Self-Service vs Done-for-You Security Awareness Training: Which Model Fits Your MSP?

Self-Service vs Done-for-You Security Awareness Training: Which Model Fits Your MSP?

The biggest decision in choosing a security awareness training (SAT) platform for your MSP is not which vendor to use. It’s which operating model to commit to.

Self-service platforms hand the MSP a tool. Done-for-you platforms deliver the program as an outcome. The two models have radically different implications for margin, scalability, and client retention.

This guide breaks down the tradeoffs honestly so MSPs can pick the model that matches how their team actually operates — not the model the vendor’s salesperson wants to sell.

The two models, defined

Self-service SAT

Self-service SAT means the MSP operates the platform.

The vendor provides software and content; the MSP:

• Designs the program
• Schedules simulations and training
• Manages enrollments
• Sends reminders and chasers
• Builds reports and QBR narratives
• Handles client questions and exceptions

In this model, the MSP is the security awareness administrator for every client.

Done-for-you SAT

Done-for-you SAT means the vendor operates the program.

The MSP signs on as a partner; the vendor:

• Designs the program for each client
• Runs simulations and training on a consistent cadence
• Sends reminders automatically
• Generates client-ready monthly reports
• Continuously optimizes based on results

The MSP is the channel and the brand; the vendor is the delivery engine.

Most real-world setups land somewhere on the spectrum between these two. Pure self-service still requires vendor support; pure done-for-you still requires MSP input on strategy. But the dominant model the platform is built around shapes everything that follows.

When self-service makes sense

Self-service is the right call for MSPs that meet all of these conditions:

• Have a dedicated security awareness specialist or vCISO on staff with capacity to spare
• Serve fewer than twenty clients, where the operational load stays manageable
• Have clients with significantly different program requirements that need bespoke design
• Want maximum control over simulation design, content selection, and reporting style
• Charge clients enough on the SAT line item to justify the internal labor

When these conditions hold, self-service offers more granular control and often a slightly lower per-user license fee. The MSP team owns the customer experience completely.

When done-for-you makes sense

Done-for-you is the right call for MSPs that match any of these patterns:

• Run lean and cannot afford a full-time security awareness specialist
• Serve more than twenty clients, where the operational load becomes unsustainable
• Want predictable monthly margin on the SAT service line without hidden labor cost
• Need consistent delivery across many client environments without per-client tuning
• Are growing fast and want SAT to scale without scaling headcount
• Have seen previous SAT programs lose momentum after the first few months

Most MSPs serving SMB clients fall into at least three of these categories. Done-for-you removes the operational drag that kills SAT programs in month three.

The economics: where each model wins and loses

License cost

• Self-service: Typically has a lower per-user license fee.
• Done-for-you: Fees are higher because they include vendor delivery time.

Total cost of ownership

This is where the math flips.

Self-service requires MSP labor for:

• Simulation and program design
• Simulation scheduling and safe-listing upkeep
• Enrollment management as client headcount changes
• Reminders, chasers, and completion follow-up
• Monthly reporting and QBR preparation
• Client questions, exceptions, and one-off requests

Price that labor honestly. Even a modest two to four hours per client per month, at a fully loaded technician rate, usually exceeds the license fee itself. An MSP running twenty clients on self-service SAT is quietly funding a part-time job that never appears on the service-line P&L — which is why "cheaper" self-service licenses so often produce a more expensive program.

Done-for-you flips the equation: the license costs more, but the labor line rounds toward zero. The margin you quote the client is the margin you keep.

Client retention

The economics that matter most are the ones that show up at renewal. Security awareness programs fail quietly: the first month ships on time, month three slips, and by month six the program has stalled — usually because the person running it got pulled onto billable work. Peer-reviewed research on phishing training found that training effects fade within about six months without reinforcement, so a stalled program is not just idle — it is actively losing the behavior it built.

Done-for-you exists to make the cadence unbreakable. Consistent monthly delivery produces the trend lines — reporting rates rising, completion holding — that let an MSP walk into a QBR with proof the service works. That story is what renews the contract.

The decision framework: five questions

Skip the feature-comparison spreadsheet. These five questions settle the model choice faster:

• 1. Who owns the admin hours today — and what does that person cost per hour, fully loaded?
• 2. Can your team sustain the cadence for every client in month nine, not just month one?
• 3. Do your clients need genuinely bespoke program design, or consistent, high-quality delivery?
• 4. Are you selling your clients a tool, or an outcome you stand behind?
• 5. What happens to the program when the person running it leaves?

If your answers cluster around spare specialist capacity, under twenty clients, and truly bespoke requirements, self-service fits. If they cluster around lean staffing, growth, and consistency, done-for-you fits. Most MSPs serving SMB clients land in the second cluster — and the ones that pick self-service anyway usually discover the hidden payroll line by month six.

The middle path: co-managed

The models are not binary. A co-managed setup — automation runs the delivery while the MSP keeps strategy, client communication, and the QBR — captures most of the labor savings without giving up the advisory relationship. If your differentiation is security expertise, co-managed lets you spend those hours on advice instead of administration.

Where Hook Security fits

Full disclosure: Hook Security is built around the done-for-you model, so weigh this section accordingly. Autopilot designs and runs phishing simulations, delivers monthly micro-learning, sends the reminders, and generates client-ready reports — across every client from one multi-tenant console. Hundreds of MSPs run their security awareness programs this way, and the MSP stays the brand and the advisor: your logo on the QBR, our engine underneath.

Pricing is published: $2 per seat per month ($20 per seat per year billed annually), or $999 per year flat for organizations under 50 seats — no setup fees. MSP partner pricing is wholesale and tiered on your aggregate seat count; the partner page has the details. And honestly: if your MSP wants to hand-design every simulation for every client, a self-service tool will fit you better than we will.

Frequently asked questions

Is done-for-you SAT more expensive than self-service?

On license price, usually yes. On total cost of ownership, usually no. Self-service shifts delivery labor onto the MSP — simulation design, scheduling, enrollments, reporting — and that labor typically costs more than the license discount saves. Compare total cost per client per month, not per-seat sticker price.

Do MSPs lose the client relationship with done-for-you?

No — the vendor runs delivery, not the relationship. The MSP remains the brand on the reports, the voice in the QBR, and the advisor who interprets results. Losing the relationship is a real risk only with vendors who sell directly to your clients; ask any prospective vendor how their channel model handles that.

Can an MSP switch models later?

Yes, and MSPs regularly do — most commonly from self-service to done-for-you as client count grows. Plan the switch around data continuity (export your history), safe-listing changes, and client communication. The switching cost is mostly a one-time setup effort, not a lock-in problem.

Keep reading

• 5 signs it’s time to replace your SAT vendor — the vetting checklist for whichever model you pick.
• Why MSPs should sell behavior change — the outcome both models are supposed to buy.
• Best security awareness training for MSPs (2026) — the vendor landscape, model by model.
• Hook’s published pricing — the price on the page is the price.