Search for AI security training for employees and you get two different products on one results page, both labeled risk-awareness training, by vendors who never mention the other half exists. One teaches staff to survive attacks that use AI against them — deepfaked executives, phishing with no grammatical tell. The other teaches staff to use AI themselves without pasting a client contract into a consumer chatbot. Most buyers at a 50–500-person company sign for the first and later find they needed the second more urgently.
This is a procurement guide: what the curriculum has to contain, the four categories of provider, what a per-seat quote should look like, and a test for whether anything changed.
The two products trading under one name
Two vendor pages side by side make it obvious. SANS sells Workforce Risk Management Fundamentals for AI: eight modules, three foundational and five role-specific, organized around threats. SecureLabs sells an AI Security & Awareness Training course at $49 per learner whose core modules — “Using AI safely: acceptable use at work”, “When AI gets it wrong” — are about the learner’s own behavior. Both are honest products solving different problems.
Attack-resistance training treats AI as a weapon pointed at your staff: synthetic voice on a payment call, a video meeting with a colleague who is not there, phishing written well enough to defeat the cues a decade of training installed. It teaches recognition and reporting, and the format is simulation — send the fake, measure who clicks, escalate difficulty.
Safe-use training treats AI as a tool your staff already hold. It teaches the judgment your AI use policy assumes: which account is sanctioned, which data never leaves the building, how to verify an output before it carries your name. The format is practice on real work, because the decision happens with a real document open.
Attack resistance is the older, better-funded market. Safe use is where exposure grows fastest. Netskope’s Cloud and Threat Report 2026 puts the average organization at 223 generative-AI-linked data policy violations per month, rising to around 2,100 in the top quartile of organizations, with uploads of regulated personal, financial or health data the largest single category at 54%. None of that is an attacker. That is staff, working, using the tool you gave them.
The attack side is real too: Gartner’s survey of 302 cybersecurity leaders, run March–May 2025, found 62% had experienced a deepfake attack involving social engineering or exploited automated processes. So the question is which half you are buying, and most pages in this market are built to stop you asking.
Which half your risk profile calls for
Three questions settle it faster than a vendor demo.
Does money move on a verbal instruction? If someone in finance can initiate or redirect a payment on the strength of a call or a video meeting, you have an urgent attack-resistance problem. The fix is mostly process: out-of-band callback on any payment or banking change, and explicit permission to refuse an executive request until the callback happens. Teaching staff to spot a deepfake is a losing arms race; teaching them to dial a known number is not.
Has your team held AI licenses for more than three months? Then you have a safe-use problem whether or not you have seen evidence. ISACA’s 2026 AI Pulse Poll of more than 3,400 digital trust professionals found nine in ten believe employees use AI at their organization while only about a third say everyone is trained on it. The gap is the exposure.
Do client contracts or your insurer now ask about AI controls? Then you need a training record, and its format matters: who was trained, on what, when.
Most companies answer yes to at least two, but sequencing is rarely a coin flip. If staff already hold licenses, the safe-use half is producing violations this month, while the worst of the attack-side exposure closes with a free approval change.
What the curriculum has to contain
The content list is settled across the market. A provider missing one of these is behind, not differentiated.
- A named list of sanctioned tools and accounts. Not “approved enterprise AI tools” — the actual names and accounts, because the difference between a company account and a personal login on the same product is the whole control.
- A data rule people can apply under pressure. Abstract classification schemes fail at the moment of decision; a short list of what never gets pasted anywhere, tied to examples from your own business, does not.
- A fast path to approve a new tool. Prohibition without a route goes underground in about two weeks.
- Prompt injection, taught to everyone. Any assistant that reads email, documents, or tickets can carry instructions written by someone else, and staff need to know that an assistant proposing an unexpected action may be following a stranger’s prompt.
- Out-of-band verification for money and credentials. A callback on a known number before any payment or banking change, treated as procedure rather than perception.
- Output verification tied to named decisions. Not “always check” but a list of the specific outputs that may not leave a desk unverified.
- Reporting without blame. Whoever pasted the wrong thing into the wrong tool has to be able to say so within the hour, and a program that makes that conversation career-limiting is buying silence.
Technical staff need two or three more — adversarial testing, pipeline security, agent permissioning — in a separate track mapped against the NIST AI Risk Management Framework, which Stanford HAI’s 2026 AI Index finds 33% of organizations now reference against 36% for ISO/IEC 42001. Do not buy that track for everyone.
The four categories of provider
| Category | Named examples | Strongest at | Weakest at |
|---|---|---|---|
| Human risk management platforms | KnowBe4, Hoxhunt, Living Security, Adaptive Security, SoSafe, Proofpoint | Attack resistance at scale, audit-ready records, year-round cadence | The safe-use half; assumes IAM, HRIS and SIEM integration budget |
| Security vendor AI modules | SANS, Fortinet, SentinelOne, Bureau Veritas | Auditor and insurer credibility, technical depth, role structure | No published pricing; transfer to daily work |
| Self-paced AI awareness courses | SecureLabs, Coursera, Udemy Business, LinkedIn Learning, Skillsoft, Pluralsight | Cost, coverage, a defensible completion record | Behavior — nothing touches the learner’s own documents |
| Facilitated safe-use sessions | Specialist firms, including ours | Judgment on real documents; the questions get asked out loud | Cost per head at scale; manual attendance records |
Living Security’s own platform comparison maps that first segment fairly, with the caveat that the vendor publishing it also wins it. The security vendors are candid about their own ceiling: Fortinet’s 2025 Security Awareness Report, surveying 1,850 senior IT and security leaders, found 67% of organizations report moderate or significant reductions in intrusions, incidents and breaches after awareness training, and yet only about 40% say their employees are truly prepared to identify, avoid and report AI-based cyberthreats. Training works and is not sufficient.
For most companies in the 50–500 band the sensible architecture is a cheap platform or course baseline for the record and the annual cadence, plus facilitated sessions for the people who handle sensitive material daily. Treating it as one purchase produces the familiar outcome: 100% completion, unchanged behavior. That gap between a record and a capability is the point of our AI enablement manifesto; the in-house-versus-vendor trade-off sits in our buy-versus-build guide.
What a quote should look like
Almost nobody publishes a price. Here is what is verifiable now.
| Option | Published price | Terms |
|---|---|---|
| KnowBe4 SAT Foundation | From $2.40 per seat per month | 3-year term, 25-seat minimum, per KnowBe4’s pricing page |
| KnowBe4 SAT Advanced | From $3.75 per seat per month | Same terms; larger seat bands reduce the rate |
| SANS, Fortinet, SoSafe, Hoxhunt, Living Security | Not published | Quote-only, per user per year, degressive with headcount |
| Self-paced AI awareness course | About $49 per learner | SecureLabs published rate; volume pricing on request |
| Facilitated AI enablement workshop | $2,000–15,000 per engagement | Market range, varies with session count and group size |
Three things before the call. These are three-year term rates, so ask for the one-year number. Seat minimums bite below 250 people: a 25-seat floor is harmless, but the 250-seat floors common in this segment rule a platform out for a 120-person company at any rate. And the AI content is usually an add-on, so ask which modules are AI-specific and when they were last revised — anything written before late 2023 teaches phishing cues that no longer hold. These catalogs reprice quarterly, so verify on the vendor’s own page.
Three tiers, not nine curricula
| Tier | Who | What they get |
|---|---|---|
| Baseline | Everyone | One 60–90 minute session: sanctioned tools and accounts, the data rule, prompt injection, output verification and how to report. A course baseline plus one live session, so the questions get asked aloud. |
| High exposure | Finance, HR, legal, client delivery, anyone touching regulated data, source code, or unreleased financials | The same material run against their own documents, plus the verification procedure for their decisions. |
| Specialist | Engineering and whoever owns the policy | Adversarial testing, agent permissions, logging, framework mapping — what most vendors sell as AI governance training. Small group, longer track, usually a different vendor. |
Going finer is where enablement programs stall; how many curricula a company needs sits in our role-based enablement guide.
What the compliance frameworks ask for
| Driver | What it actually asks for |
|---|---|
| EU AI Act Article 4 | Applicable since 2 February 2025: providers and deployers must ensure sufficient AI literacy among staff and contractors operating their AI systems. The test is market and effect, not headquarters location — Latham & Watkins’ briefing reads the scope well. Operationally: a record, refreshed as the systems change. |
| SOC 2 and ISO 27001 | Evidence of awareness training covering the tools in use; an AI module inside an existing program is the cleanest route. |
| ISO/IEC 42001, NIST AI RMF | Now in procurement questionnaires more often than in regulation. Customers want evidence that AI use is governed and staff trained. |
| Client contracts and insurance | The fastest-moving, least standardized driver. Read the clause before buying against it. |
None of these requires a specific vendor, a module count, or a simulation platform. They require that training happened, that it covered what your staff actually touch, and that you can prove it. What the policy itself should say, and where it stops governing behavior, is covered in our safe AI use playbook.
The behavior test you can run without a SIEM
Completion rate is a vanity metric and a quiz score measures recall of a module. Neither tells you whether anyone stopped pasting the client file into a personal account. This test needs no tooling.
Collect three things before training, and the same three at 30 days. The count of distinct AI tools and accounts in use, from an expense-report search plus a direct, amnesty-framed question to each team. Two or three real artifacts per team produced with AI help, whatever is actually in the shared drive. And one sentence from each team lead describing the rule they believe applies to client data. Afterwards the tool count should have consolidated toward sanctioned accounts rather than grown, the artifacts should show verification traces — a checked figure, a named source, a reviewer’s edit — and the three sentences should agree with each other and with the policy.
Then run one live probe. Ask someone in a high-exposure role, in normal conversation, what they would do with a specific borderline document. If they describe the approval path, the training worked. If they name the rule but not the path, your fast-approval component is missing. If they pause, you bought a completion record.
Track the reporting rate too — questions raised and mistakes flagged in the month after training. A rise is the healthiest signal available, and the one that looks like bad news on a dashboard. Measurement that survives a board conversation is the subject of our measurement playbook.
Where to start
Fix the payment-approval callback this week, inventory the tools and accounts people actually use, then shortlist by category rather than brand.
Stanford HAI’s 2026 index names the top barrier to responsible AI implementation as gaps in knowledge (59%), ahead of budget (48%). The barrier is not money. It is that nobody has been taught enough to make the decisions the policy assumes they can.
If you want a second opinion on which half you need before spending anything, book a free AI-readiness call. We run hands-on LLM fluency sessions against a team’s own documents and daily work, and we will say plainly when a $49 course and a changed approval process would serve you better.
Frequently asked questions
What should AI security training for employees cover?
Seven things: a named list of sanctioned tools and accounts, a data rule concrete enough to apply under pressure, a fast path to approve a new tool, prompt injection taught to everyone, out-of-band verification for payment and credential changes, output verification tied to specific decisions, and blame-free reporting. Technical staff need an extra track on adversarial testing and agent permissions.
How much should it cost per employee?
Published platform rates start around $2.40 per seat per month for KnowBe4’s SAT Foundation tier and $3.75 for SAT Advanced, both on three-year terms with a 25-seat minimum. Self-paced courses run roughly $29–99 per learner, and facilitated workshops sit in a $2,000–15,000 market range per engagement.
Is a phishing-simulation platform enough?
Not if your staff hold AI licenses. A simulation platform trains attack resistance, a real and separate need, but it does not teach anyone how to handle their own client file in a chat window — where most measured policy violations originate.
How often should this training be refreshed?
Annually for the baseline, plus a short update whenever the sanctioned tool list changes. Ask vendors for the module revision date rather than the copyright year.
Who should own this when there is no security team?
Whoever owns the policy — usually an operations leader, a chief of staff, or HR — with IT supplying the tool inventory and account configuration. Leaving it with IT alone is the common failure: these are judgment calls about client data and liability, not configuration tasks.
Does the EU AI Act’s literacy duty apply to a US company?
It can. Article 4 has applied since 2 February 2025 to providers and deployers of AI systems, and the test is market and effect rather than headquarters location: if you deploy an AI system in the EU or affecting people there, the duty reaches you and your contractors. Take the question to counsel; operationally it asks for a training record.
Will this satisfy a SOC 2 or ISO 27001 auditor?
An AI module inside a documented awareness program, with attendance records and an assessment, generally satisfies the awareness-training control. A facilitated workshop does too, provided you keep deliberate attendance records — platforms generate those automatically and live sessions do not.
Can we ban the AI tools instead?
You can, and you will lose visibility rather than usage: it moves to personal devices and personal accounts, where you have no logging, no data-handling terms, and no way to know what left. Sanctioning a small set of tools with real controls is the defensible position.
How do we know whether the training changed anything?
Measure three things before and 30 days after: the number of distinct AI tools and accounts in use, the verification traces visible in real work, and whether team leads describe the same data rule.
Key takeaways
- The phrase covers two products. Attack-resistance training defends staff against AI-powered social engineering; safe-use training governs how staff use AI themselves. Buy them deliberately, usually separately.
- If your team has held licenses for more than three months, the safe-use half is where the measured exposure sits: an average of 223 violations per month, almost none attacker-driven.
- Fix the payment-approval callback before buying anything. It is free and closes the largest financial exposure on the attack side.
- Expect $2.40–3.75 per seat per month on a three-year platform term, about $49 per learner for a self-paced course, and $2,000–15,000 per facilitated engagement.
- Completion rates prove nothing. Baseline the tool inventory, the verification traces in real work, and the rule your team leads believe applies, then re-measure at 30 days.
Dirk Jan van Veen, PhD
