🎯 The business: you teach the staff of small offices to spot phishing emails, fake invoices and voice-clone calls, then keep them sharp with short monthly lessons and harmless practice phishing emails. You run the training platform for the client, give live sessions people remember, and hand the owner a yearly report that insurers and auditors ask for. Platforms sell this software directly and cheaply, so your value is the live teaching, the follow-up and the report.
At a glance
| Money to start | ≈ $300 to $1,640 |
| Time to the first paid client | 3 to 8 weeks |
| Hours a week | 5 to 12 part time |
| Skills that matter most | Teaching adults without talking down to them, current scam knowledge, basic email security |
| What it can pay | About $1,850 a month before tax with ten offices on a program and two live workshops (worked below) |
Is this for you?
It suits a confident speaker who likes security and can make a room laugh about a fake gift-card request without making anyone feel stupid. Teachers, trainers, help desk staff and security students do well. You need to keep up with new scams every month.
It is a weak fit if you only want to resell software. A training platform alone is a commodity: vendors sell to small offices online, and some email systems include phishing tests. You also need a thick skin; some staff resent being "tested".
Who pays, and what
Small offices that hold money or sensitive data: accounting and law firms, clinics, insurance and real estate agencies, title companies, nonprofits. Often the trigger is a cyber insurance application or renewal that asks whether staff are trained, a near-miss with a fake invoice, or a rule that requires training.
Some rules do require it. The HIPAA Security Rule requires a security awareness and training program for all workforce members, management included. The FTC Safeguards Rule, which covers tax preparers and many other financial businesses, requires security awareness training for staff. CISA’s small business guidance lists staff training among its core steps.
The threat is large and changing. In the FBI’s 2025 Internet Crime Report, phishing and spoofing was the most reported crime type, with 191,561 complaints. Business email compromise brought 24,768 complaints and $3.05 billion in losses. For the first time the FBI counted AI-related complaints: 22,364, with $893 million in losses, including fake executive emails and cloned voices asking for payments.
What they pay: training platforms list roughly $1 to $4 a user a month (vendor figures), and MSPs commonly charge clients about $2 to $5 a user a month for a managed program. Live sessions are priced separately; there is no good public survey of workshop fees, so the prices below are examples.
What is free or built in, and how to stay above it. Microsoft’s Attack simulation training is included with Microsoft 365 E5 or Defender for Office 365 Plan 2, and free videos exist from CISA and the FTC. An owner can click "start" on a platform without you. What they cannot buy that way is a person who tailors lures to their office, runs a live session staff remember, drills the payment-approval process against a voice-clone call, follows up with the people who clicked, and writes the yearly evidence report. Sell that, and treat the platform as a tool inside your service.
What it takes to start
| Sole proprietorship or LLC and local license | $0 to $500 |
| Training platform demo or partner account (many offer free MSP trials) | $0 to $300 |
| Projector adapter, clicker, printed handouts | $50 to $150 |
| Errors and omissions insurance (an estimate; get quotes) | $200 to $500 first payment |
| Domain, simple website, business email | $50 to $190 |
| All-in | ≈ $300 to $1,640 |
Start to finish: the steps
1. Learn the material properly. Study real cases: FBI and FTC alerts, CISA’s guidance, and your platform’s own threat notes. A CompTIA Security+ level of knowledge is plenty. You must answer "how would I know?" for any scam you show.
2. Pick a platform and a partner path. Most training platforms have MSP or reseller programs with per-user wholesale prices and multi-client consoles. Pick one with short videos, good reporting and a simple "report phishing" button for Outlook and Gmail. If a client already has Microsoft 365 E5 or Defender for Office 365 Plan 2, use Microsoft’s built-in tool instead.
3. Build one great live session. Forty-five minutes: three real fake emails, one fake invoice change request, one voice-clone call recording made with a colleague’s permission, and the office’s own rule for approving payments. End with how to report something suspicious. Practice it on friends.
4. Get permission in writing. Before any practice phishing email, get the owner’s signed authorization, tell their IT person or provider, and allow the sending addresses so tests are not blocked or mistaken for a real attack.
5. Run a baseline test. Send one realistic but harmless phishing email to everyone. Report the click rate only to the owner, by group, not by name in public. That number makes the case for the program.
6. Run the year. Follow the plan below. Keep tests fair: no fake layoffs, bonuses or medical news, which damage trust and teach nothing.
7. Write the yearly report. Dates of training, completion rates, test results over time, and the payment-approval rule the office adopted. Insurers, auditors and HIPAA reviews ask for this kind of record. Do not certify that the office is "compliant"; report what was done.
8. Add a second offer. Owners who like the program often want a short written security policy, an incident checklist, or help from an IT provider to fix what the tests revealed. Partner with an IT provider rather than doing IT work you are not set up for.
Pricing
| Live workshop, up to 25 people (60 to 90 minutes) | $500 to $1,500 |
| Managed program: platform, monthly lessons and tests, reporting | $3 to $6 a user a month, $100 minimum |
| Payment-fraud and voice-clone drill with a written call-back rule | $500 to $1,000 |
| Yearly report for insurer or auditor (included in the program) | Included |
These are example prices; the per-user program sits a little above the $2 to $5 MSPs commonly charge because it includes live follow-up. Never promise that training will "stop" phishing or cut clicks by a set percentage. Show the client’s own numbers over time. More in Pricing AI and IT services.
The math
Take a part-time trainer about a year in. Ten offices averaging 15 users is 150 users at $5 a month: $750. Two live workshops a month at $750 each add $1,500, for $2,250 in all. Costs: platform wholesale at about $1.50 a user, $225; insurance $80; travel and marketing $95. That is $400, leaving about $1,850 a month before tax for roughly 10 to 12 hours a week.
Set aside about a quarter to a third of profit for tax. See Small business taxes.
Getting customers
Who to approach first. Insurance agents who sell cyber policies and IT providers who don’t want to teach. Agents see clients struggle with the training question on every application; IT providers would rather refer the people side to you. Both can send you several offices a year. Also try any office where you already know the owner.
The first ten customers. Meet 10 local insurance agents and 5 small IT providers. Offer two free 30-minute "How to spot a fake invoice" talks at the chamber or a library business night. Email 30 accounting, law and medical offices with a dated example of a current scam. As an example over about three months: 6 to 10 conversations, 3 or 4 paid workshops, and 2 or 3 of those turning into yearly programs.
Hi Maria, I train small office staff to spot phishing emails, fake invoice changes and voice-clone calls. The FBI counted $3.05 billion lost to business email fraud in 2025, and most of it started with one convincing message to someone in accounts. I run a 60-minute session for your team with real examples, plus a practice run of your rule for confirming payment changes. You get a short written record afterwards, which is the kind of proof cyber insurance applications ask about. Could I send you the outline?
Channels, best to worst for this customer.
1. Insurance agents and brokers: they meet the need at renewal time and refer with authority.
2. IT providers and MSPs: they own the technology and often prefer to hand off the teaching.
3. Trade associations (state CPA society, county bar, dental or medical society): continuing-education slots fill rooms of owners.
4. Chamber of commerce and library business programs: free talks bring warm leads.
5. LinkedIn: short posts showing a real scam of the week, with how to spot it.
6. Google Business Profile: helps when someone searches after a near-miss.
7. Marketplaces such as Upwork and Fiverr: little demand for live local training; skip at first.
8. Paid ads: last; the buyers are found through relationships.
Case studies and referrals. Track each client’s test results by quarter and, with permission, publish the trend without names, in a form like "practice-email clicks at a 14-person firm, quarter by quarter", filled in with that client’s real measured numbers. Ask the insurance agent who referred you for the next office, and send them the yearly report (with the client’s permission) so they see the result. More in Launch and marketing playbook.
Running it week to week
Weekly: read FBI, FTC and CISA alerts and save good examples. Monthly: schedule each client’s lesson and test, review results, and send people who clicked a short follow-up lesson. Answer staff who report suspicious emails quickly and thank them; reporting is the behavior you want. Quarterly: update your live session and send each owner a one-page summary. Keep records of every session and result for the yearly report.
Rules to check
No license is needed to teach security awareness. Get written authorization from the owner before any phishing test; sending deceptive emails to staff without it can break the client’s own policies and set off a real incident response. Never collect real passwords in a test; use a platform whose landing pages record only the click. Do not use real company or brand logos in lures in ways their terms forbid; most platforms supply safe templates. If you record a voice for a drill, use your own voice or one given with written consent. In healthcare clients you may see patient data in a mailbox; you need a business associate agreement if you will handle it. You train and report; you do not tell clients they meet HIPAA, the FTC Safeguards Rule or an insurer’s terms. That judgment belongs to their lawyer or compliance adviser. See Contracts, client data and AI rules.
What goes wrong
A test email is too cruel (a fake bonus) and staff turn against the program; keep lures realistic but kind. The IT provider was not told and treats your test as a real attack; coordinate first. The owner wants names of people who clicked shamed in a meeting; refuse, and report privately. The office buys a platform and drops you; make the live teaching and the report the reason to stay. And your examples go stale; scams change monthly, so update before each session.
Questions people ask
How much does security awareness training cost for a small business?
Platforms list roughly $1 to $4 a user a month, and MSPs commonly charge $2 to $5 a user a month for a managed program. Live workshops are extra; $500 to $1,500 a session is a reasonable example range.
Is security awareness training required by law?
For some businesses, yes. The HIPAA Security Rule requires a training program for all staff at covered healthcare organizations, and the FTC Safeguards Rule requires training at tax preparers and other covered financial businesses. Many cyber insurers also ask about it.
Are phishing simulations legal?
Yes, when the employer authorizes them in writing and the test does not collect real passwords or personal data. Coordinate with the client’s IT provider before sending anything.
How do I train staff to spot voice-clone scams?
Teach one rule: any request to pay, change bank details or share login codes by phone or message gets confirmed by calling back a known number. Then practice it with a drill the owner approves.
Can a college student do this part time?
Yes, if you can present confidently to business owners; evening and lunchtime sessions fit around classes. International students on F-1 visas generally cannot freelance for outside clients without work authorization; ask your international student office first. More in For students.
Free help
CISA’s Cyber Guidance for Small Businesses and Cyber Essentials, the FTC’s small business cybersecurity pages, and the FBI’s Internet Crime Complaint Center (ic3.gov) public alerts give you current examples you may teach from in your own words. SCORE mentors and Small Business Development Centers help with pricing and contracts at no cost. More in Free help directory.
Checked in November 2026: FBI Internet Crime Report 2025 figures, HIPAA Security Rule and FTC Safeguards Rule text, Microsoft’s Attack simulation training license requirement, and CISA’s small business guidance. Platform and MSP prices come from vendor pages; check current prices with the platform you choose.