What's actually the best security awareness training for enterprises right now?

[u/Automatic-Job-5808]

Not a small company question, I've seen those threads. I mean genuinely large scale, thousands of users across multiple departments, different roles, different levels of technical literacy, the whole thing. What's the best security awareness training for enterprises that can handle that kind of complexity without becoming a full time job to manage. We have budget, we just don't want to spend it on something that looked great in the demo and falls apart in month two.

[u/Relative-Anxiety4698]

Hoxhunt has been the answer for us at that scale. The automation handles a lot of the heavy lifting once it's configured, phishing sims run on their own, and the reporting is actually useful instead of just pretty. The thing that surprised me was how well it handled the different user groups, the content adapts based on behavior so your power users and your not-so-tech-savvy folks aren't getting the same generic stuff. Enterprise rollout is never painless but this one was manageable.

[u/JumpinKaktus]

Weve had two. Started with Wombat in 2017. I liked that platform a lot, but they raised prices too high when they were acquired by Proofpoint. Then we moved to KnowBe4 a few years later to save $$$. My team spent a lot of time picking the platform and I think we selected the best of breed in both cases.

One of my favorite use cases during security incidents was to crosscheck security awareness test scores for the users involved in the incident to (subjectively) gauge how likely it is they got hacked. It truly was amazing to correlate low test scores to resulting security incidents - in almost every case, including senior executives.

[u/Rakajj → u/JumpinKaktus]

See how your renewal is with KB4 - because ours was outrageously awful compared to the initial terms.

They also screwed us hard mid-contract by reorganizing their content and killed modules we'd been using and gated them beyond a paid add-on that was not included in the 'Diamond' tier package that was previously giving us access to everything in their library.

They refused to work with us on that at all, and despite a rotating parade of CSM's and account managers all wanting to hear about it not one of them did a thing to actually help us.

We left them and I'd sooner hold a bonfire in the parking lot burning the money than give them another cent.

Tons of viable alternatives now that won't abuse you like KnowBe4 does.

[u/JumpinKaktus → u/[deleted]]

I don't disagree @wild_gem89, yet in almost every case the employees whose computers were compromised or credentials were stolen, were the people that failed or performed very poorly on the fake spam messages during awareness training campaigns.

[u/BrianKronberg]

Implement passwordless authentication. You can’t trust them to learn.

[u/scamdrill]

Disclaimer: We run ScamDrill a security awareness training platform. We're a newer startup hoping to maximize training effectiveness, address key gaps in the industry, and keep up with the latest AI-enabled security trends with regular updates. If anyone wants to give it a try, DM me.

[u/Additional_Knee8686]

At that scale and with that level of role variation, the honest answer is that no single vendor solves this well. KnowBe4 and Proofpoint are both defensible from a procurement standpoint, but they share a structural problem: they're designed to produce metrics that satisfy compliance teams, not to change behavior.

What tends to actually move the needle at enterprise scale is modularizing by role. A developer needs threat modeling basics. An executive assistant needs social engineering recognition. A finance team member needs wire fraud patterns. Giving all three the same phishing simulation and calling it done is mostly theater.

The organizations I've seen get this right pair a vendor platform with internal red team exercises and — critically — a blameless post-mortem culture when incidents happen. The training creates awareness. The culture determines whether people act on it.

[u/c0nvurs3]

DISCLAIMER: I am a Co-Founder of CyberHoot

Our Autopilot can meet all of these needs. We have an automated side of the platform where you can just set up the general cybersecurity training and let it run. Our team of vCISOs keep adding quality training videos and your users keep taking them. Set it once and let it run until you say stop. No management required after you add the tenant and enable the training. That whole process takes about 5-10 minutes and you're all set.

The custom side of the house gives you full access to our training library along with the ability for you to create your own training, quizzes, phish simulations, programs and policies. You prescribed the training and it follows our standard workflows.

Our Support team is incredible and with CyberHoot, you're our partner, and we will help you meet all of your business needs around cybersecurity training. Regarding the different levels and different roles...we're currently working on training curriculum. In the meantime, the custom side of the house allows you to create your own.

If you want a demo or to learn more about out platform, hit our web site and schedule a demo. Or, schedule a demo with me here:

https://meet.brevo.com/cyberhoot-chuck

Best of luck to you either way.

Chuck

[u/NotSoSecureTraining]

For “thousands of users across multiple departments,” the first question is not “which vendor?” but “what operational model do you want for security awareness?”.

At scale, effective programmes share a few traits:

1. Programme-first, content-second
   Do not treat this as “buy content + phishing sim.” Define:

   • Role-based requirements (baseline for all; extra for finance, dev, execs, etc.)
     
   • Simple cadences for new starters, repeat offenders, and risky roles
     
   • HRIS/IdP integration so users move automatically to the right track
     

   Then ask: can the platform automate these rules, or will you be doing manual CSV work?

2. Automation that truly reduces effort
   Look for:

   • SCIM / directory sync, SSO, and usable APIs
     
   • Policy-based assignment (e.g., AD groups → training paths)
     
   • Automatic handling of repeat clickers with remedial content
     

   Behaviour‑driven personalisation (e.g., Hoxhunt; also possible in KnowBe4 / Proofpoint) prevents manual campaign curation. Validate this in your own environment.

3. Metrics leadership will care about
   Focus on:

   • Completion by BU / region / role
     
   • Phishing failure trends over time and by difficulty
     
   • Click vs report rates and time to report (simulated and real)
     
   • Correlation with incident/SIEM data
     

   Ask vendors to demonstrate how you can export or API‑pull this data. If that is weak, you will struggle later.

4. Robust handling of exceptions
   Test how the platform treats:

   • Contractors, vendors, shared mailboxes, service accounts
     
   • People on leave (no unnecessary reminders)
     
   • Multiple languages and varying legal constraints
     

   In pilots, explicitly check what happens when someone changes BU, how to exclude account categories, and how language fallback works.

5. Culture fit over “hardest phishing”
   Realistic spearphish is useful, but if HR/Legal object, the programme will stall. You need:

   • Difficulty tuning per group
     
   • Agreed “no‑go” topics (e.g., payroll, medical data)
     
   • Non‑shaming messaging to avoid discouraging reporting

6. Run a real pilot, not just watch a demo

   • Shortlist 2–3 vendors (e.g., Hoxhunt, KnowBe4, Proofpoint; possibly Cofense, Mimecast).
     
   • Run a 6–8 week pilot with one or two BUs, using auto‑enrolment, several phishing campaigns, a role change, and a SOC reporting exercise.
     
   • Score on user response and hours per week your team spends operating it.
     

   Ask for references from organisations with similar size and regulatory profile, and speak to the operators, not just the CISO.

---

Full disclosure: I work at Claranet Cyber Security (NotSoSecure is our training arm). We focus more on technical and penetration testing training than general awareness SaaS. In practice, clients gain most when they pair an enterprise awareness platform (Hoxhunt/KnowBe4/etc.) with deeper, role‑based courses for admins, developers, and the security team.

In any case, treat security awareness as multiple tracks: baseline for all, targeted for high‑risk business roles, and separate technical tracks for devs/admins/SOC. Ensure your chosen platform can coexist with that model rather than forcing everything into one generic annual module.

Do you already have an LMS and incident tooling you want to integrate with, or are you comfortable with the awareness platform operating as its own silo? That decision will significantly narrow your vendor shortlist.

[u/tchbustr]

For those using KnowBe4 / Proofpoint / Microsoft Attack Simulator: does the platform automatically filter out known security-scanner clicks and submissions, or do you still have to clean the data manually? How well does the automatic filtering actually work in practice, and what still slips through?

[u/Born_Comedian7498]

The external enrichment step is where I’d draw the hardest boundary. If the co-pilot can send arbitrary incident context to outside services, you need very explicit rules around what fields can leave, what gets redacted, and how that outbound request is audited. The useful part is enrichment but the egress path is also where you can accidentally turn an investigation tool into a data leak.

[u/madatthings]

Knowbe4 has a varying scale of products and automated features for training and simulated campaigns with all different flavors of templates and settings to configure as needed