether each tenant can retain its own cadence.
Phin focuses on the MSP workflow: multi-tenant administration, shared campaigns, automated reports, and monthly usage billing. That combination is relevant when you want one recurring service template without making every customer identical.
A 20-client portfolio needs consistent defaults, but a healthcare customer and a construction firm may require different timing or content. Ask Phin to demonstrate how a shared campaign changes, which clients inherit the change, and how an exception remains visible to the next technician.
Pricing: The current site promotes monthly usage billing without a long-term contract; obtain the rate, minimums if any, and user-count definition in the proposal. Do not equate a flexible agreement with a guaranteed lower operating cost.
Best for: MSPs that prioritize recurring automation and manageable customer accounts. Inspect the reports your account manager will actually use, plus any API or helpdesk workflow your service depends on. Keep client-facing program evidence separate from any analysis of suspicious emails handled by an additional product.
Huntress Managed Security Awareness Training combines training, simulations, and program management in a managed offering. Its SAT pricing page identifies per-learner, per-month pricing billed annually, active-user licensing, and multi-tenant license allocation.
The purchasing distinction matters. A monthly price unit does not automatically mean a month-to-month contract. Ask what happens when a client leaves in month 4 of an annual arrangement, and whether that capacity can move to another customer.
Pricing: Request the learner rate and annual commitment. Reconcile the definition of an active user with your directory groups and customer invoices.
Best for: MSPs that want a managed program and clearer allocation across clients. Your pilot should identify who selects campaigns, handles exceptions, answers learner questions, and prepares the account manager’s summary. Managed delivery still needs an MSP owner who reviews completion and follows up with the customer.
Hook’s Security Awareness on Autopilot is designed around a managed program, including phishing, training, and reporting. It is relevant when your technicians can administer software but cannot spend each month curating content and preparing every campaign.
Pricing: Hook’s public pricing page distinguishes company subscriptions from MSP partner pricing. Obtain the MSP proposal. Direct-company annual prices should not be treated as your wholesale buy rates.
Best for: A small service team that wants help operating the awareness program. Ask who approves the calendar, changes content after a client request, handles delivery problems, and explains the results in a quarterly business review.
Tradeoff to test: A managed program must still accommodate customer-specific schedules and escalation preferences. Have Hook demonstrate one standard client and one client requiring a different cadence. Agree how exceptions are requested, who fulfills them, and which work is included before you package the service.
CanIPhish’s partner program supports multi-customer administration, separated customer data, white-labeling, and license allocation. The useful distinction is between individual customer subscriptions and a master subscription whose licenses are distributed across clients.
Its partner requirements, updated September 3, 2025, require an Enterprise subscription with at least 100 users and a signed partner agreement to maintain partner features after the trial. The trial includes partner capabilities for evaluation.
Pricing: Request the Enterprise partner rate and confirm whether the commitment is pooled across the customer portfolio. A 100-user requirement is material when your first 2 clients total only 60 employees.
Best for: MSPs that want to evaluate a clearly documented partner structure and actively control simulation and training delivery. Demonstrate customer access roles, periodic reports, license reassignment, and client offboarding. Check whether your chosen subscription structure makes a future transfer to another provider straightforward.
PhishingBox’s partner program separates solution providers, resellers, and content providers. A solution provider can operate a managed simulation or consulting service; a reseller arrangement can leave service delivery and support with PhishingBox. Those are different commitments to your customers.
Its MSP pricing calculator also distinguishes phishing-email units from subaccount seats. The former supports centrally delivered testing without customer access; subaccount seats support a customer account with unlimited phishing under that model. The page states that the base plan includes 50 Professional seats.
Pricing: Quote the service model you intend to sell. Ask which account, learning, and support capabilities attach to your selected package.
Best for: An MSP mixing assessments, recurring simulations, and its own LMS content. Price a 1-time client assessment separately from a 12-month program with customer access. A low unit cost for centrally sent emails does not establish the cost of a full client training portal.
Infosec IQ Global Administration supports separate organizations with their own learners, campaigns, reports, and branding, alongside shared assets and delegated administration. It suits a service model where centrally managed curricula need client-specific execution.
Its program management options include managed-service support. Treat that as a scope decision rather than assuming every platform subscription includes a provider-operated annual program.
Pricing: Request the multi-organization proposal, learner allocation rules, and any additional program-management charges.
Best for: MSPs with a vCISO or awareness specialist designing tailored customer programs. Test the finance workflow as carefully as the learning workflow: export a month-end learner count by client, reconcile it with the invoice, and retain the snapshot.
A January 22, 2024 review below makes this billing concern concrete. It is a useful pilot question; it does not establish whether the same reporting request remains unresolved in the current product.
KnowBe4 has a channel partner program, but you should identify the exact arrangement in your quote before comparing administration or price.
Its published MSP standards of engagement, last updated December 20, 2022 and checked October 21, 2026, specify that under the bulk MSP subscription, the MSP operates administration and the customer does not receive administrative console access. The document also restricts moving existing customer subscriptions into the bulk model. These conditions concern that arrangement; they should not be generalized to every KnowBe4 partner purchase.
Pricing: Ask for a bulk-versus-per-customer comparison, including customer access, license transitions, and commitments.
Best for: An MSP willing to choose a defined management model and operate within it. If a client requires control of its own campaigns, obtain written confirmation that the proposed arrangement permits that. A demo of a different enterprise console does not settle this requirement.
Wizer’s MSP offering combines multi-tenant management, training, simulations, automated reminders and reports, and an MSP API. Its cross-client approach is relevant when a service team needs to assign a program broadly and manage exceptions afterward.
Pricing: Obtain the MSP proposal. Direct-company pricing or a free content offer does not establish partner pricing, administration, branding, or support rights.
Best for: MSPs that want a repeatable training service and expect account managers to explain it easily to SMB customers. Ask a technician to assign one module across 3 clients, exempt a group in one client, and generate the resulting reports.
Tradeoff to test: Short lessons need to connect to the service’s promised outcomes. Show the customer how training assignments, simulated attacks, reminders, and completion evidence join together. Verify the API fields needed for your own dashboard instead of assuming that an API makes every desired report available.
Keepnet’s MSSP partnership supports multi-tenancy, white-labeling, subscribed-product pricing, and API workflows for customer management, invoicing, licensing, and reporting. Its simulation portfolio extends beyond email to channels including SMS, voice, QR codes, and callback scenarios.
Pricing: Request the partner proposal with each simulation product and usage allowance itemized. The public plan structure separates capabilities by package, so the platform name alone does not establish the included channels.
Best for: MSSPs selling targeted assessments or premium awareness services across several attack channels. Demonstrate client-level usage visibility before offering an unlimited-looking service to your own customers.
Tradeoff to test: An API-driven service can still require integration work. Have your operations lead identify which client identifier, billable quantity, campaign result, and report link move into the PSA or business-intelligence system. Establish responsibility for failures and maintenance before including automation savings in the margin forecast.
CyberHoot for MSPs provides a white-label, multi-tenant approach with automated user synchronization, assignments, reminders, escalations, and reports. That supports a consistent training service without manually repeating every assignment in every customer account.
Its phishing approaches need to be distinguished: guided learning through HootPhish and attack-style testing through AttackPhish serve different purposes. Confirm the purchased capabilities rather than treating the word “phishing” as a complete specification.
Pricing: Request a current proposal identifying the included training service and any additional phishing capabilities. A public price could not be verified for this comparison.
Best for: An MSP that prioritizes learning automation and wants to choose how simulated attacks fit into the program. During the pilot, show a guided learning activity and an attack-style assessment separately. Then compare what the client sees, what the technician must operate, and how each activity appears in the customer report.
Breach Secure Now’s MSP offering extends awareness delivery into a wider employee enablement platform. Cybersecurity training and phishing sit alongside areas such as Microsoft 365 productivity and AI awareness.
That breadth can help an MSP selling ongoing workforce education. It can also complicate a comparison when one quote covers cybersecurity training alone and another includes several learning services.
Pricing: Obtain an itemized MSP proposal. Separate the cybersecurity service, additional content areas, onboarding, and any delivery responsibilities.
Best for: MSPs that want awareness inside a wider employee training relationship. Ask for a cybersecurity-only report before assessing the broader catalog. Your vCISO still needs to explain phishing participation, training completion, unresolved gaps, and recommended next actions.
Tradeoff to test: Broader content should support the service your client bought. If the immediate need is a precise phishing and remediation program, demonstrate that workflow independently. Avoid paying for a larger bundle solely because its total number of courses looks attractive.
BullPhish ID’s documentation describes MSP parent organizations managing SMB customer environments, training, simulations, directory synchronization, and reporting.
Its user-role guide, revised September 25, 2025, distinguishes partner-level administration from client-level privileges and read-only access. That makes the role model worth demonstrating with your technician and client contact.
Pricing: Request the purchased bundle and contract terms; do not assume every Kaseya relationship has the same awareness entitlement.
Best for: MSPs that value structured parent/client administration. Test the report path for remediation: the Auto Enrollment documentation states that remediation data is accessed through campaign details rather than Business Reports, and remediation campaigns cannot be edited or recreated. Confirm that your promised client evidence can be assembled through the available reports.
TitanHQ Security Awareness Training supports multiple customers, white-labeling, automated monthly summary reports, and mass campaigns. Its Auto Campaigns approach is relevant when you want a standard recurring program that can include newly added clients and learners.
The current site places TitanHQ within CyberSentriq. When evaluating an older SafeTitan reference, confirm which current platform and service you will actually receive.
Pricing: Request a SAT-only proposal and, if relevant, a wider bundle comparison. Identify the license unit, minimum commitment, included campaign management, and support route.
Best for: MSPs that want recurring training and phishing within a multi-customer service. Ask for the sequence from adding a customer to assigning its learners and receiving its first monthly report.
Tradeoff to test: A mass campaign must still respect client exceptions. Demonstrate one customer with a different schedule and another with a distinct learner group. Check what changes globally and what remains local before standardizing the service across your portfolio.
Guardz Security Awareness Training sits within a broader MSP cybersecurity platform. Its current plans include adaptive awareness within Pro, alongside identity, endpoint, email, and exposure capabilities; higher packages expand detection and response coverage.
The pricing page describes per-user purchasing, license movement across clients, volume options, and a 14-day trial. Exact MSP prices are provided directly. These are the terms checked October 21, 2026; older public seat prices should not be carried into a current comparison.
Best for: An MSP already seeking a wider integrated security service. Evaluate the awareness workflow as one part of that decision.
Tradeoff to test: Compare the incremental cost and operational value of training inside the bundle with a dedicated awareness platform. Ask how the client report separates learning completion, phishing behavior, and security-control alerts. Your account manager should be able to explain each measure without implying that a training score is equivalent to detection or response performance.
Use 3 customer environments in the pilot: a standard SMB, a client requiring a custom schedule, and a client with its own administrative contact. A single populated demo tenant cannot prove customer isolation, shared program behavior, or delegated access.
| Pilot task | Pass condition to request | Why it matters to the MSP |
|---|---|---|
| Create a second customer | Separate learners, campaigns, reports, and client identifiers | Prevents portfolio administration from becoming one mixed account |
| Add a restricted technician | Access only the clients and actions assigned to that role | Limits accidental changes and unnecessary data exposure |
| Delegate client access | Client sees its permitted data and actions only | Supports co-managed customers without exposing another tenant |
| Edit a shared campaign | Demonstrate inheritance and a visible exception | Avoids repeatedly rebuilding the same program |
| Synchronize a starter and leaver | Show assignment behavior, history, and billing treatment | Connects the directory to operations and invoicing |
| Transfer or close a customer | Export evidence and explain retention and license treatment | Makes offboarding a defined process |
Ask the vendor to perform these actions in the environment you will buy. Product screenshots and a partner brochure are useful introductions; the pilot should establish whether the workflow matches your service.
Picture your 20-client MSP applying one monthly training program. Eighteen customers accept the default, one customer wants quarterly assignments, and one needs a finance-specific lesson. If your technicians duplicate the program twice, ask what happens when the shared content changes next month.
The useful result is a visible relationship between the standard program and each exception. Record who owns the exception, which client approved it, and when it should be reviewed. Otherwise, a temporary accommodation can become a forgotten service variation that is difficult to explain at renewal.
Decide early whether customers need learner access, report access, campaign administration, or full account control. These are 4 different requirements. A platform may support a customer portal without permitting customer-managed campaigns under the partner contract you are considering.
KnowBe4’s bulk arrangement makes that distinction explicit. The same question belongs in every vendor conversation: what can the customer do under the exact subscription we are buying? Put the answer beside the service description your sales team will use.
Compare the landed cost of delivering the service, including licenses, recurring labor, onboarding, reporting, and additional usage. Keep your wholesale purchase price separate from the price you charge customers.
For the broader company-buying context, see this security awareness training cost guide. Apply the partner terms below when modeling your own MSP service.
The following commercial details were checked October 21, 2026. Request the current rate card and agreement before using them in a customer proposal.
| Platform or model | Public commercial detail | What to put in the quote request |
|---|---|---|
| Threatcop OEM | Partner licensing with MSP-controlled service packaging | License minimum, products, usage, technical support, and renewal basis |
| usecure MSP | Monthly usage billing; no minimum licenses or long-term commitment stated | Billable-user definition and optional uBreach Pro charge |
| Phin | Monthly usage billing and no long-term contract promoted | User status rules, billing cutoff, and any minimums |
| Huntress SAT | Per-learner monthly unit billed annually | Annual commitment and allocation of unused seats |
| Hook MSP | Partner pricing separate from company plans | Managed tasks, exceptions, and incremental service charges |
| CanIPhish partner | 100+ Enterprise users and partner agreement after trial | Portfolio pooling, unit rate, and customer transfer rules |
| PhishingBox MSP | Phishing-email and subaccount-seat models | Customer access, included learning, base seats, and extra quantities |
| Guardz | Per-user platform plans; exact MSP pricing provided directly | Awareness scope, bundle cost, and license transfer rules |
The strongest proposal names the unit being purchased and the work included. “Per user per month” leaves too much unresolved if an annual commitment, inactive users, or additional simulation usage changes your actual cost.
Imagine you sell a 1,000-user program for $4 per user per month, generating $4,000 monthly revenue. For your planning sheet, assume a platform buy rate of $1.50 per user, a loaded technician cost of $60 per hour, and $200 in other monthly delivery costs. These are your scenario inputs, not prices attributed to any vendor.
| Monthly service measure | Program requiring 20 labor hours | Program requiring 8 labor hours |
|---|---|---|
| Customer revenue | $4,000 | $4,000 |
| Platform licenses | $1,500 | $1,500 |
| Technician labor | $1,200 | $480 |
| Other delivery costs | $200 | $200 |
| Service contribution before wider overhead | $1,100 | $1,820 |
| Contribution as a share of revenue | 27.5% | 45.5% |
A 12-hour difference changes monthly contribution by $720, or $8,640 over 12 months if the inputs remain constant. This calculation gives your pilot a useful target: measure recurring delivery time rather than assuming that every automation feature reduces labor equally.
Use the formula monthly service contribution = client revenue − platform cost − delivery labor − other service costs. Keep onboarding, sales effort, taxes, financing, and general business overhead visible elsewhere in the forecast; the table does not calculate company profit.
If your proposed agreement requires 100 seats but your initial customers use 60, you are paying for 40 unallocated seats. At a hypothetical $2 buy rate, that is $200 divided by 60 deployed learners, or about $3.33 per deployed learner before labor.
That arithmetic is especially relevant to a documented minimum such as CanIPhish’s 100-user partner requirement. Use the real quoted rate in your own model. Ask whether capacity can be pooled, reassigned, ramped, or reduced, and when changes take effect.
Customer reviews are useful for identifying what to demonstrate: content relevance, setup effort, reporting, follow-up, and billing. The 6 excerpts below are individual experiences, with their public author labels and dates. They are not a comparative rating of current MSP editions.
| Product and directly linked reviewer | Date and relevant context | Exact excerpt | Practical buying implication |
|---|---|---|---|
| Threatcop — Akshat V. | June 10, 2026; cyber security engineer, business with 50 or fewer employees; validated G2 reviewer, G2 invitation without G2 incentive | “interactive and hands-on training” | Ask to see the learner activity your clients will receive, alongside the administrator workflow |
| Threatcop — raktim p. | June 10, 2026; Admin, 51–1,000 employees; validated, organic G2 review | “ample amount of real life examples” | Review content against the roles and situations in your customer base |
| Phin — Verified User in Computer & Network Security | June 17, 2025; business with 50 or fewer employees; validated, organic G2 review | “high quality content that doesn’t waste your time” | Assess learner time and management effort separately; the public review does not identify an MSP role |
| PhishingBox — Danny S. | July 9, 2026; Owner, 50 or fewer employees; resells the platform and uses its LMS; current-user validation, incentivized seller invitation on G2 | “Learning the platform takes a little time” | Include technician familiarization in onboarding; the review also describes the platform becoming easier after that learning period |
| Huntress — Sam G. | July 16, 2026; Level 2 Support Engineer, 51–1,000 employees; current-user validation, incentivized seller invitation on G2 | “tracking progress and following up much easier” | Demonstrate follow-up and the level of report detail; the reviewer also wanted more detail and customization |
| Infosec IQ — Verified User, Director in Finance and Accounting | January 22, 2024; Computer & Network Security company, 11–50 employees; vetted TrustRadius review, uses IQ internally and for clients | “this would be helpful when billing clients” | The reviewer requested monthly seat counts by group; validate today’s export rather than assuming the historical request remains a product gap |
The strongest MSP-specific lesson comes from the billing and reseller context. A positive learning experience can coexist with onboarding effort or a reporting request. Keep those questions in the pilot instead of using a single favorable quote to settle the purchase.
The 2 Threatcop reviewers support a content and learning-experience case. They do not establish partner margins, multi-tenant permissions, or the time your technicians will save. For those purchasing questions, pair the learning evidence with an OEM demonstration and a written partner proposal.
That combination is useful for a branded service: your customer needs relevant training, while your operations team needs a workable account model. Verify both before the sales team turns them into a recurring commitment.
Require 3 separate outputs: an executive client summary, an operational follow-up report, and a billing reconciliation. One dashboard rarely answers all 3 audiences equally well.
| Output | Intended reader | Required fields or questions | Failure to catch in the pilot |
|---|---|---|---|
| Executive client summary | Owner, CISO, vCISO, account manager | Period, learner coverage, training progress, simulation response, open actions | Attractive score with no explanation of the next decision |
| Operational follow-up | Technician or awareness administrator | Assigned learners, overdue work, failed delivery, exceptions, action owner | Manual reconstruction of who needs attention |
| Billing reconciliation | MSP finance and service manager | Client ID, period, billable quantity, license changes, subscription type | Directory total differs from billable seats without an explanation |
| Evidence export | Client audit or assurance contact | Completion record, relevant activity dates, scope, retained history | Report cannot be reproduced after a learner leaves |
Ask for a sample report generated from your pilot data. Check whether it can be scheduled, branded, exported, and reproduced for a past reporting period. A report that looks useful in a sales deck may require additional work once customers ask different questions.
A raw click rate needs context. If Client A receives an easy test and Client B receives a more difficult lure, the difference does not establish which organization is safer. Record the campaign, audience, delivery conditions, and reporting period beside the result.
If a customer needs the underlying process explained, this guide to how phishing simulations work provides the foundation.
For each client review, separate simulation participation, suspicious-message reporting, learning completion, and unresolved follow-up. Use repeated measures within a reasonably consistent program to explain progress. Avoid turning one cross-client ranking into a claim about overall breach probability.
A finance team should be able to reproduce the count behind an invoice. Decide whether you bill enrolled users, active learners, an agreed minimum, or another contractual unit. Then establish how the platform’s count maps to that unit.
For a 20-client portfolio, keep the platform client ID in the billing record. Names can change; a stable identifier reduces reconciliation errors. Include the reporting period and any manual adjustment so next month’s technician does not have to reconstruct the decision.
Run a 30-day evaluation around the work you expect to repeat. This is a proposed evaluation schedule; it is not a promise that every vendor or customer will complete deployment within that time.
| Evaluation window | Owner | Task | Evidence to retain |
|---|---|---|---|
| Days 1–5 | Service manager and technician | Establish 3 client accounts, roles, directory scope, and delivery readiness | Role matrix, enrollment count, approved campaign scope |
| Days 6–10 | Awareness lead | Launch a standard assignment and one client exception | Activity record, exception owner, technician time |
| Days 11–20 | Technician and account manager | Run follow-up, handle one starter and leaver, inspect reports | Task log, support response, report drafts |
| Days 21–25 | Finance and service manager | Reconcile billable quantities and the sample vendor invoice | Client-level billing worksheet |
| Days 26–30 | vCISO and commercial owner | Review client outputs, offboarding, and proposed service margin | Shortlist decision and written scope |
Include 2 learners with different needs in the content review: one who relies on captions and one who needs an alternative language. Check captions, transcript availability, mobile usability, and the accessibility features your customer requires. Do this in the purchased content, since a sample video may not represent the entire library.
The pilot should produce something your team can sell and operate. A successful learner launch alone is insufficient if the recurring report or invoice still requires unplanned manual work.
Use this 100-point weighting as a starting template, then change it to match your portfolio. Score each criterion from 0 to 5 using pilot evidence; calculate weighted points as the score divided by 5, multiplied by the criterion weight. These are your evaluation scores, separate from customer review ratings.
| Evaluation criterion | Suggested weight | Evidence for a strong score |
|---|---|---|
| Client isolation and delegated access | 25 | Correct permissions across all 3 pilot clients |
| Recurring service workload | 25 | Measured technician time, repeatable assignments, visible exceptions |
| Reporting and billing reconciliation | 20 | Reproducible client report and billable-seat snapshot |
| Learning and simulation fit | 15 | Relevant content, accessible delivery, appropriate assessment scope |
| Commercial flexibility and exit | 15 | Acceptable minimums, commitments, transfers, and exports |
A combined score should not override a failed mandatory requirement. If a client must have administrative access and the quoted arrangement prohibits it, remove that option from the shortlist regardless of its total.
| Recurring task | Confirm the provider’s role | Assign within your MSP |
|---|---|---|
| Content selection and campaign scheduling | Included managed work, automation, or platform tools only | Awareness service owner |
| Customer approval and exceptions | Request process and turnaround | Account manager or vCISO |
| Enrollment and directory issues | Technical support scope | Technician |
| Learner questions and overdue work | Available learner support and escalation | Named customer contact plus MSP owner |
| Client reports and review meetings | Generated report versus interpreted service | Account manager or vCISO |
| Seat reconciliation and renewal | Billing exports and change rules | Finance and service manager |
For Threatcop, the OEM model gives you platform maintenance and technical support while preserving your customer relationship. For a managed-program provider such as Hook or Huntress, identify the additional recurring activities included in the proposal. Price your remaining responsibilities in either case.
Start with a base service containing a defined training cadence, simulation scope, follow-up responsibilities, and reporting period. A premium service can add role-specific content, additional assessment channels, or vCISO interpretation when the purchased capabilities and your delivery capacity support them.
Avoid describing a package as unlimited when voice calls, SMS, customization, or technician involvement have practical or commercial limits. Write down the response process for a customer asking for an extra campaign halfway through the month.
Choose around the service you can deliver consistently across customers. Use the shortlist below to narrow demos, then decide with your pilot results and the actual partner proposal.
| Your MSP’s priority | Start with | Condition to resolve before selecting |
|---|---|---|
| Branded human-risk service with simulations and adaptive learning | Threatcop | Confirm partner economics, customer roles, included products, and report workflow |
| Monthly flexibility while the portfolio grows | usecure, Phin | Match billable-user rules and usage snapshots to customer contracts |
| Help running the recurring awareness program | Hook Security, Huntress | Assign every recurring task and price what remains with your team |
| Detailed control over customer simulations and account allocation | CanIPhish, PhishingBox | Compare minimums, license units, client access, and transfers |
| Shared curricula or client-specific administrative rights | Infosec IQ, Wizer, BullPhish ID | Demonstrate delegation and the reports your clients need |
| Established channel procurement with a defined operating model | KnowBe4 | Resolve bulk versus per-customer access and transition requirements |
| Specialist assessments or wider service bundles | Keepnet, CyberHoot, Breach Secure Now, TitanHQ, Guardz | Isolate the required awareness capability and its actual delivery cost |
Start with Threatcop when you want the client relationship, service packaging, and awareness program to reinforce your own MSP brand. Its simulations and learning management system provide the product foundation; your pilot establishes the customer workflow and commercial fit.
Compare Threatcop’s simulation capabilities with the attack scenarios your clients need. Review the Threatcop MSSP offering, then book a demonstration with a technician, service manager, and commercial owner. Bring 3 client profiles, your expected learner count, a sample report, and your billing template. That makes the conversation specific enough to decide whether the service will work for your portfolio.
Some models permit a smaller start. usecure’s public MSP pricing states no minimum license requirement, while CanIPhish’s ongoing partner features require at least 100 Enterprise users after the trial. Compare the actual quote, contract term, and billing definition for your initial customer base rather than assuming all partner programs have the same threshold.
No. A price can be expressed per learner per month while the purchase is billed annually, as Huntress’s SAT page describes. Separate the price unit, invoice frequency, commitment period, and rules for reducing or reassigning seats. Your customer cancellation terms should reflect the commitments your MSP is accepting.
That depends on both roles and the purchased arrangement. BullPhish ID documents client-level privileges, while KnowBe4’s bulk MSP terms specify MSP-operated administration without customer admin access. Require a demonstration of the exact customer role under the quoted subscription before promising co-managed campaign control.
Confirm each surface separately: learner portal, login domain, campaign messages, training content, scheduled reports, and support communications. A logo on the dashboard does not establish all of those rights. Record the branding included in your partner package and show your account manager the customer experience during the pilot.
Agree the export, retention, administrator transition, and license treatment before onboarding. Ask for learner completion records, campaign history, and past reports in usable formats. A client departure should also trigger directory removal, access review, and billing reconciliation so the next invoice reflects the agreed commercial treatment.
Threatcop combines an OEM partner model with multi-tenant administration, simulations, adaptive learning, and executive reporting. Its 2,000+ learning resources across 8 formats give your program content options, while the partner model preserves your commercial relationship. Evaluate permissions, included products, service responsibilities, and pricing against your own client portfolio before committing.
Cyber Security Specialist
Department: Compliance, Threatcop
Sara Abraham is a Cyber Security Specialist at Threatcop, where her extensive expertise in the field is instrumental in strengthening the company’s cyber security initiatives. She is a key contributor to the company’s mission of providing top-notch security solutions.
Compare 16 phishing simulation tools for awareness managers: pricing, automation, and reporting, with a clear shortlist of platforms to...
Compare 15 Hoxhunt alternatives for CISOs: pricing, automation, and reporting, with a clear shortlist of platforms to evaluate before...
Compare DMARC pricing across 13 providers for IT managers: plan limits, domain caps, and first-year costs, with a clear...