Phishing simulation is shifting from an "optional extra" for large enterprises to a "must-have" for SMEs. But many IT leaders face a common question when procuring: How much should it actually cost?
This article breaks down real pricing in the Chinese market based on public procurement data and industry reports — using a 1,300-employee scenario with three tailored campaigns for IT staff, general employees, and managers.
Key Data at a Glance
Market Background: Why Phishing Simulation Is Booming
Threat Landscape: Phishing Emails Remain the Top Social Engineering Vector
Industry statistics show that phishing emails received by Chinese enterprise mailboxes grew from 34.4 billion in 2019 to 75.5 billion in 2024. With AI-enhanced copy, click-through rates have surged from 12% to 54%.
Even more telling: organizations with no prior training see an average first-baseline click rate of 23.88% — meaning more than one in five employees fall for the phishing link.
Compliance Drivers: From "Encouraged" to "Mandatory"
Phishing simulation procurement is largely compliance-driven:
- Cybersecurity Law requires critical infrastructure operators to conduct regular cybersecurity education
- MLPS 2.0 (Classified Protection) mandates security awareness training for all personnel categories
- HW Action (national cyber drills) — industries like finance, telecom, and energy typically require targeted exercises beforehand
Procurement timing: The two peak windows are pre-HW Action season (May–August) and National Cybersecurity Awareness Week (September).
Four Delivery Models — 10× Price Difference
The Chinese phishing simulation market has four mainstream delivery models with vastly different pricing:
| Model | Typical Price | Best For |
|---|---|---|
| ① Open-source / Self-built | ¥5K–25K/year | Security team on hand, tight budget |
| ② SaaS Self-service | ¥10K–40K/year | Dedicated operator, ongoing exercises |
| ③ Per-exercise Managed (Mainstream) | ¥20K–40K/time | Most government & enterprise clients |
| ④ Annual Comprehensive / On-premise | ¥80K–300K+ | Finance, SOEs, government |
Five key pricing levers: headcount covered (significant economies of scale), scenario customization depth, exercise frequency, whether training closed-loop is included, and delivery format.
Public Procurement Cases: Real Price Anchors
Below are publicly available procurement results — the most direct benchmarks for pricing:
| Buyer | Scale | Contract Price | Unit Price |
|---|---|---|---|
| Dalian University of Technology | 1,000 people | ¥16,000 | ¥16/person/time |
| Central University of Finance & Economics | 7,200 people | ¥26,000 | ¥3.6/person/time |
| Nanjing Agricultural University | University-wide | ¥29,800 | — |
| China Unicom Package | 50–210 people | ¥4,279–14,378 | ¥68–86/person/time |
Unit price pattern: The larger the scale, the lower the unit cost. 50–210 people ≈ ¥68–86/person; 1,000-person level drops to ¥16/person; 5,000+ can go as low as ¥3.6/person.
1,300-Person Scenario: Three Tailored Campaigns
Suppose your enterprise has 1,300 mailboxes, segmented by role into IT, general employees, and managers — each receiving a different phishing scenario:
| Group | Headcount | Recommended Scenario |
|---|---|---|
| Managers | ~130 | Business cooperation letter, BEC fraud |
| IT Staff | ~130 | System upgrade notice, VPN update |
| General Employees | ~1,040 | Benefits subsidy, attendance notice |
Recommended Budget
| Procurement Plan | Recommended Budget |
|---|---|
| Single 3-scenario managed exercise | ¥20,000–40,000/time |
| 3 exercises per year | ¥60,000–100,000/year |
| Exercise + Training + Awareness annual service | ¥80,000–150,000/year |
| On-premise platform (self-built) | ¥150,000–300,000 |
Procurement Advice: 6 Negotiation Tips
- Decide the model before comparing prices: For 1,300 people, the sweet spot is usually "per-exercise managed" or "3-exercise annual framework."
- Use evidence-based anchors to negotiate: Directly cite public prices like Dalian University of Technology (¥16/person) and Central University of Finance (¥3.6/person).
- Write training into the contract: Exercises don't change behavior — training does. Prioritize vendors that auto-push courses to employees who click.
- Data security clauses: Require all exercise data to be deleted after completion — no retention, no external transfer.
- Disclosure strategy: Don't disclose the first round to establish a true baseline; subsequent rounds can align with Cybersecurity Awareness Week.
- Compare multiple vendors: Get quotes from security firms, email system vendors, and carrier enterprise divisions simultaneously — price differences can reach 2–3×.
Performance expectation: A first-time click rate of 20%+ is normal — don't set punitive KPIs. After a sustained year of "simulation + training," the click rate can drop to around 4%.
Conclusion
Phishing simulation is not a "buy it and you're safe" product — it's a "continuous operations" process. For 1,300 people, budget ¥20–40K per exercise and ¥80–150K for annual services. Whether that money is well spent depends on whether the program includes a training closed-loop and outcome tracking.
If your organization is considering launching a phishing simulation, feel free to contact us for a free security awareness assessment.