Security awareness plans

Every plan includes the full awareness platform. We compare what each tier adds —managed service layer, custom simulations, custom design— not a number. Price is always quoted in a conversation with sales.

Book a demo

Service plans

What each plan includes

Smart

For teams launching their program who need to organize campaigns, training, and first reports.

See details

Growth

For organizations already working on awareness that want to add analytics, automation, and more realistic multichannel simulations for enterprises.

See details

Enterprise

For companies with regional operations, compliance requirements, and ongoing strategic support.

See details

	Smart	Growth	Enterprise
Platform
Assigned account analyst
Annual program design
Course and campaign management
Monthly follow-up meeting
Custom simulations	—	Up to 6	Up to 8
Branded design package (12 pieces)	—	—
Advanced Attack + retest	—	—
Cybersecurity talk	—	—

Book a demo

Plans

Product, managed layer, and professional — three things in one table

Smart, Growth, and Enterprise compare capabilities and support, not a figure. Price is quoted. This page already has three commercial questions; here is the criterion and three more.

The product is the platform: simulations, training, analytics, agent, integrations. That is the floor. On top, each level adds a service layer — analyst, program, follow-up — and a different quota of professional work or design. The table exists so you see that difference. It does not exist so you choose by price, because the price is not there. Anyone who compares “the middle plan” without reading the smishing row or the branded-assets row has the wrong conversation.

The managed layer does not turn Whalemate into the CISO. It operates the program with you. Professional services are not an Enterprise all-you-can-eat: they have a quota or they are quoted. Custom content appears when the table or the proposal says so. Three mental contracts. One commercial conversation. If the RFP asks for “platform + operations + unlimited deepfake,” it is taken apart into those three lines. If it is not taken apart, the scope will hurt at day ninety.

There is no published implementation fee as an extra because go-live is not sold as a separate project in the plans copy. Term conditions are closed in the proposal. This page does not replace that proposal. It gets you to the table knowing what you are asking: active people, whether you need operations, whether you need a scenario the module does not run alone. The rest is a quote. There is no calculator. There is no “from.”

Service tier

How the plan is operated, beyond the table

The comparison says what is in. These pages say who it's for, what a year looks like and what stays out.

Managed service

An assigned analyst builds the annual plan, runs campaigns, and reports back. Security does not add an internal operator.

See details

Implementation

From kickoff to the first campaign: directory, whitelist, contact, and annual plan. The calendar is confirmed at kickoff.

See details

Professional services

Mature programs, advanced demands

For organizations with active programs that need more complex scenarios, personalization, or impact.

Advanced attacks

Smishing, vishing, USB Drop, 2FA attacks, and deepfakes with findings report and recommendations.

Training and crisis

Tabletop exercises for ransomware, data breaches, and executive account compromise to expose gaps before they escalate.

Content and data

Graphics, newsletters, and videos aligned with each organization's identity and internal channels.

View available services

Questions

Before you buy

Why are there no published prices?

Price is always quoted in a conversation with sales. It depends on active users, program scope, and whether there is a managed service layer or custom scenarios.

Is there an implementation fee or a minimum term?

Go-live is not an extra. Commercial terms close in the proposal; we don't publish a figure that won't apply to your roster.

Do smishing, vishing or deepfake come in any plan?

Not as a native channel. Those exercises are sold as professional services — especially on Enterprise — so we don't promise a channel the platform doesn't run on its own.

Can I buy only the platform without the managed layer?

The commercial design is discussed in the quote. The published levels assume support to different degrees. If your team wants to operate alone, say so: fit is evaluated. Do not build an order for “loose licenses” from this FAQ as if it were a marketplace SKU. The demo confirms which level makes sense.

Can we change level later?

Yes, when scope asks for it: more roster, more operations, more scenarios. The change is agreed commercially, not with a toggle. Stepping down is also discussed: sometimes the professional quota does not roll back mid-exercise. There is no public “free upgrade” policy on this page.

What stays out of every plan?

A published price — there is none — the badge of compliance with your rule, disciplinary use of the score, and channels sold as professional when they are not native. An invented case study also stays out, as does a regional report that is not on the grid. The Trust Center and the DPA are not an add-on: they are the vendor floor.

Talk to a specialist

One conversation. Scope, service level and quote come out of it.

Book a demo