Choosing KnowBe4, Hoxhunt or CybSafe for Academy Trust Phishing Training

A UK academy trust weighing KnowBe4, Hoxhunt and CybSafe for staff phishing training meets one clear split straight away. KnowBe4 publishes tiered GBP per-seat prices from £1.26 to £2.89 a month depending on tier and headcount; Hoxhunt and CybSafe have both moved to quote-only pricing, released only after a sales call. The right pick depends less on headline cost than on content depth, engagement model and supplier location, so budget only once every quote is in writing.

Key pointers

• KnowBe4's published GBP pricing runs from £1.85 a seat a month (Foundation, 25 to 50 seats) down to £1.26 (Foundation, 501 to 1,000 seats), rising to £2.89 down to £2.15 for the Advanced tier, before quotes take over above 1,001 seats.
• Hoxhunt's pricing page does not publish a number at all; the only route to a price is a 30-minute scoping call.
• CybSafe's plans page now sends every one of its three products, GUIDE, PHISH and RESPOND, to a "Contact us" button, with no per-seat figure anywhere on the page.
• Ask KnowBe4 directly about its non-profit discount before assuming list price; an academy trust is an exempt charity and may qualify.
• The Academy Trust Handbook requires trusts to take appropriate action on cyber risk and never to pay a ransom demand, and cites the DfE's cyber security standards as the route to meeting that duty.
• DfE's core standard requires an annual cyber awareness plan covering phishing, passwords and incident reporting for staff, at least one governor or trustee, and anyone else with a login.
• A free NCSC training pack for school staff exists as a baseline, and is mandatory annually for anyone the trust must evidence under risk protection arrangement (RPA) cover.
• Only CybSafe is a UK-registered company; get each supplier's exact seat count, contract term and VAT treatment in writing before comparing headline numbers.

What an Academy Trust Actually Needs to Decide

Staff phishing training for an academy trust is not just a compliance box. Trusts hold pupil safeguarding records, staff payroll data and, in multi-academy trusts, finance systems shared across several sites, all of which make school and trust email accounts a realistic target for fraud and ransomware. The decision an IT lead is really making is which of three different products to buy, not which is cheapest on paper.

KnowBe4 sells a content library. Its two published tiers, SAT Foundation and SAT Advanced, differ mainly in the depth of training material and add-on phishing test formats, and every seat count band has a fixed, quotable price up to 1,000 seats. That suits a trust that wants a number for a governors' finance committee before it commits.

Hoxhunt sells an adaptive engagement model, where phishing simulations and micro-training scale in difficulty to how an individual member of staff responds, rather than delivering the same rotation of content to everyone. It does not publish a price, so a trust cannot budget from the website alone.

CybSafe sells a behavioural-science approach built on SebDB, its own taxonomy of security behaviours, aimed at organisations that want deeper reporting on why staff behaviour changes rather than just completion rates. Its current site has also moved fully to quote-only pricing across all three of its named products.

For a school workforce, the practical difference that matters most is often not the platform's engagement mechanic but the admin burden. A single-academy trust with one part-time IT lead needs a platform that is simple to set up against a small staff list and needs little ongoing tuning. A larger multi-academy trust running training across dozens of sites needs SSO integration, smart groups by school, and reporting that a central data protection officer can actually use at board level. Confirm SSO/SAML and Active Directory or SCIM provisioning support with each vendor before assuming any of the three will simply plug into your existing Microsoft 365 or Google Workspace for Education tenant.

UK Compliance Mapping

Two DfE documents set the actual requirement, rather than a general "best practice" claim. The Academy Trust Handbook (the 2026 edition takes effect from 1 October 2026, and the same duty already sat in the current 2025 edition) states at section 6.14 that trusts must be aware of the risk of cybercrime and put in place proportionate controls, and take appropriate action to meet DfE's cyber security standards. Section 6.15 states that trusts must not pay any ransom or extortion demand, including cyber ransomware.

The DfE's cyber security core standard for schools and colleges sets out what that action should include. Trusts must create and implement a cyber awareness plan for students and staff, covering phishing, password security, social engineering, device security, removable media, multi-factor authentication, and how to report an incident or a personal data breach. Training should happen at least annually, and more often for staff handling higher-risk data. It must reach not only staff but at least one current governor or trustee and anyone else with a login, including supply teachers and agency workers.

None of this requires a specific paid platform. If your trust holds risk protection arrangement (RPA) cover, staff covered by that arrangement must evidence completion of NCSC's own free training annually regardless of what paid platform you also run, so keep that box ticked even after signing with KnowBe4, Hoxhunt or CybSafe. This is not legal advice; consult your legal counsel.

How the Three Platforms Actually Work Day to Day

All three follow the same basic loop: simulated phishing emails go to staff, clicks and reports are logged, and training content is assigned automatically to whoever needs it, with a dashboard for the IT lead or data protection officer to review results. Where they differ is what drives the assignment and what the trust has to configure.

KnowBe4's model is closer to a content platform administered centrally: an admin builds campaigns from a large template library, chooses training modules, and reviews Risk Score reporting by department. Hoxhunt's model pushes more of that decision to its own engine, which adjusts simulation difficulty per user based on past behaviour, so less manual campaign-building is needed but there is less direct control over what an individual member of staff sees next. CybSafe's model sits between the two, combining behavioural nudges and personalised interventions drawn from SebDB with the trust's own reporting needs.

For a trust with limited IT capacity, the practical question is who does the ongoing work: an admin manually scheduling campaigns and chasing non-completers, or a platform doing more of that automatically. Ask each vendor during a demo to show, specifically, what a single IT lead covering several schools would need to do each term to keep the programme running, not just what the dashboard looks like on day one.

Pricing and Cost Model

Pricing date and basis: figures below were confirmed directly against each vendor's own website on 29 September 2026. KnowBe4's GBP figures are its own published "MSRP" monthly price per seat under a three-year term commitment, and exclude VAT and other government fees; ask KnowBe4 for the equivalent one-year and annual-billing prices, since a shorter or annual term will price differently to this three-year MSRP figure. Hoxhunt and CybSafe publish no price at all, so any budget line for either is an assumption until a quote arrives.

For a worked example, a single-academy trust with 60 teaching and support staff sitting in KnowBe4's 51 to 100 band would pay roughly £1.64 a seat a month for Foundation, before VAT: 60 seats times £1.64 times 12 months equals £1,180.80 a year, or £1,886.40 a year on Advanced at £2.62 a seat (60 times £2.62 times 12). That is a published starting point only; ask about non-profit discounts, since KnowBe4's own pricing page invites a request for "non-profit and competitive upgrade discounts", and an academy trust's exempt-charity status is worth raising in that call.

For Hoxhunt, Vendr, a SaaS-procurement platform that publishes pricing intelligence drawn from anonymised buyer transactions rather than vendor list price, reports typical costs of $15 to $30 per user a year for 100 to 500 users, falling to $10 to $20 per user a year for 500 to 2,000 users, with multi-year contracts commonly discounted 15 to 30% against a one-year term. Those figures are US-dollar market data, not a UK quote, and this is one procurement platform's transaction sample rather than Hoxhunt's own price list, so treat it as a starting range for a negotiation rather than a number to put in a budget paper.

CybSafe currently gives no third-party or vendor-published figure to anchor a similar estimate against; request a quote directly and ask specifically which of its three products, GUIDE, PHISH or RESPOND, the quote actually covers, since they are sold and priced separately.

Vendor and Option Comparison

No platform here suits every trust equally, and none should be chosen on price alone. A trust with a governors' committee that wants a defensible, published starting number before approving spend has good reason to shortlist KnowBe4 first and negotiate from there. A trust that already has a confident IT lead able to run a proper procurement conversation, and that values adaptive engagement over library size, has good reason to get Hoxhunt and CybSafe quotes alongside it rather than defaulting to the vendor with a public price card.

Editorial Analysis

The starkest fact in this comparison is not which platform is "best" but that two of the three suppliers a school buyer is likely to be pointed towards no longer publish a price at all. That is a genuine change in how this market sells to smaller buyers: a single-academy trust comparing three names now gets one real number and two invitations to a sales call. It is reasonable to read that as these vendors increasingly pricing by negotiated deal size rather than list price, which rewards a trust that is prepared to ask two suppliers for a quote and use the third's public figure as a reference point, rather than a trust that takes the first number it is offered.

It is also worth weighing whether a paid platform is the right first step at all for a very small single-academy trust. NCSC's own free training pack meets the substance of the DfE's awareness-plan requirement, and is a reasonable starting point for a trust with a handful of sites and a tight budget, with a paid platform picked up later once the trust needs ongoing simulation, individual-level reporting, or evidence for a growing MAT's audit committee.

Sources

• KnowBe4, Security Awareness Training Pricing
• Hoxhunt, Request Hoxhunt pricing
• Hoxhunt, Company
• CybSafe, Plans
• CybSafe, On demand webinar: How to use SebDB to drive a more behavior-focused security program
• Vendr, Hoxhunt Software Pricing & Plans 2026
• Department for Education (GOV.UK), Meeting digital and technology standards in schools and colleges: Cyber security core standard
• Department for Education (GOV.UK), Academy trust handbook 2026: effective from 1 October 2026
• National Cyber Security Centre, Cyber security training for school staff
• Companies House, CYBSAFE LTD company overview