How to get budget approval for security awareness training

How do you get budget approval for security awareness training? Show decision-makers three things: what the program costs compared with what an incident could cost your organization, how it fits the time and people you have, and how you'll prove it's working. Then tailor the case to each person who needs to approve it, since a CEO, a finance manager and an HR lead look for different things.

The person who sees the need, usually an IT or security manager, is rarely the person who signs off. This guide is for that person. It covers who needs to approve, what drives the cost, how to put numbers on the decision and what a one-page proposal should include. If you're considering Nimblr, we can also give you a demo account and a quote to share with your decision-makers.

Who approves the budget for security awareness training?

Different approvers look for different things, so prepare for each.

In practice, a short summary, the quote and access to a demo account are what most decision-makers ask for. A demo account lets them click through a lesson and see the reports themselves, which often answers more questions than a slide deck.

In the public sector and in municipalities, budgets usually follow the calendar year, costs may be split across departments and political changes can affect new spending. Start the conversation before next year's budget is set, often in the autumn, and agree early on whether the program is funded centrally or by each department.

What affects the cost of security awareness training?

Most security awareness platforms are priced per user. Nimblr uses a volume-based, tiered model, so the price per user goes down as the number of users goes up. The standard agreement runs for 12 months and includes product upgrades and technical support.

For a specific organization, the price mainly depends on the number of users, how many languages you need (training and simulations are available in more than 30 languages), whether you add smishing simulations for some or all employees, and whether you want your own branding or custom courses. The core program includes Micro Training lessons, simulated attacks, Instant Learning, Role-Based Learning, the Microsoft report button integration, reporting and guided onboarding.

One practical tip: ask how inactive and service accounts are counted, since an automatic directory sync can include accounts that aren't real employees. You can request a quote for your organization's size.

How do you calculate the cost and value of security awareness training?

A simple worksheet makes the case easier to discuss. List costs on one side and benefits on the other.

Costs to include in your security awareness training budget

• The annual license.

• Setup time. With Nimblr, the guided configuration rarely takes more than half an hour with an onboarding specialist.

• Employee time. With lessons under five minutes, about one lesson a month and a few minutes on simulations, a 300-person organization spends roughly 300 to 400 hours a year in total, spread across everyone.

• Admin time. Calculate it as hours per month × internal hourly cost × 12. With automated scheduling, most of that time goes to reviewing monthly reports.

Benefits of investing in security awareness training:

• Lower risk. Nimblr customers see an 80% average reduction in clicked simulations within three months.

• Earlier warning. Employees who report suspicious messages give your security team a chance to act before an incident spreads.

• Saved admin time. Compare with the hours your team spends today choosing templates, scheduling campaigns and chasing completion.

• Evidence. Reports that show owners, auditors and the board that the program is working.

To put the cost in context, estimate what one day of disruption would cost your organization: lost revenue or production, overtime, external incident response and the time leaders spend handling it. Most organizations already have email filters, MFA and endpoint protection, but the attacks that get through usually depend on someone acting on a message. According to the Verizon Data Breach Investigations Report, 62% of confirmed data breaches involved the human element. Nimblr's own analysis of around 11 million phishing simulations in 2025 found that the lures that worked best looked like everyday work. Read more in Why does phishing still work in 2026?

You don't need an exact return on investment to make the case. Put the annual cost of training next to your own estimate of what one incident would cost, then agree on how you'll measure progress, such as click rate, reporting rate and Awareness Level. Results from the first months give decision-makers something concrete to review, rather than a promise.

What should a security awareness training budget proposal include?

Most proposals fit on a single page. Copy these six headings into your own proposal and fill them in with your organization's details:

Business challenge: employees regularly receive phishing and social engineering attempts, and current training is infrequent, hard to run or the same for every role.

Proposed solution: a continuous security awareness program with short lessons, realistic simulations, immediate feedback and reporting.

Objectives: fewer risky clicks, more reported threats, less admin work for IT and documentation for requirements such as NIS2.

Investment: the annual cost based on the number of employees, plus any options you need.

Success measures: click rate, reporting rate, Awareness Level, lesson completion and admin time, reviewed every quarter.

Decision requested: approval of the budget and start date, and a date to review the first results.

The success measures matter most once the program is running. Nimblr's Awareness Level gives each employee, team and the organization a score based on behavior: how employees handle simulated attacks, whether they report them and how they engage with training. Administrators receive automated monthly reports, and line managers can receive reports for their own teams. The trend over time is what most organizations share with leadership and auditors.

How does training support NIS2 and other requirements?

NIS2, DORA and ISO 27001 all expect organizations to train employees in cybersecurity, and NIS2 places explicit responsibility on management. A security awareness program helps organizations meet the training part of these requirements and gives them documentation to show it.

It's worth being clear in the proposal that training is one part of compliance. Full compliance also depends on technical and organizational controls, such as access management, incident handling and supplier security. Nimblr supports the human-risk side, with role-based courses for groups such as management and reporting you can share with auditors. For more detail, see how Nimblr supports compliance and our guide to security awareness training for NIS2 and DORA.

Frequently asked questions

When should we start the budget conversation?

Before next year's budget is set. For many organizations, and most of the public sector, that means the autumn.

How much does security awareness training cost per user?

It depends on the number of users and the options you choose. Nimblr uses volume-based tiers, and you can request a quote for your organization.

How do you calculate the total cost?

Add the subscription, internal admin time and employee training time. Admin time is hours per month × hourly cost × 12, and employee time is the number of employees × training hours per year × hourly cost.

Do inactive accounts count as users?

Ask any provider how this is handled, and review your user list before agreeing on a license count.

Can we start with a smaller group?

Yes. Many organizations start with a pilot group or add options such as smishing only for selected teams.

How long is the contract?

Nimblr's standard agreement runs for 12 months.

Does training make us NIS2 compliant?

It helps you meet the training requirements and document them, but full compliance also depends on technical and organizational controls.

Can security awareness training prevent cyberattacks?

It can't guarantee it. It helps employees recognize and report suspicious messages, and it works alongside technical controls and clear processes.

If you're preparing a proposal, book a 30-minute demo. We'll show you the platform, give you a demo account to share with decision-makers and prepare a quote that fits your organization.