Security Awareness Training ROI Calculator

See how much your organization can save by reducing phishing risk through security awareness training.

Organization

Total employees who will receive training.
$
Used to calculate the productivity cost of training time.

Training Program

Select the level of security awareness training you are considering.

PPP (Phish-Prone Percentage) is the percentage of employees who would fall for a simulated phishing attack. Training is the time each employee spends on security awareness training per year.

Risk & Training Variables

Automatically calculated based on your selections above. You can override these values if needed.

hrs
Time each employee spends in training annually.
$
The financial cost of a cyber security incident. Scaled from a $4.8M base by organization size.
%
Baseline 6%, adjusted by phish-prone improvement from training.
$
Annual platform cost, scaled by employee count. Based on a CanIPhish Enterprise subscription.
$
Staff time to administer the SAT program.
$
Any additional costs (consultants, etc.).
-ARO × SLE
Your estimated annual loss from social engineering breaches. This value cannot be overridden.

ROI Summary

Total Program Cost
-
ALE (Before SAT)
-
ALE (After SAT)
-
Annual Risk Reduction
-
Net Benefit
-
Return on Investment
-

Detailed Breakdown

Metric Value
Cost Breakdown
Hourly Cost per Employee-
Productivity Cost (training time)-
SAT Platform Cost-
Admin / Management Cost-
Other Costs-
Total Annual Program Cost-
Risk Analysis: Before SAT
Single Loss Expectancy (SLE)-
Annual Rate of Occurrence (ARO): Baseline-
Annualized Loss Expectancy (ALE)-
Risk Analysis: After SAT
Phish-Prone Percentage (After)-
Annual Rate of Occurrence (ARO): After-
Annualized Loss Expectancy (ALE)-
ROI
Annual Risk Reduction-
Net Benefit-
ROI-

Key Assumptions

    Frequently Asked Questions

    The calculator draws on two primary industry reports to establish its baseline assumptions:

    Average cost per phishing breach: Single Loss Expectancy (SLE)

    According to IBM's Cost of a Data Breach Report 2025, the average cost of a data breach where phishing was the initial attack vector is USD $4.8 million. This figure includes direct costs (incident response, forensics, legal, regulatory fines) and indirect costs (lost business, reputational damage, customer churn).

    For modelling purposes, the $4.8M figure is benchmarked against a mid-market organization of approximately 500 employees. The calculator then scales this logarithmically based on your employee count. Smaller organizations receive a proportionally lower estimate, while larger organizations scale higher, capped at 2× the base.

    Annual likelihood of a phishing-origin breach: Annual Rate of Occurrence (ARO)

    The baseline ARO of 6% is derived from two published statistics:

    1. 43% of UK businesses reported experiencing a cyber security breach or attack within the last 12 months (UK Cyber Security Breaches Survey 2025).
    2. 16% of all data breaches had phishing as the initial attack vector (IBM Cost of a Data Breach Report 2025).

    Combining these: 0.43 × 0.16 = 0.0688 (~6.9%). We conservatively round this down to 6% for modelling purposes.

    Phish-Prone Percentage (PPP)

    Baseline PPP benchmarks are informed by aggregate phishing simulation data collected by CanIPhish across its entire customer base, which shows an average initial click rate of approximately 30–35% across industries before any training. The reduction percentages for each program level reflect commonly observed outcomes from sustained training and phishing simulation programs.

    The calculator uses the Annualized Loss Expectancy (ALE) model, a standard risk quantification framework:

    ALE = ARO × SLE

    SLE (Single Loss Expectancy): the estimated cost of a single phishing-origin breach, scaled by organization size. ARO (Annual Rate of Occurrence): the probability of a phishing breach occurring in a given year.

    The calculator computes ALE twice:

    Before SAT: using the baseline ARO of 6% (no training). After SAT: using a reduced ARO, adjusted proportionally by the Phish-Prone Percentage improvement from training.

    The Annual Risk Reduction is the difference between the two ALE values. The Total Program Cost includes employee productivity loss during training, SAT platform subscription, admin/management time, and any other costs. Finally:

    ROI = (Annual Risk Reduction − Total Program Cost) ÷ Total Program Cost × 100%

    A positive ROI means the modelled risk reduction exceeds the cost of the program. All input values can be overridden in the “Risk & Training Variables” section if your organization has more specific data.

    The Phish-Prone Percentage (PPP) represents the proportion of employees likely to fall for a phishing attack. Industry benchmarks suggest an average of approximately 30% with no training.

    The four program levels model progressively more effective security awareness programs:

    LevelDescriptionPPPTraining TimeAdmin Effort
    No SATNo training or phishing simulations30%0 hrs/yrNone
    MinimalAnnual bulk training + annual phishing simulation25%0.5 hrs/yr1 week/yr
    ModerateQuarterly training + quarterly phishing simulations10%1 hr/yr2 weeks/yr
    Best PracticeMonthly training + risk-based smart phishing (weekly for high-risk, monthly for moderate, quarterly for low-risk users)2%2 hrs/yr3 weeks/yr

    The PPP reduction directly lowers the ARO: a lower PPP means fewer employees fall for phishing, which reduces the likelihood of a successful breach. The formula is: ARO (After) = Baseline ARO × (PPP After ÷ PPP Before).

    Total program cost is the sum of four components:

    1. Productivity Cost: the opportunity cost of employees spending time on training instead of working. Calculated as: Number of Employees × Hourly Rate × Training Hours per Year. The hourly rate is derived from the average annual salary divided by 2,080 standard work hours.
    2. SAT Platform Cost: the annual subscription cost for a security awareness training platform. This is auto-calculated using volume-based per-user-per-month pricing that decreases at higher employee counts, then annualised. If “No SAT” is selected, this is $0.
    3. Admin / Management Cost: the cost of staff time to set up and manage the SAT program (configuring campaigns, reviewing reports, following up on failures). This is modelled as a number of weeks of one person’s time at the average salary: Annual Salary × (Admin Weeks ÷ 52).
    4. Other Costs: any additional costs such as external consultants, custom content development, or compliance audit fees. Defaults to $0.

    All cost values are auto-calculated but can be manually overridden in the “Risk & Training Variables” section to match your actual costs.

    A negative ROI means the modelled cost of the training program exceeds the estimated risk reduction under your chosen assumptions. This is most common in the following scenarios:

    Very small organizations: the SLE scales logarithmically Minimal program selected: a minimal program only reduces PPP High salary / high admin overhead: if your average salary is high,

    To improve ROI, try selecting a more comprehensive program level (which delivers a larger risk reduction), or adjust the cost variables to reflect your actual spending. In many cases, moving from “Minimal” to “Moderate” or “Best Practice” dramatically improves ROI because the risk reduction grows faster than the incremental cost.

    Yes. Every auto-calculated field in the “Risk & Training Variables” section can be manually overridden. The defaults are based on industry benchmarks and are intended as reasonable starting points, but every organization is different.

    We recommend adjusting the following values if you have organization-specific data:

    SLE: if you have incident cost data ARO: if you track phishing incidents Platform Cost: if you already have a vendor quote, Admin Cost: if you know how much staff time Training Hours: if your training program uses a different time commitment

    Selecting a different training program level will reset the auto-calculated fields to their default values for that level.

    This calculator provides a simplified risk model focused on phishing. It does not account for:

    Other attack vectors: SAT also helps reduce risk Compliance benefits: many regulatory frameworks Insurance premium reductions: some cyber insurance providers Culture and reporting improvements: trained employees report Multi-year compounding: this is a single-year model.

    As a result, the actual ROI of a well-run SAT program is likely higher than what this calculator estimates.