Proofpoint Security Awareness Training cost: quote-only, priced per user per year

Proofpoint does not publish a uniform list price for PSAT. It is sold quote-only, per user per year, with the quoted figure depending heavily on three variables. First, the standalone-versus-bundle status: PSAT purchased alongside Proofpoint TAP through the Aegis bundle typically yields per-user pricing meaningfully below standalone purchase. Second, the user-count volume: PSAT, like other enterprise-software platforms, applies discount tiers at typical breakpoints of 1,000, 5,000, and 25,000 users. Third, the feature tier and add-on mix: the base tier covers awareness training and phishing simulation; higher tiers add adaptive content delivery, granular risk-scoring, and behavioural-analytics features.

Because Proofpoint publishes no rate, the only way to establish PSAT's price for your organisation is a direct quote. Buyer-data aggregators report per-user figures, but these are unverified inputs to your own negotiation rather than a benchmark, and actual pricing for a specific organisation varies widely with bundle status, volume, and term. Treat any specific per-user number as provisional until it is in your quote.[Proofpoint does not publish a uniform list price for PSAT (quote-only, confirmed via vendor and third-party marketplaces, checked August 2026)]

The most consequential PSAT pricing decision for most buyers is whether to purchase the platform standalone or as part of the Proofpoint Aegis bundle that combines PSAT with Proofpoint TAP (URL and attachment sandboxing email security), Proofpoint Sigma (information protection), and additional platform components. For existing Proofpoint email-security customers, the Aegis bundle is typically the better commercial choice because the bundle discount on PSAT is meaningful and the contract negotiation overhead is lower when consolidating products with a single vendor.

For organisations not currently on Proofpoint email security, the decision is more nuanced. The Aegis bundle commits the buyer to Proofpoint's broader email-security architecture, which is a multi-year procurement commitment that may not align with the buyer's preferred architecture. The bundle also typically requires a 3 or 5-year term to access the full discount, which raises optionality concerns if the buyer's environment is evolving. Independent buyers should compare standalone PSAT pricing against KnowBe4, Hoxhunt, and Cofense for the awareness-training function, and separately evaluate the email-security function against alternatives including Microsoft Defender for Office 365, Abnormal Security, and IRONSCALES.

The 2024-2025 pricing trend has seen Proofpoint tighten the bundle discount versus standalone (i.e. making the bundle relatively more attractive) as a response to competitive pressure from Microsoft Defender for Office 365 Plan 2, which now ships with comparable email-security capability included in the Microsoft 365 E5 SKU. The defensive bundle pricing has stabilised the standalone PSAT pricing band but has compressed margins on the bundle relative to historical norms.[Proofpoint product literature + competitive analysis 2024-2025 + buyer-side procurement reports]

Proofpoint publishes no per-user rate, so this table is a scaling model, not a price list: it multiplies user count by two illustrative rates to bracket a range. The lower column is closer to a discounted Aegis-bundle deployment; the upper column is closer to a standalone purchase. Locate your quoted per-user rate between the columns (or substitute it directly). Larger deployments typically negotiate below the per-user rate that smaller ones pay.[Illustrative scaling model (user count x illustrative rate); Proofpoint does not publish per-user rates]

PSAT is unusual among phishing-training platforms in carrying a documented academic-research lineage. Wombat Security was founded in 2008 as a Carnegie Mellon University spin-off based on research by Lorrie Cranor's CUPS lab (CyLab Usable Privacy and Security Laboratory) into anti-phishing behavioural training. The original Wombat product set, PhishGuru, was developed and validated through peer-reviewed CHI and SOUPS-conference research that demonstrated measurable behavioural change in user populations exposed to embedded-training experiences. Proofpoint acquired Wombat in 2018 for approximately $225M and integrated the platform as PSAT while retaining the underlying behavioural-science approach.

The practical implication of the lineage is that PSAT places relatively more emphasis on behavioural-change methodology than competing platforms. Embedded-training experiences (where a simulated phishing email leads, on click, to an immediate training intervention rather than a deferred training session) are a Wombat-originated technique that PSAT continues to emphasise. Behavioural risk-scoring at the per-user level draws on the same academic-research foundation. Buyers evaluating PSAT should test whether the embedded-training and risk-scoring features are properly enabled in the trial deployment because the platform's strongest distinguishing capability is in those features rather than in the content-library breadth where KnowBe4 leads.[Wombat Security academic record (PhishGuru, CHI / SOUPS publications) + Proofpoint acquisition announcement 2018]

The ROI calculation for PSAT mirrors the calculation for KnowBe4 (see /training/knowbe4-cost) because the click-rate-reduction expectations are similar across the major awareness-training platforms. Proofpoint's annually-published State of the Phish report tracks click-rate-reduction outcomes across PSAT customers and shows results consistent with the 50 to 70 percent reduction over 24 months that other vendors report. The per-platform variance in outcomes is smaller than the variance attributable to program-management quality on the buyer side.

For a 2,000-employee mid-market organisation, at an illustrative $30 per user per year through the Aegis bundle (substitute your own quoted rate), the annual PSAT cost is $60,000. Against the modelled $4.20M average mid-market breach cost (see /by-scale/mid-market), even a 5 percent reduction in event-probability-weighted cost pays back the program multiple times over. The same caveats that apply to KnowBe4 apply to PSAT: training is effective against bulk-phishing simulation but materially less effective against AI-grade spear phishing or AitM attacks, where the failure mode is not lure-recognition. The honest framing is that PSAT (and any awareness-training platform) is a necessary layer in a phishing-defence program but not a sufficient one.[Proofpoint State of the Phish Report 2024 + IBM 2023 mid-market cohort (last org-size split)]

• KnowBe4 cost
• Cofense PhishMe and Triage cost
• Hoxhunt cost
• SoSafe cost
• Proofpoint TAP cost (Aegis bundle counterpart)
• Abnormal Security cost
• BEC cost
• Spear phishing cost
• Phishing cost for mid-market
• databreachcost.com