KnowBe4 Security Awareness Training at Partner Pricing: Phishing Simulation, Insider Threat and CUI Handling Training for CMMC (2026)

Service guide · United States, Canada, Europe · Updated October 6, 2026

Short answer: ITSecOps supplies KnowBe4 licences at partner pricing and runs the programme for you: monthly phishing simulations, security awareness training, insider threat awareness and CUI handling training, with every assignment and completion recorded. For defense contractors those records are the evidence behind three CMMC Level 2 practices. You receive a written quote within one business day.

Why this matters now

The Sophos Active Adversary Report 2026, published in February, analysed 661 incident response cases and traced 67 percent of them to an identity-related root cause, the kind of entry point that starts with a person and a convincing message. At the same time, contractors declaring CMMC Level 2 under the September 3, 2026 class deviation have to show training evidence for every person with access, and “we sent a link once” is not evidence.

What the programme covers

What KnowBe4 costs

KnowBe4 prices per seat, and the price depends on the subscription level, the number of seats and the term. Third-party pricing trackers report 2026 list prices of roughly $1.30 to $3.75 per seat per month, with a 25-seat minimum and annual billing. List price is the ceiling. ITSecOps buys through its distribution channel at partner pricing, which is why the written quote is normally below what you are offered direct.

What ITSecOps does beyond the licence

1. Set-up: directory sync, single sign-on, allow-listing so simulations reach inboxes, and groups by role.
2. Calendar: a year of campaigns agreed up front: monthly phishing simulation, quarterly insider threat and CUI refresher, annual training for everyone.
3. New starters: training assigned in the first week, before access to sensitive data.
4. Follow-up: reminders and escalation for people who have not completed, and extra training for repeat clickers.
5. Evidence: completion reports exported on schedule and filed against the CMMC practice they support, ready for the annual affirmation.

The management work is estimated by the hour, the same way as the rest of the CMMC recurring activity calendar.

CUI handling training: what is actually needed

The Department of Defense publishes CUI training and insider threat awareness training through the Center for Development of Security Excellence, and many primes expect their suppliers to complete them. We assign those courses, record each completion alongside the KnowBe4 records, and add a short module on your own CUI procedure, because an assessor will ask whether staff know how CUI is handled in your company, not only in general.

Frequently asked questions

How much does KnowBe4 cost?

KnowBe4 prices per seat by subscription level, seat count and term. Third-party pricing trackers report 2026 list prices of roughly $1.30 to $3.75 per seat per month, with a 25-seat minimum and annual billing. ITSecOps quotes KnowBe4 at partner pricing in writing within one business day.

Does security awareness training satisfy CMMC Level 2?

It addresses the three Awareness and Training practices: AT.L2-3.2.1 on security risk awareness, AT.L2-3.2.2 on role-based training and AT.L2-3.2.3 on insider threat awareness. An assessor looks for the content used and a completion record for each person, which is why the records matter as much as the training.

Is training required for CMMC Level 1?

The 15 Level 1 requirements in FAR 52.204-21 do not include a training requirement. Training is still the cheapest control against phishing, and it becomes mandatory at Level 2.

How is CUI handling training covered?

The Department of Defense publishes CUI training through the Center for Development of Security Excellence. We assign it, record each completion, and add a short module on your own CUI marking, storage and sharing procedure so staff learn the rules that apply in your company.

Can ITSecOps run the programme for us?

Yes. We set up the platform, schedule the phishing simulations and training campaigns, chase completions and file the reports as CMMC evidence, estimated by the hour.

Is ITSecOps part of KnowBe4?

No. ITSecOps is an independent reseller and service provider. KnowBe4 is a trademark of KnowBe4, Inc.

Related

CMMC Level 2 recurring activity checklist · CMMC consultants for US contractors · Cybersecurity price comparison · Security stack recommender

KnowBe4 is a trademark of KnowBe4, Inc. ITSecOps is an independent reseller and service provider and is not affiliated with or endorsed by KnowBe4.