How to build a revenue model around security awareness

Many partners ask themselves: how do I make money from security awareness? Anyone who looks for the answer in the price per licence will be disappointed. There is little room there, and you end up competing on rate alone. The real profit lies elsewhere, namely in what you build around the platform. An organisation is happy to pay for a programme that makes its people safer and that demonstrably works, and you are the one who delivers that programme, with 2LRN4 as the engine underneath it.

This article shows how you grow from selling individual licences to a fully fledged revenue model. We describe a number of concrete services you can offer, explain where your margin sits in each model, and finish with the practical side of pricing. For background on the three sales models, also read "How to become a security awareness reseller".

From reselling licences to delivering value

Reselling a licence is easy, but it makes you interchangeable. The customer sees a platform, compares the price with another platform, and you have little to set yourself apart. The moment you deliver a programme instead of a product, that changes. You are no longer selling access to software, but a result: employees who recognise phishing, a management team that understands its responsibility, and an organisation that can demonstrate it meets its duty of care.

Within that programme, 2LRN4 is one component, not the whole. The platform provides the training, the phishing simulations and the measurable figures, while you add the direction, the advice and the human contact. It is precisely those added layers that are hard to compare and hard to replace, and that is where your margin and your customer loyalty sit.

Six revenue models in which 2LRN4 is one component

You can offer the models below separately or combine them into a single multi-year programme. They increase in value and in the effort you put in, so choose what fits your organisation and your ambition.

1. The multi-year awareness programme as direction and advice

This is the richest model. You do not deliver training, but a complete privacy and security awareness programme spanning several years. You start with a baseline measurement, you divide the organisation into target audiences, and you create a communication plan that fits the customer's culture. You then roll out the training through 2LRN4, you build in feedback loops to see what works, and you adjust course every quarter. Finally, you report to the management team or the board on progress and behavioural change. You are the director, the platform is your instrument, and your margin sits in the advice, the direction and the multi-year contract.

2. Live training for specific audiences

Alongside the digital platform, you provide on-site or live-online training for groups with their own risk profile. You train the management team on management liability and CEO fraud, the finance department on invoice fraud, HR on handling personal data, and administrators on working safely with privileged accounts. The 2LRN4 platform sets the baseline for everyone, while you deliver the depth that really sticks. You charge per half-day or per group, and this training sells itself the first time a management team is shocked by a realistic example.

3. The ongoing phishing simulation with an improvement cycle

A single phishing test says little, but an ongoing cycle changes behaviour. You run periodic simulations, you analyse who clicks and who reports, you feed the results back to the organisation, and you adjust the next campaign accordingly. The platform provides the simulations and the figures, while you sell the analysis and the improvement cycle as a recurring service. This model delivers predictable, recurring income.

4. The sector-specific programme

You build a ready-made programme for a single sector, for example healthcare, local government, education or the legal profession. You use the examples, the language and the regulations of that sector, so that the programme is immediately recognisable to the customer. 2LRN4 provides the platform and the base content, and you add your own sector material, which we encourage as a partner. With one strong programme, you then serve many customers in the same sector.

5. Compliance and audit support

Many organisations have to demonstrate that they meet NIS2 and the GDPR, and awareness is a mandatory part of that. You help the customer provide that evidence: you translate the measurable figures from the platform into reports for the auditor, you link awareness to policy, and you make sure the management team can substantiate its duty of care. The platform provides the data, and you provide the translation into compliance. NIS2 and its management-liability requirements make this model all the more urgent.

6. The fully managed subscription

Some customers do not want to think about it at all. For them, you take the entire awareness process off their hands for a fixed monthly amount per employee, including the platform, the communication, the reporting and first-line support. 2LRN4 sits under the bonnet, and the customer only sees you. This is the white-label model in its most complete form, with the highest margin and the strongest loyalty, but also the most responsibility. For that reason, also read "How to avoid the pitfalls of white-label".

Where your margin sits per model

In all of these models, the licence is your cost price and the service is what you earn. The price per licence also falls as your volume rises, so your purchasing becomes cheaper while the value of your service stays the same or increases. The table below shows where the margin in each model comes from.

Revenue model	Where your margin sits	Type of income
Multi-year programme with direction	Advice, direction and the multi-year loyalty.	Recurring, high and predictable.
Live training	The rate per half-day or per group.	Project-based, with a good hourly margin.
Phishing simulation as a service	The analysis and the improvement cycle.	Recurring and predictable.
Sector-specific programme	Your own content and the repeatability.	Scalable across many customers.
Compliance support	The translation into compliance and reporting.	Recurring, tied to audits.
Fully managed subscription	The mark-up on the licences plus your services.	Recurring and the highest.

The purchasing side follows a volume scale: the more licences you take, the lower the price per licence becomes. As a reseller, each customer counts within its own scale, whereas with a managed service you add up the total of all your customers and so reach a more favourable rate sooner. A multi-year contract lowers the price per licence per year even further. In this way, growth works in your favour twice over, because your purchasing costs fall while the value of your service rises.

Start small and build out your programme

You do not have to offer the full multi-year programme straight away. Start with one service that fits what you can already do, for example a live training for the management team or a first phishing cycle, and expand as your customer gains confidence and you build up experience. Every service you add raises your margin and deepens the relationship, and a customer you bring in for a baseline measurement often stays for years for the whole programme.

Partner terms are tailored, so there is always room to align the purchasing, the margin and the term with the model you choose. Get in touch to discuss which revenue model and which terms suit your organisation.

Sources for further reading

You will find the prices and volume scales on the pricing page, the rates for managed service on the MSSP page, and the partner terms on the partner page. The market figures on the growth of security awareness are set out with references in "How to become a security awareness reseller".

Related on partnership

How to become a security awareness reseller · Why white-label pays off more than you think · How to sell security awareness in a conversation

FAQ

What am I actually selling if I am not just reselling licences?

You are selling a result rather than a product. That can be a multi-year awareness programme, live training for specific audiences, an ongoing phishing cycle or compliance support. The 2LRN4 platform provides the measurable foundation, and you add the direction, the advice and the human contact. That is where your margin and your distinctiveness sit.

Which services can I build around the 2LRN4 platform?

Among others: a multi-year programme with a baseline measurement, audience segmentation, communication and feedback loops; live training for the management team, finance, HR and administrators; ongoing phishing simulations with analysis; sector-specific programmes; compliance and audit support; and a fully managed subscription under your own brand. You can offer them separately or combine them.

How do I make a multi-year awareness programme attractive?

By presenting it as a journey with a measurable result rather than an annual training. Start with a baseline measurement, divide the organisation into target audiences, create a communication plan and adjust course every quarter based on the figures. The management team wants to see that behaviour is changing and that the organisation is demonstrably meeting its duty of care, and that is what you deliver with a multi-year programme.

Can I provide my own training alongside the digital platform?

Yes, and that is one of the strongest ways to raise your margin. The platform sets the baseline for all employees, while you provide more in-depth training, on-site or live-online, for groups with their own risk profile. You charge per half-day or per group, and this training also strengthens the relationship with the customer.

Where does my margin sit if I deliver a full programme?

In the services around the platform, not in the licence itself. The licence is your cost price, which falls as your volume rises. Your advice, your direction, your training and your reporting determine your selling price. The more value you add and the longer the term, the higher your margin over the whole period.