Security awareness training is a mandatory element of most compliance frameworks — PIPEDA, HIPAA, PCI DSS, CMMC, SOC 2, and ISO 27001 all require it in some form. The problem for MSPs with Canadian and UK clients is that most major platforms are built around US law. Covering PIPEDA, Quebec Law 25, PHIPA, YCJA, UK GDPR, the Care Act, and safeguarding obligations typically means buying add-on content, configuring custom modules, or accepting that a meaningful portion of your clients' regulatory reality is not covered.
This guide evaluates platforms on the criteria that matter most for MSP deployments across multiple jurisdictions.
What to look for
- Jurisdiction-specific content depth — generic "privacy awareness" content is not the same as a course that explains PIPEDA's RROSH threshold, Quebec Law 25's PIA requirement, or UK GDPR's special category data rules
- Sector-specific courses — healthcare, legal, financial services, and especially the vulnerable sector (children, abuse survivors, mental health clients) have obligations that general courses cannot cover
- Phishing simulation quality and configurability — number of templates, ability to run jurisdiction-specific simulations, targeting by department or risk group
- Phishing Reporter user experience — does the button just collect the email, or does it explain to the user why the email is suspicious?
- Multi-tenant management — one admin dashboard across all client companies, with per-company reporting and configuration
- Policy acknowledgement — can you require users to sign off on a specific policy document as part of course completion?
- Pricing model — per-seat per-year platforms add up quickly at scale; bundled models reduce billing complexity
- Integration with existing tools — a training platform that lives alongside your patch management and GRC reduces admin overhead
Platform evaluations
Lavawall® MSP pick for Canadian, US, and UK clients
Lavawall® is a full MSP platform — patch management, GRC compliance, M365/Entra configuration monitoring, breach detection, and security awareness training — with training included at no additional per-seat cost. Courses are jurisdiction-specific for Canada (PIPEDA, Law 25, PHIPA, HIA, YCJA, CYFSA, NERC CIP, IIROC/CIRO), the US (HIPAA, FERPA, COPPA, PCI DSS), and the UK (UK GDPR, DPA 2018, RIPA, safeguarding law). Industry-specific courses cover vulnerable sector organizations (children, abuse survivors), non-profits, food services, financial sector, and healthcare.
The Phishing Reporter Outlook add-in gives every user plain-English feedback on every email they report, in real time, directly in Outlook. Phishing simulations are included. Policy acknowledgement — requiring users to sign a specific GRC policy document as part of course completion, with timestamped records — is included.
Best for: MSPs with Canadian clients (especially those in regulated industries), UK clients, or clients in the vulnerable/charitable sector. Also strong for organizations that want training integrated with their GRC and patch management platform.
Where it falls short: Smaller content library than dedicated standalone platforms. Organizations that need thousands of short-form training videos may want to supplement.
KnowBe4
KnowBe4 is the market leader in security awareness training by seat count. Its content library is the largest in the category — thousands of short modules, videos, games, and assessments. Its phishing simulation engine is mature, highly configurable, and supports a wide range of templates and targeting options. Its admin interface is polished and its reporting is comprehensive.
Best for: Organizations that need a very large content library, advanced phishing simulation configurability, or want a purpose-built training platform with deep analytics. Strong for US clients.
Where it falls short: Canadian-specific content (PIPEDA, Law 25, PHIPA, YCJA/CYFSA, provincial laws) and UK-specific content (UK GDPR, safeguarding) require custom configuration or are not deeply covered. Per-seat pricing adds up at MSP scale. The Phishing Reporter (PhishAlert) is report-and-submit only — users receive no explanation of why an email is suspicious. Operates as a separate platform from your security stack.
Proofpoint Security Awareness Training
Proofpoint's training platform is strong on technical email security integration — it feeds real threat intelligence from the email gateway into training content and simulation targeting. If your MSP uses Proofpoint email security, the integration is meaningful.
Best for: Organizations already using Proofpoint email security who want training driven by their real threat landscape.
Where it falls short: Canadian-specific and UK-specific content depth is limited. Per-seat pricing. Operates separately from patch management and GRC. The Phishing Reporter is report-and-submit only.
Mimecast Awareness Training
Mimecast offers short-form "micro-training" content focused on brief, frequent interventions. Its content is professionally produced and easy to consume. Integration with Mimecast's email security is useful for Mimecast shops.
Best for: Organizations that prefer micro-learning formats and are already using Mimecast for email security.
Where it falls short: Content library is smaller than KnowBe4. Canadian and UK-specific content is limited. Per-seat pricing. The Phishing Reporter is report-and-submit only.
Cofense PhishMe / Triage
Cofense is primarily a phishing simulation and threat intelligence platform. Its simulation engine is high quality. Triage provides SOC-level analysis of reported phishing emails. Primarily focused on enterprise, not MSP deployments.
Best for: Enterprise organizations with dedicated security operations teams that want deep phishing analysis infrastructure.
Where it falls short: Not designed for MSP multi-tenant use. Training content library is secondary to the simulation engine. Expensive. No Canadian or UK-specific content.
Frequently asked questions
- What compliance frameworks require security awareness training?
- PIPEDA and most provincial privacy laws (implied by the accountability principle), HIPAA Security Rule §164.308(a)(5), PCI DSS v4 Requirement 12.6, CMMC 2.0 AT domain, SOC 2 CC1.4/CC2.2, ISO 27001:2022 A.6.3, NIST CSF PR.AT, CIS Controls v8 Safeguard 14.1–14.9, and the Canadian CCCS guidelines all require security awareness training in some form.
- Does training need to be jurisdiction-specific to satisfy compliance requirements?
- For most frameworks, the standard is "appropriate training for employees' roles." For Canadian organizations subject to PIPEDA, Law 25, or PHIPA/HIA, generic US-focused training that does not cover those laws' specific requirements is unlikely to satisfy an auditor or regulator looking for evidence of awareness training. For UK organizations subject to UK GDPR and safeguarding obligations, coverage of those specific requirements is expected.
- What is the difference between a Phishing Reporter and a Phishing Reporter with explanation?
- A standard Phishing Reporter (KnowBe4 PhishAlert, Proofpoint, Mimecast) collects the reported email and sends it to an admin queue. The user receives a generic confirmation. A Phishing Reporter with explanation (Lavawall®) shows the user, in the Outlook taskpane within seconds, the specific reasons the email should or should not be trusted. The latter reinforces the skills that make training stick.