Switching security awareness training providers: when to start and how to roll it out

If you're thinking about switching security awareness training providers, start four to six months before your current contract renews. The first thing to check is your notice period, often three months, because missing it usually means another full year with your current provider. That leaves time to compare options, run a trial and plan the rollout before the old contract ends.

The technical switch itself is usually smaller than people expect. Modern platforms sync users from Microsoft Entra ID or Google Directory, and with Nimblr the guided configuration with an onboarding specialist rarely takes more than half an hour.

Internal approvals, security reviews and rollout planning usually take longer, and they vary by organization. This guide covers the timeline, what to compare, what switching to Nimblr involves and how to roll it out.

When should you start looking for a new security awareness training provider?

Security and IT teams often realize too late that a renewal is coming. In our conversations with organizations across the Nordics, one of the most common reasons a switch is postponed is a missed notice deadline. The alert about it sat in an inbox, the deadline passed, and the contract rolled over for another year.

A simple timeline helps avoid that:

1.    Six months before renewal: find the contract and confirm the notice period, the renewal date and who needs to sign off. Check what data you can export from your current provider.
2.    Five months before: decide what isn't working today and book demos with a short list of providers.
3.    Four months before: run a trial or proof of concept with a small group. Agree first on what success looks like: can employees access training easily, is the content relevant, how much admin does it take and can managers read the reports?
4.    Three months before, or by your notice deadline: make the decision, complete procurement and give notice if you're switching.
5.    One to two months before: set up the new platform, connect user sync and plan the communication to employees.
6.    At renewal: launch the new program, ideally with no gap in training.
This is an example. Procurement rules, notice periods and the size of your organization may call for more time. If your budget follows the calendar year  add the budget process to this timeline. Decisions for next year are often made in the autumn.

What to ask your current provider before you switch:

•    When does our contract renew, and what is the cancellation deadline?
•    Can we export training history and reports, and in which format?
•    What happens to company data after the contract ends?
•    Which technical settings or integrations do we need to remove, such as whitelisting rules or an email add-in?
•    Can we run both platforms side by side for a short transition period?

Why do organizations switch security awareness training providers?

Most organizations don't switch because their current tool is broken. They switch because the program has stopped changing how employees act.

The reasons we hear most often are these:
•    Low uptake. Some training depends on employees logging in and choosing to take part, and many don't.
•    High admin load. Someone has to pick templates, schedule campaigns and chase completion, and that job slips when other priorities come up.
•    The same content for everyone. A finance employee who approves payments gets the same training as someone with no access to money or systems.
•    No clear way to show results. Completion rates show that training happened, not whether behavior changed.
•    Pressure from regulation. NIS2 and owner or supplier requirements push organizations to show a working program rather than a checkbox.

If one or two of these sound familiar, it's worth looking at how other approaches handle them before your next renewal.

What should you compare when choosing a new security awareness training provider?

Feature lists tend to look alike. These questions make the differences clearer during demos and trials:

For a broader comparison of approaches, from traditional training platforms to enterprise suites and course libraries, see how Nimblr compares to other security awareness solutions.

Format deserves an honest conversation. Some organizations are used to video and want to keep it. Nimblr uses short, interactive text-based lessons, which work without sound, on any device and in more than 30 languages, and which are easier to keep current as threats change. Neither choice is wrong, and it's worth asking a group of employees before you decide.

What does switching to Nimblr involve?

The technical configuration can be quick, while approvals and planning take the time they need in your organization. When you switch to Nimblr, the steps usually look like this:

1. Configure your organization with an onboarding specialist: your logo, language, key senders such as the CEO or HR contact, and the systems you use, so simulations look like your real environment. This guided configuration rarely takes more than half an hour. Read more about organization setup.
2. Connect user sync through Microsoft Entra ID, Google Directory or SFTP, so onboarding and offboarding employees are handled automatically.
3. Whitelist simulations so they reach inboxes without weakening your email security. A step-by-step guide covers this in Microsoft 365.
4. Connect the Microsoft report button, so employees can report suspicious emails, including simulations, from Outlook.
5. Send a launch message to employees, using the template Nimblr provides.
6. Start the program. Every employee receives an introduction course, the first simulation follows a few days later, and from then on lessons, simulations, reminders and reports run automatically.

Before you switch, check what you can export from your current provider, such as completion records and simulation results, in case you need them for audits. Results from different platforms rarely compare directly, since difficulty and scoring differ, so treat the first months with Nimblr as a new baseline.

How do you roll out a new security awareness training program to employees?

A new program changes what lands in employees' inboxes, so a little communication goes a long way.

Send a short message a few days before launch. Explain that the organization is starting a new security awareness program, that it includes short lessons and simulated attacks, and that clicking a simulation is a chance to learn, not something anyone will be blamed for. Nimblr provides a template.

The first thing employees receive is an introduction course that explains how the program works and why it matters. If you want to test the experience first, start with a pilot group, such as IT and a few managers, before rolling it out to everyone.

Involving managers helps too. When line managers receive reports for their own teams, completion becomes something the whole organization owns, rather than a task for IT alone.

Who is Nimblr best suited for?

Many security awareness programs still depend on an administrator to choose courses, plan simulation campaigns, send reminders and build reports. Nimblr is designed to automate that ongoing work: lessons, simulations, reminders and reporting run continuously and adapt to each employee's behavior. In practice, that means less manual administration, learning that continues all year and training that responds to how people actually act.

Nimblr is built for mid-sized and large organizations that want security awareness to run reliably without becoming someone's part-time job. It fits well if you want training and simulations scheduled automatically, Micro Training lessons under five minutes, Role-Based Learning for high-risk roles and an Awareness Level that shows how behavior changes over time. Nimblr customers see an 80% average reduction in clicked simulations within three months.

It may not be the best fit if your team prefers to plan and run every campaign by hand, if you're consolidating risk analytics across a complex security stack and need a broader suite, or if your organization has decided that video-based training is the only format that will work for your employees.

Frequently asked questions

How long before renewal should we start looking?

Four to six months. Check your notice period first, since it's often three months.

Can we try a new platform before giving notice?

Yes. Most providers, including Nimblr, offer a demo account or a trial with a small group.

Will our employees notice the switch?

They'll see new lessons and simulations. A short message before launch and an introduction course explain what's changing.

Do we lose our historical data?

Results from the old provider won't move into the new platform. Export what you need for audits before the old contract ends, and treat the first months as a new baseline.

How do you migrate from one phishing simulation platform to another?

Export the history you need from the old platform, configure the new one, sync users, update allowlisting and the report button, and launch with a short message to employees. With Nimblr, an onboarding specialist guides the configuration.

How much work is the setup?

The guided configuration with Nimblr's onboarding specialist rarely takes more than half an hour. User sync, whitelisting and your internal approvals come on top of that.

Will employees need new accounts or passwords?

No. Users sync from your directory, and lessons open straight from email without a login.

Can we run two security awareness platforms at the same time?

Yes, for a short transition, but you may pay for both during that period. Agree on a start date that fits your notice period, and make sure employees know which program is current.

Book a 30-minute demo, and we'll walk through how a switch to Nimblr would work for your organization and timeline.