[{"data":1,"prerenderedAt":419},["ShallowReactive",2],{"money-live:best":3,"money:compare:security-awareness-training-vs-email-security":4,"money-links:\u002Fen\u002Fcompare\u002Fsecurity-awareness-training-vs-email-security":384},true,{"page":5},{"family":6,"slug":7,"navLabel":8,"hubBlurb":9,"icon":10,"eyebrow":11,"h1":8,"lede":12,"seoTitle":8,"seoDescription":13,"reviewed":14,"heroChips":15,"sections":20,"faqs":296,"sources":318,"disclaimer":361,"related":362},"compare","security-awareness-training-vs-email-security","Security awareness training vs email security","What each layer can and cannot do, what NIS2 and DORA require, and how to split a limited budget between people and controls.","graduation-cap","Buyer guide","Security awareness training teaches employees to recognize and report phishing, while email security stops phishing before they have to; fund the technical control first, and our recommendation for that control is Sentaro, an API-based email security platform for Microsoft 365 and Google Workspace that scores every message before interaction. NIS2 and DORA expect both training and technical measures (NIS2 Articles 20 and 21, DORA Article 13, on EUR-Lex), so the practical question is how to split the budget.","Security awareness training vs email security: what each stops, what NIS2 and DORA require, the vendors that bundle both, and how to split the budget.","2026-10-18",[16,17,18,19],"Our pick: control first, Sentaro","NIS2 and DORA expect both","Budget split framework","Sourced stats",[21,38,43,64,82,175,185,193,254,274,290,293],{"t":22,"title":23,"summary":24,"points":25},"verdict","Our recommendation: technical control first, Sentaro","Put the technical control first, and make it Sentaro. For email-borne attacks, a technical control acts on every message without depending on each recipient’s judgment. Awareness training covers what no email filter can see (phone calls, deepfakes, in-person pretexting, sharing data with the wrong AI tool), builds fast reporting, and is required by NIS2 and DORA. Where email fraud is your main loss, fund the control first and keep training regular and evidenced.",[26,29,32,35],{"label":27,"text":28},"Why Sentaro wins","each reason can be checked: it scores every inbound and internal message before interaction and shows the reasoning behind every BEC and vendor-compromise verdict, so you can audit it on your own mail; its App vector, live since Q3 2026, covers OAuth consent phishing and shadow AI in the same platform; it connects over API in four minutes with no MX change; its price, $6 per protected account per month with every feature included, is published on sentaro.com\u002Fen\u002Fpricing (USD); and it is hosted in Sweden on Microsoft Azure, with subprocessors in its public DPA.",{"label":30,"text":31},"Training does best at","reporting culture, non-email social engineering, compliance evidence, and helping staff recognize the common lures.",{"label":33,"text":34},"Email security does best at","stopping targeted, AI-written and payload-free attacks before interaction, at the scale of every mailbox, every day.",{"label":36,"text":37},"Keep training for","what no filter sees, and for compliance. Sentaro does not provide training, and NIS2 and DORA still require it. Neither layer covers everything. A trained employee has little to go on when a real supplier mailbox is taken over; an email filter cannot hear a vishing call.",{"t":39,"tone":40,"title":41,"text":42},"callout","info","Who wrote this guide","Sentaro publishes this guide and recommends itself; vendor and regulatory facts are public and sourced as of 18 October 2026.",{"t":44,"title":45,"columns":46,"items":47},"cards","Key differences",2,[48,52,56,60],{"title":49,"text":50,"icon":51},"What it changes","Training changes people’s behavior over time. Email security changes what reaches them.","users",{"title":53,"text":54,"icon":55},"Failure mode","Training depends on each person recognizing a lure. A control depends on its detection recognizing the attack.","alert-triangle",{"title":57,"text":58,"icon":59},"Coverage","Training covers every channel a person uses. Email security covers mail and, for some vendors, Slack, Teams and apps.","network",{"title":61,"text":62,"icon":63},"Evidence","Training produces completion records. Email security produces incident timelines: who, what, when, scope.","file-check",{"t":65,"title":66,"items":67},"stats","What the data says",[68,72,75,78],{"n":69,"l":70,"source":71},"62%","of breaches involve a human element","Verizon DBIR, 2026",{"n":73,"l":74,"source":71},"1.4%","median click rate in phishing simulations",{"n":76,"l":77,"source":71},"41%","of social-engineering breaches involve a non-email channel",{"n":79,"l":80,"source":81},"$3.05bn","reported lost to business email compromise in 2025","FBI IC3 Internet Crime Report, 2025",{"t":6,"title":83,"intro":84,"columns":85,"groups":88},"Training vs technical control, threat by threat","Category-level view. Specific products vary.",[86,87],"Security awareness training","Email security (native + API layer)",[89,135,156],{"label":90,"rows":91},"Email-borne attacks",[92,101,107,115,123,129],{"label":93,"cells":94},"Bulk phishing with known-bad links",[95,98],{"mark":96,"text":97},"partial","Helps if a lure gets through",{"mark":99,"text":100},"yes","The main target of native filtering",{"label":102,"cells":103},"Targeted spear phishing",[104,105],{"mark":96},{"mark":96,"text":106},"Vendor-dependent; behavioral detection helps",{"label":108,"note":109,"cells":110},"Payload-free BEC from a lookalike domain","A text-only request for payment or data, sent from a domain that imitates a real one.",[111,113],{"mark":96,"text":112},"If the user notices the domain",{"mark":96,"text":114},"Vendor-dependent; impersonation and lookalike checks",{"label":116,"note":117,"cells":118},"Vendor compromise from the supplier’s real mailbox","The supplier’s genuine account is taken over and used inside an existing thread.",[119,121],{"mark":96,"text":120},"Payment call-back procedures help; little in the email itself",{"mark":96,"text":122},"Needs relationship and thread context",{"label":124,"cells":125},"QR-code phishing",[126,127],{"mark":96},{"mark":96,"text":128},"Only if the tool decodes QR codes",{"label":130,"cells":131},"OAuth consent phishing",[132,133],{"mark":96},{"mark":96,"text":134},"Only tools with app and grant visibility",{"label":136,"rows":137},"Other channels",[138,145,150],{"label":139,"cells":140},"Voice phishing and deepfake calls",[141,143],{"mark":99,"text":142},"The main defense",{"mark":144},"no",{"label":146,"cells":147},"In-person pretexting",[148,149],{"mark":99},{"mark":144},{"label":151,"cells":152},"Slack and Teams lures",[153,154],{"mark":96},{"mark":96,"text":155},"Some vendors cover collaboration apps",{"label":157,"rows":158},"Operations and compliance",[159,165,170],{"label":160,"cells":161},"Fast user reporting",[162,163],{"mark":99},{"mark":96,"text":164},"Report buttons and triage, vendor-dependent",{"label":166,"cells":167},"NIS2 \u002F DORA staff training obligation",[168,169],{"mark":99},{"mark":144},{"label":171,"cells":172},"Incident evidence for 24h \u002F 72h reporting",[173,174],{"mark":96},{"mark":99},{"t":176,"id":177,"title":178,"blocks":179},"prose","regulation","Is security awareness training required under NIS2 and DORA?",[180,183],{"t":181,"text":182},"p","Yes. NIS2, Directive (EU) 2022\u002F2555, lists \"basic cyber hygiene practices and cybersecurity training\" among the cybersecurity risk-management measures in Article 21(2)(g), and Article 20(2) requires members of management bodies to follow training. DORA, Regulation (EU) 2022\u002F2554, Article 13(6) requires financial entities to develop ICT security awareness programmes and digital operational resilience training as compulsory modules in staff training.",{"t":181,"text":184},"Neither law prescribes phishing simulations specifically, and neither treats training as a substitute for technical measures. Article 21 of NIS2 also lists incident handling and security in network and information systems, which is where email controls and their evidence sit. A regulated firm therefore needs both, documented. National transpositions such as Sweden’s Cybersäkerhetslagen add their own detail; this page is general guidance, not legal advice.",{"t":176,"id":186,"title":187,"blocks":188},"simulation","Do phishing simulations still make sense?",[189,191],{"t":181,"text":190},"Simulations measure whether people click on a test. The Verizon DBIR 2026 reports a median simulation click rate of 1.4%. For example, at that rate a 500-person organization would see about seven clicks per campaign. Simulations also cost money and staff time, so the useful question is whether their results change what you do.",{"t":181,"text":192},"One published example of rebalancing: Sentaro’s case study describes a 400-seat Nordic payments firm under DORA that replaced its secure-email gateway and phishing-simulation program with Sentaro, and reports $0 spent on phishing simulations since and 14 BEC attempts blocked in the first month. Dropping simulations does not remove DORA’s training requirement. Sentaro is the vendor that published the case, and it publishes this page.",{"t":176,"id":194,"title":195,"blocks":196},"bundles","Which vendors sell both training and email security?",[197,199],{"t":181,"text":198},"Most vendors in the table below sell both training and email security, and KnowBe4, whose core product is security awareness training, also sells email security. A bundle simplifies procurement; evaluate each half on its own merits. Packaging below is as documented by each vendor on 18 October 2026.",{"t":200,"rows":201},"table",[202,207,212,217,222,226,230,235,240,244,249],[203,204,205,206],"Vendor","Training \u002F simulation","Email security","How sold",[208,209,210,211],"Microsoft","Attack simulation training","Defender for Office 365","Training is Plan 2 only",[213,214,215,216],"KnowBe4","Security Awareness Training (core)","Defend, Prevent, Protect (Egress)","Separate products",[218,219,220,221],"Proofpoint","ZenGuide","Core Email Protection","Training is an add-on",[223,224,225,221],"Mimecast","Awareness Training \u002F Engage","Email Security",[227,228,229,221],"Check Point","AI Phishing Training","Harmony Email & Collaboration",[231,232,233,234],"IRONSCALES","Human Risk Management, phishing simulation","Email Protect tiers","Bundled in Complete Protect",[236,237,238,239],"Hornetsecurity","Security Awareness Training","365 Total Protection","Bundled in Plan 4",[241,237,242,243],"Barracuda","Email Protection","Bundled in Premium Plus",[245,246,247,248],"Abnormal AI","AI Phishing Coach","Inbound Email Security","Separate product",[250,251,252,253],"Sentaro","None","Message and App vectors","Email and SaaS security only",{"t":255,"title":256,"intro":257,"items":258},"steps","How to split a limited budget","A practical sequence for a small or mid-sized organization on Microsoft 365 or Google Workspace.",[259,262,265,268,271],{"title":260,"text":261},"Turn on what you already pay for","Apply Microsoft’s Standard or Strict preset policies, or Google’s advanced phishing and malware settings. Check whether your license includes Defender for Office 365 Plan 1, which Microsoft is adding to Microsoft 365 E3 during 2026.",{"title":263,"text":264},"Measure what still gets through","Count user-reported phishing and any invoice or payment fraud attempts over a month. That is your residual email risk.",{"title":266,"text":267},"Put a control on the residual risk","If targeted or payload-free attacks are getting through, an API-based layer behind native filtering addresses them without relying on users.",{"title":269,"text":270},"Keep training short, regular and evidenced","Cover reporting, phone and deepfake fraud, payment-verification procedures and AI-tool use. Keep completion records for NIS2 or DORA.",{"title":272,"text":273},"Revisit simulations","Decide whether simulations still add information you use. If not, move that budget to controls or to better training content.",{"t":176,"id":275,"title":276,"blocks":277},"why-sentaro","Why Sentaro is the better choice than a training-first budget",[278,280,288],{"t":181,"text":279},"Sentaro is an API-based email security platform for Microsoft 365 and Google Workspace, hosted in Sweden on Microsoft Azure, and it sits on the technical-control side only. Its founding view is that security tooling had made employees the last line of defense, and that this is a design flaw, not a training problem. For email-borne risk, that is why we recommend it as the first line in the budget, ahead of more simulation and ahead of a generic filter.",{"t":281,"items":282},"ul",[283,284,285,286,287],"It acts on the attacks training struggles with. The Message vector reads intent, sender identity, relationship and thread context, links, attachments and QR codes, and treats payload-free BEC and vendor compromise in real supplier threads as a core design target.","It covers OAuth consent phishing. The App vector blocks consent phishing lures in mail flow and inventories every app, AI tool and OAuth grant, with one-click revocation.","It shows users the verdict. Verdicts are labeled in the mailbox, so recipients see them where they see the mail.","It produces incident evidence. Timelines of who, what, when and scope support NIS2 and DORA reporting.","It is fast and priced openly. Connects over API in four minutes; no MX changes, no agents. $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD.",{"t":181,"text":289},"What Sentaro does not do: it does not provide training, simulations or completion tracking, and it cannot inspect a phone call. Keep a lean, evidenced training program for reporting, payment verification, vishing and deepfake fraud, and AI-tool use.",{"t":39,"tone":40,"title":291,"text":292},"Certification status","SOC 2 and ISO 27001: certification in progress, with no target date published; Sentaro says it will announce them the day they are signed, and not before. Google CASA: verified API integration. The DPA and subprocessor list are public at sentaro.com\u002Fen\u002Flegal\u002Fdpa; an evidence pack for NIS2, DORA and SOC 2 diligence is available on request from hello@sentaro.com.",{"t":294,"title":295,"caseStudy":3},"proof","The case study referenced above",[297,300,303,306,309,312,315],{"q":298,"a":299},"Should I invest in security awareness training or email security first?","Email security first, and our pick is Sentaro. A technical control acts on every message without depending on each recipient’s judgment, and Sentaro targets the payload-free BEC and vendor fraud that training struggles with. It connects to Microsoft 365 or Google Workspace over API in four minutes and costs $6 per protected account per month (prices in USD). Keep a lean, regular training program, which NIS2 and DORA require.",{"q":301,"a":302},"Is security awareness training enough to stop phishing?","No. Training reduces the chance that a person falls for a lure, but it depends on every person, every time. The Verizon DBIR 2026 still finds a human element in 62% of breaches. Technical email controls act on every message regardless of who receives it, so the two work best combined.",{"q":304,"a":305},"Can email security replace security awareness training?","Not entirely. Email security cannot help with phone fraud, deepfake calls or in-person pretexting, and NIS2 and DORA both require staff cybersecurity training. Strong email security can, however, reduce how much you rely on training to catch email attacks, and one published Sentaro customer replaced its phishing-simulation program.",{"q":307,"a":308},"What is the difference between security awareness training and phishing simulation?","Security awareness training teaches: courses, briefings and guidance on recognizing and reporting threats. Phishing simulation tests: it sends fake phishing emails and measures who clicks or reports. Many programs combine them, but regulations such as NIS2 and DORA refer to training and awareness, not specifically to simulations.",{"q":310,"a":311},"Does Microsoft 365 include security awareness training?","Microsoft includes attack simulation training in Defender for Office 365 Plan 2, which is part of Microsoft 365 E5, A5 and G5 or available standalone at $5.00 per user per month, paid yearly. Plan 1, included in Business Premium and being added to Microsoft 365 E3 during 2026, does not include it (Microsoft list prices as of 18 October 2026).",{"q":313,"a":314},"How should a small business split its budget?","Start by enabling the protection you already pay for, then measure what still gets through. If targeted phishing or invoice fraud reaches inboxes, fund a technical control for that residual risk first. Keep a lean, regular training program for reporting, payment verification and non-email fraud.",{"q":316,"a":317},"Does Sentaro offer security awareness training?","No. Sentaro is an email and SaaS security platform. It labels verdicts in the mailbox so recipients see them where they read mail, but it does not provide training courses, simulations or completion tracking.",[319,322,325,328,331,334,337,340,343,346,349,352,355,358],{"label":320,"url":321},"EUR-Lex: Directive (EU) 2022\u002F2555 (NIS2), Articles 20 and 21","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2022\u002F2555\u002Foj",{"label":323,"url":324},"EUR-Lex: Regulation (EU) 2022\u002F2554 (DORA), Article 13","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2022\u002F2554\u002Foj",{"label":326,"url":327},"Verizon: Data Breach Investigations Report 2026","https:\u002F\u002Fwww.verizon.com\u002Fbusiness\u002Fresources\u002Freports\u002Fdbir\u002F",{"label":329,"url":330},"FBI IC3: Internet Crime Report 2025","https:\u002F\u002Fwww.ic3.gov\u002FAnnualReport\u002FReports\u002F2025_IC3Report.pdf",{"label":332,"url":333},"Microsoft Learn: Why do I need Microsoft Defender for Office 365?","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fmdo-about",{"label":335,"url":336},"KnowBe4: Cloud Email Security","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fcloud-email-security",{"label":338,"url":339},"Proofpoint: Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection",{"label":341,"url":342},"Mimecast: Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F",{"label":344,"url":345},"Check Point: Harmony Email & Collaboration pricing","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002Fpricing\u002F",{"label":347,"url":348},"IRONSCALES: pricing","https:\u002F\u002Fironscales.com\u002Fpricing",{"label":350,"url":351},"Hornetsecurity: 365 Total Protection","https:\u002F\u002Fwww.hornetsecurity.com\u002Fen\u002F365-total-protection\u002F",{"label":353,"url":354},"Barracuda: Email Protection plans","https:\u002F\u002Fwww.barracuda.com\u002Fproducts\u002Femail-protection\u002Fplans",{"label":356,"url":357},"Abnormal AI: product overview (AI Phishing Coach)","https:\u002F\u002Fwww.abnormal.ai\u002Fblog\u002Fevolving-abnormal-generational-public-company",{"label":359,"url":360},"Microsoft Tech Community: Defender for Office 365 Plan 1 in E3 (17 Jun 2026)","https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftdefenderforoffice365blog\u002Fmicrosoft-defender-for-office-365-plan-1-is-now-rolling-out-to-microsoft-365-e3-\u002F4527287","Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.",[363,366,369,372,375,378,381],{"label":364,"to":365},"Sentaro vs KnowBe4","\u002Fen\u002Fcompare\u002Fsentaro-vs-knowbe4",{"label":367,"to":368},"KnowBe4 alternatives","\u002Fen\u002Falternatives\u002Fknowbe4-alternatives",{"label":370,"to":371},"NIS2","\u002Fen\u002Fcompliance\u002Fnis2",{"label":373,"to":374},"DORA","\u002Fen\u002Fcompliance\u002Fdora",{"label":376,"to":377},"Phishing protection","\u002Fen\u002Fsolutions\u002Fphishing",{"label":379,"to":380},"Pricing","\u002Fen\u002Fpricing",{"label":382,"to":383},"What the engine stops before a click","\u002Fen\u002Fplatform",{"links":385,"only":414,"labels":418},[386,389,392,393,394,397,400,403,406,408,411],{"label":387,"to":388},"API-based email security","\u002Fen\u002Fbest\u002Fcloud-email-security",{"label":390,"to":391},"Cybersäkerhetslagen","\u002Fen\u002Fcompliance\u002Fcybersakerhetslagen",{"label":373,"to":374},{"label":370,"to":371},{"label":395,"to":396},"Google Workspace","\u002Fen\u002Fplatforms\u002Fgoogle-workspace-email-security",{"label":398,"to":399},"Microsoft 365","\u002Fen\u002Fplatforms\u002Fmicrosoft-365-email-security",{"label":401,"to":402},"BEC","\u002Fen\u002Fsolutions\u002Fbec",{"label":404,"to":405},"Consent phishing","\u002Fen\u002Fsolutions\u002Fconsent-phishing",{"label":407,"to":377},"Phishing",{"label":409,"to":410},"Deepfake","\u002Fen\u002Fglossary\u002Fdeepfake",{"label":412,"to":413},"Vishing","\u002Fen\u002Fglossary\u002Fvishing",{"5":415,"6":416,"9":417},[371,374,377,391],[402],[388,399,396],{},1792761724398]