The business in one offer
Who it serves
Small professional services companies and nonprofits with 10 to 50 staff that handle client data but have no security team. Owners hear about business email compromise and want staff trained without buying a large enterprise program.
What to sell first
Monthly simulated phishing campaigns for up to 50 users, a quarterly 45-minute live or virtual training session, and a short monthly report of click and report rates by department. Excluded: penetration testing, incident response, technical security controls, and simulations impersonating government agencies or tactics leadership has not approved.
A fixed user count and monthly cadence make the work predictable and easy to price. Reports based on the client's own results show progress concretely, and keeping technical security work out of scope prevents you from promising protection you are not providing.
What could it cost to start?
This is an original example budget for the limited pilot described above. It is not a researched market average or a complete quote for every location.
| Item to price | Example allowance |
|---|---|
| Phishing simulation platform, three months | $300.00 |
| Training content license or course materials | $300.00 |
| Professional liability and cyber insurance allowance | $900.00 |
| Presentation kit, microphone and webcam | $200.00 |
| Simple website with plan details | $150.00 |
| Example total | $1,850.00 |
What this assumes—and excludes
Assumes you already have security knowledge, a computer and presentation skills. Excludes office rent, travel, owner pay and local business licenses. Platform pricing often depends on user count, so get quotes from vendors and an insurance agent before launch.
Collect actual supplier, insurance and local-authority information. Add a reserve for delays and unexpected costs; the example total is not a funding recommendation.
How the unit economics work
At an assumed $350.00 per monthly client and $45.00 in direct costs, contribution is $305.00 before monthly fixed costs, owner pay and taxes. With 3 all-in working hours per unit, that is $101.67 per delivery hour before those deductions. These inputs illustrate the arithmetic; they do not establish a market price or expected earnings.
The example also allows $150.00 in monthly fixed costs. Include unpaid acquisition and administrative time when deciding whether the offer is worthwhile.
Try your own numbers
These are editable planning assumptions, not prices we have verified. Calculations stay in your browser.
Operating result = (price − direct cost) × units − monthly fixed costs. Before owner pay, taxes, financing and startup recovery. At these inputs, delivery requires 30 hours per month, plus any work not included in your per-unit estimate. Sales volume is a scenario, not a forecast.
How to find the first customers
Test a small offer before scaling traffic. Record the source of each enquiry, whether it fits the offer, and whether the buyer pays.
- Offer a free 30-minute talk on email scams to a local business association or chamber group. Invite attendees to opt in for a follow-up conversation.
- Partner with a managed IT provider that lacks training services, agreeing on a referral arrangement disclosed to clients.
- Send a one-page proposal to office managers explaining the program, data handling and how failures are treated. Use published business contact details only.
- After each campaign, share anonymized trend data with the client and ask whether they would refer a peer. Avoid publishing client names without permission.
What to validate before spending more
- Draft a scope agreement covering simulation types, timing, data use and who may see individual results, and have it reviewed by an attorney.
- Run a pilot campaign on volunteers, such as your own test accounts or a friendly business, to check that emails pass filters and landing pages load correctly.
- Confirm your phishing platform's data retention and privacy settings and decide how long you keep individual results.
- Test whether clients prefer monthly or quarterly pricing by offering both in early proposals and tracking which they pick.
The operational catch
Simulated phishing can backfire if it targets sensitive topics such as layoffs or bonuses, or if staff believe results will affect their jobs. Agree with leadership on off-limits themes and that results will be used for coaching, not discipline, and tell staff the program exists before the first test.
A practical way to fund the first step
Start with one or two clients on monthly plans and pay for the platform from their first payment. Use free or low-cost training content until demand shows which materials are worth licensing.
Separate cash already available from money still to earn. Count only proceeds after direct expenses, and do not spend customer funds needed to fulfill their existing orders.
Questions before you start
Is it legal to send fake phishing emails?
With written authorization from the organization and a clear scope, simulations are common practice. Avoid impersonating real outside brands or agencies where that could create legal or trust issues, and follow the client's policies.
What should happen when someone clicks?
Show a short training page explaining what they missed. Track repeat clicks for coaching, but avoid public shaming, which discourages reporting.
Can training stop all breaches?
No. Training reduces risk but cannot replace technical controls. Present it as one layer of protection alongside updates, backups and multifactor authentication.
Source-backed checks
These references support the specific checks below. They do not endorse this business idea or substantiate the example prices, costs or demand.
CISA publishes cyber guidance to help small businesses guard against common threats such as phishing. CISA: Cyber Guidance for Small Businesses.
SBA recommends that small businesses train employees in security principles as part of strengthening cybersecurity. U.S. Small Business Administration: Strengthen your cybersecurity.
The FTC's CAN-SPAM guide explains rules for commercial email, including accurate header information and opt-out options. Federal Trade Commission: CAN-SPAM Act: A Compliance Guide for Business.
- Cyber Guidance for Small BusinessesCISA · Reference checked September 8, 2026
- Strengthen your cybersecurityU.S. Small Business Administration · Reference checked September 8, 2026
- CAN-SPAM Act: A Compliance Guide for BusinessFederal Trade Commission · Reference checked September 8, 2026
Turn this into your own plan.
Start with this offer, then add your actual budget, skills, weekly hours and location. Your generated plan starts private.
Plan this business →