The 17 best phishing simulation software tools (2026): free, open source and full platforms compared

Phishing simulation software lets you send realistic but harmless phishing emails to your own employees, so they learn to spot real attacks before one costs you. We compared 17 tools on realism, reporting, ease of setup and what actual users say about them. Guardey tops the list. Below you’ll find where each of the other 16 falls short, and for whom they might still work.

An estimated 3.4 billion phishing emails go out every day, and most successful breaches still start with one employee clicking the wrong link. Technology filters out a lot, but the last line of defense is human. This guide helps you pick the simulation tool that actually changes behavior, not just checks a compliance box.

In brief

• What it does: phishing simulation software sends realistic but harmless phishing emails to your own employees and shows you who clicks, who reports, and who needs training.
• Our pick: Guardey. Simulations and weekly gamified training in one platform, set up in minutes, with reports that satisfy NIS2, ISO 27001 and IBP audits.
• What to compare: how realistic the templates are, what happens after someone clicks, what the reports look like for your auditor, and how long setup takes. We compared all 17 tools on exactly those points below.
• Not in this list: KnowBe4, SoSafe and Awaretrain are full awareness suites rather than dedicated simulation tools. We cover them separately further down.

All 17 phishing simulation tools compared

We deliberately left prices out of the table: most vendors quote per user count and public prices change often. Where a vendor publishes prices, we link to them in its section below.

The 17 best phishing simulation software tools:

1. Guardey
2. Sophos Phish Threat
3. Gophish
4. Attack Simulation Training by Microsoft
5. Hoxhunt
6. Cofense PhishMe
7. Infosec IQ
8. Safetitan
9. Cyber Guru
10. Phishingbox
11. uPhish (by Usecure)
12. Wizer
13. Barracuda
14. Arctic Wolf
15. Phished
16. Proofpoint
17. Fortra Terranova Security

Full phishing simulation and training platforms

Platforms that combine realistic simulations with training and audit-ready reporting. This is the category most organizations end up in.

1. Guardey

Guardey offers a combination of security awareness training and phishing simulations.

You can easily set up a phishing simulation in a matter of minutes:

1. Pick a phishing template from the library
2. Decide to which employees it should be sent and when
3. Whitelist your domain
4. Start sending

In a real-time dashboard, you can keep a pulse on important statistics such as how many emails have been sent and how many times an email was opened, a link was clicked, and data was submitted. The reports are built for audits: they work for NIS2, ISO 27001, IBP and most other frameworks, so you can hand them straight to your auditor or board.

What sets Guardey apart from the alternatives is that they also offer gamified security awareness training. Employees take on weekly challenges, in which they learn about all sorts of phishing threats and a wide variety of other security risks. In a leaderboard, they get to compete with each other, which has proven to boost engagement. Users can score points by performing well during training and by reporting phishing (simulations).

Guardey believes that the best way to create phishing awareness is by training weekly and regularly performing a phishing simulation to test the effectiveness of training.

Pros

• Easy-to-use platform (set up a campaign in a matter of minutes)
• Gamification to motivate users
• Leaderboards reward both training performance and reported phishing emails, so reporting becomes a habit
• Mobile app for iOS and Android
• Free trial available

Cons

• The training platform doesn’t use video content, which can be a con for some organizations

Review

“The phishing results made it clear that there was work to be done to improve phishing awareness. If we get our people to recognize and report more phishing incidents, we can take action and keep damages to a minimum. From now on, we want to perform a phishing simulation twice a year with Guardey, to see if this improves.” – Source

2. Hoxhunt

Hoxhunt offers what it calls a human risk management platform. It doesn’t offer a free trial, so you will need to get in contact with the sales department to get a better understanding of how it works.

But here’s how it works in short:

• You set up phishing simulations
• Based on how your employees interact with those simulations, they get assigned training material
• Users can score points for performing well during training and by recognizing and reporting phishing

Hoxhunt offers a great and complete solution for phishing, however, it is consider by many to be pricy and mostly suitable for enterprise organizations.

Pros

• Gamification
• Easy-to-use dashboard for admins

Cons

• No free trial
• Mostly focused on enterprise organizations
• Some phishing templates are easy to recognize as fake

Review

“The idea of emails that look real is great. I think it helps people to realize how simple it is to attract someone to click on a link or to open an attachment. It is easy to navigate when in dashboard, the scoring among others within company is interesting. Interactivity on the dashboard is great and invites for more completions. The emails, however, are very easy and can be spotted on the first sight that it belongs to a Hoxhunt. When subscribed for the spicy mode, those emails are not very sophisticated either.” – G2

3. Phished

Phished (tips hat for the clever brand name choice) also offers a combination of training and phishing simulations.

With Phished, you can automate the entire process of sending out phishing simulations, freeing up your IT team of some time. The content is tailored to your organization’s location, company context, and current events. You can also customize content to individuals, to make sure they’re tested in a way that makes most sense. How good the level automation truly is, is hard to say. There is no free trial of the product available.

Pros

• Fully automated phishing campaigns
• Custom campaigns for individuals

Cons

• No transparent pricing on the website
• No free trial

Review

“Phished allows an effortless setup and management of simulation phishing emails. The control dashboard is very limited documented. The dashboard is extensive, but the logic in how it’s structures is not always clear (bet it is to the developers).” – G2

4. Infosec IQ

Infosec IQ offers personalized awareness training based on the unique risk profile of each employee. It does so in a similar way that Hoxhunt does it:

1. Send out phishing simulations
2. Automatically analyze how the user reacts
3. Assign training based on performance

Many reviewers are excited about the platform, but mention that the reporting capabilitites could be improved upon.

Pros

• Easy to set up campaigns
• Training based on individual risk profile

Cons

• Reporting functionality could be improved
• No free trial

Review

“The tool interface keeps evolving constantly to make it better for their customers. I have been working with the tool for the past 1 year and I see a ton of improvement on user interface. Reporting and metrics can be better. At times it is difficut to figure out the metrics manually. Also, there should be a way to remove the stale accounts automatically.” – G2

5. Safetitan

Creating a phishing campaign in Safetitan is simple. You can set up continuous campaigns for simulations that never end. Just like other solutions, training sessions are triggered based on how the users interact with the phishing emails that are being sent.

Pros

• Simple set-up
• Use templated phishing emails and training content
• Automated report is sent each month

Cons

• No free trial
• The admin panel could be improved upon

Review

“SafeTitan’s automated approach to training employee’s model based on specific behaviors is a effective feature. This means that I don’t have to set up the general security awareness training for the whole team by myself.” – G2

6. Cyber Guru

Cyber Guru is an Italy-based platform that offers both a training program and phishing simulations. Here’s how they’ve organized it:

1. Awareness training: an e-learning-based program
2. Channel training: a video-series
3. Phishing training: adaptive anti-phishing training (including simulations)

If a user ‘fails’ a simulation, they have to do a micro training session. This session is specifically tailored to the phishing email they just clicked on. There are many experts who advise against this, as this form of training can easily be perceived as punishment.

Pros

• Complete platform with training and simulations
• Includes video content (even though these videos are somewhat long-winded, some organizations prefer it)

Cons

• No free trial available
• Training sessions after failing a phishing simulation may feel like a punishment
• The platform doesn’t use gamification to motivate users

Review

“We tried only the phishing feature; on-the-job training experience without users having to take courses, simple to implement and easy to understand. Results are visible over time, but there is a need for incentives from the company.” – Gartner

7. Fortra Terranova Security

Fortra Terranova offers a very wide range of security solutions. This means security awareness (and phishing simulations) isn’t necessarily their focus, but they do offer it as a product.

They offer a mix of gamified content to make the training experience engaging, while mixing in ‘real-world phishing simulations’, which must mean that the templates are meant to be very convincing.

Pros

• Could be interesting for organizations that look for an all-in-one product
• Offers both training and phishing simulations
• Free trial

Cons

• No transparent pricing
• No focus on just security awareness

Review

“I am mostly using the simulation functionality and I am quite happy with that. I like they way a simulation is built using a step-by-step approach visualized with tabs. It helps understanding exactly what is left to complete. The interface is easy to use. I dont like that there is no easy way to copy and re-use and existing template that I have built. I basically have to copy and paste email and feedback templates which is unnecessary. There is also kind of a bug related to email settings and the possibility to test sending emails. It is unclear exactly how the test functionality works.” – G2

Free and open-source phishing simulation tools

Three realistic routes if budget is the constraint. What you give up compared to a full platform is explained below the list.

8. Gophish

GoPhish is an open-source phishing framework that enables you to copy existing emails to use for phishing campaigns. The links are automatically replaced and the input values are recorded, so you can see exactly who clicked and filled out valuable data.

The set-up of GoPhish requires some technical ability. You can use the installation guide on Github or use another platform to get it to work. But once it does, it’s a powerful tool to set up your own personalized phishing campaigns.

Pros

• Free to use
• Open-source
• Easily use existing emails

Cons

• Requires technical knowledge
• Does not come with a training module

Review

“We did set up our own GoPhish server using an AWS instance, and it took quite a bit of work to get it going. One of the harder parts was getting Gmail to not automatically flag the test emails as phishing/scam and defeating the whole testing our users part.” – Reddit

9. Wizer

Wizer is a platform that offers ‘smart phishing’ simulations. They have a template library that is organized by calendar dates. During the holidays, you will see holiday-related templates, and at the end of January you will see an ‘End of Year Taxes’ template. This makes it easier to find templates that are relevant for your organization right now.

You can easily decide who you want the phishing mails to be sent to:

• All users
• Departments
• Or specific users

Wizer has a good-looking interface and is easy to manage for admins.

Pros

• Easy to find relevant phishing templates
• Easy to maintain for admins

Cons

• No free trial
• The videos in the training content can be a bit long-winded

Review

“Wizer is much easier to setup and manage than our previous platform. The training are bite-sized videos that cover the topic well without droning on. Our previous training provider offered more tools and reporting, but this also made the admin console more cluttered and difficult to navigate.” – G2

10. Attack Simulation Training by Microsoft

Microsoft’s Outlook is the most widely used email client there is, so it’s only right that they have created their own phishing simulator. They call it Attack Simulation Training, which is part of their Microsoft Defender product.

Attack Simulation training allows you to pick from a few different social engineering technques:

• Credential harvest
• Malware attachment
• Link in attachment
• Link to malware
• Drive-by URL

On the reporting dashboard of the product, you can see how many users have experienced a simulation, how many have completed training after failing a phishing test, and even how many repeat ‘offenders’ are active in your organization.

Pros

• Part of the Microsoft 365 ecosystem
• Good reporting
• Multiple social engineering techniques to pick from

Cons

• Users mention that the training product isn’t up-to-par
• Users mention the product is expensive in comparison to other alternatives

Review

“The training modules seem solid, definitely not nearly as many as KnowBe4 or others, but what they have seems adequate. More expensive than competition, at least if evaluating strictly for phish testing & infosec training.” – Reddit

Simulation-first tools

Tools that do phishing simulation well but leave the training layer to you.

11. Phishingbox

Phishingbox may not come with a free trial, but it’s still not afraid of showing its platform. In the above video, you can get a clear idea of what you can do with their platform.

To set up a simulation in Phishingbox, you can pick from a wide variety of phishing templates in their library. The emails populate some variables, so that they are personalized to each individual user.

Phishingbox offers a lot of room for customization. For instance, you can decide which actions on the landing page are tracked (filling in data, clicking a sign in button, and so on).

When the user ‘fails’ a phishing simulation, they are forwarded to a training session. Again, this is a practice that is often advised against by educationalists, as it can be perceived as punishment.

Pros

• Large library of templates
• A lot of room for customizing the campaigns

Cons

• The UI looks a little outdated
• Training sessions after ‘failing’ a simulation may feel like a punishment

Review

“Straightforward product experience-more than enough to get the job done for SMBs. Say what you will about the effectiveness of Phishing Campaigns, but in many cases, these are required for cyber insurance and the like. The UI can be a little bit confusing, particularly around the campaign scheduling, but it’s certainly workable and I expect will continue to improve as the product matures.” – G2

12. uPhish (by usecure)

usecure is a well-known security awareness training platform with a special product for phishing: uPhish. With uPhish, you can set up phishing simulations and track when people have opened, an email, visited the link inside, and when their details have been compromised. You can also track if the user then reports the incident, which gives you a complete overview of your current vulnerabilities.

The UI of uPhish is clean and easy to work with. You can select from a wide variety of phishing templates, including landing pages, attachments, and a combination of the two.

Pros

• Large template library
• Easy-to-use platform
• Clean UI

Cons

• No free trial available
• The customization process can be somewhat time-consuming

Review

“The platform is very user-friendly and easy to navigate around. The loading times have also been quick for me. The lower level training exercises are sometimes too low level, and there could still be more information included.” – G2

13. Sophos Phish Threat

Sophos offers a combination of phishing simulations and security awareness training in one platform. The platform offers a free trial, so we signed up and took a look for ourselves.

You can set up a campaign by using one of the 500 phishing templates from Sophos’ library. There is a wide range of topics available, such as an email that contains an employee engagement service and an email about new parking rules. We like the specificity there. You can also customize these templates in order for them to suit your needs.

Aside from the phishing simulations, the platform enables you to train employees on recognizing phishing. It’s available in 10 languages and comes with some animated videos, as you can see in the video above.

Pros

• Comes with a free trial so you can try before you buy
• Combination of simulations and training
• Wide range of templates
• Offers a reporting button in Outlook

Cons

• The training is a little one-dimensional (only focuses on phishing)
• The video content feels long-winded and outdated

Review

“The ease of setting up phishing awareness campaigns, integrated Outlook “Report Message” button, and reports are the strong points of the product. Apparently, due to some legal challenges by Microsoft, Sophos removed all their campaigns designed to look like Microsoft phishing and credential harvesting attacks. This is unfortunate as many real-life attacks mimic a Microsoft user authentication experience and are very effective at tricking personnel into giving up their usernames and passwords.” – G2

Enterprise suites and managed services

Phishing simulation as a module inside a larger security stack, or fully outsourced.

14. Proofpoint

Proofpoint’s security awareness product is mostly focused on identifying high-risk individuals in organizations. They do this by evaluating roles, vulnerabilities, attack risk, and business priviliges.

They measure human risk based on the following aspects:

• Behavioral choices
• Threat context
• Roles and business privileges
• Skills and cultural attitudes
• Phishing/USB/SMS simulations based on real-world attacks

The platform does not come with a free trial and the pricing isn’t transparently communicated on the website. To see the product in action for yourself, you’ll have to contact their sales department.

Pros

• Shows human risk on an individual level
• Also offers SMS simulations (smishing)

Cons

• Mostly focused on enterprise organizations
• No transparent pricing
• No free trial

Review

“From an administrator perspective, is designed to “check a box” for compliance, rather than to actually educate your user base. The product is clunky and poorly integrated into the rest of Proofpoint’s platform/services.” – G2

15. Cofense PhishMe

Cofense’s phishing product is called PhishMe. A quote from their video: the phishing simulation program that transforms the hunted into the hunters. And with that, they mean your employees will be hunting for phishing emails. We appreciate the wit.

The platform offers a combination of three pillars:

• Security awareness training: a combination of simulations and remediative training
• Malicious email reporting: the ability to report an email from within your email client
• Risk validation: the ability to get insights into the risk profile of each individual employee

Pros

• Complete product with simulations and training
• In-depth reporting on individual performance
• A witty video script writer 😉

Cons

• Requires continuous upkeep
• Users get weary after the repetitive simulations
• Administering the training initiatives is often called time- and resource-consuming by users

Review

“Cofense PhishMe’s most beneficial feature is its capacity to enhance cybersecurity proactively. It achieves this through realistic, customizable phishing simulations that empower users to identify and counter phishing threats effectively. Drawbacks of Cofense PhishMe may encompass the requirement for continuous upkeep, potential user weariness due to repetitive phishing simulations, and the resource-intensive task of administering training initiatives.” – G2

16. Barracuda

Barracuda is well-known for being an email security product, which stops a big number of phishing emails from reaching your inbox in the first place. However, they have also built a security awareness product to compliment it.

With this product, you can simulate email threats, analyze user behavior, and choose from a large variety of training content to enable users to recognize phishing from afar.

Pros

• Interesting option if you’re also looking for a technical phishing blocking solution
• Wide variety of phishing templates

Cons

• Setting up training modules can be time-consuming
• Some users mention it is not as user-friendly

Review

“I feel in today’s environment phishing and spam protection is more critical than any endpoint protection. Users are the weakest link in cyber security and protection for any organization. Barracuda SAT fills the role for end user training and awareness of what to look for. It can be hard to manage and without Executive buy-in to force compliance it can be a waste of time. There are other products that are easier to use and manage.” – G2

17. Arctic Wolf

Arctic Wolf is similar to Barracuda, as it offers a wide security platform. Security awareness isn’t their main focus, but they do offer it as a product.

The security awareness product, which they call ‘Managed Security Awareness’, combines a training platform and a phishing simulator.

The training platform offers short micro-lessons that don’t take up to much of an employee’s time. Every month, new content is added to the platform, including so-called ‘rapid response training’ on emerging threats.

If a user ‘fails’ one of the phishing simulations, they are sent to a micro training session. Here, they learn about the importance of reporting a phishing email the next time. As we’ve stated before, this tactic is favored by some, but opposed by many educationalists for feeling like a punishment.

Pros

• A combined training and phishing simulation solution
• Interesting if you’re looking for an all-in-one security solution

Cons

• No free trial
• No transparent pricing on the website

Review

“The security awareness is short, to the point, yet effective. The trainings have led to discussions about the content and the relevancy to our organization, as well as some of the more amusing parts. Any trainings with the rep, and the training on MFA fatigue have been fan favorites.” – Gartner

What about KnowBe4, SoSafe and Awaretrain?

You might notice a few familiar names missing from this list. Platforms like KnowBe4, SoSafe and Awaretrain offer phishing simulations too, but as part of broader security awareness suites rather than as dedicated simulation tools. We reviewed what KnowBe4 does and where it falls short and compared the best KnowBe4 alternatives and best Awaretrain alternatives separately.

Free phishing simulation tools: what you get and what you don’t

If budget is the constraint, you have three realistic free routes:

• Gophish (open source). Free, self-hosted, full control over templates and landing pages. You need a server, a sending domain with correct SPF/DKIM, and someone to maintain it. No training content, no compliance reports, and you are responsible for GDPR (the click data is personal data).
• Microsoft Attack Simulation Training. Included if you already pay for Defender for Office 365 Plan 2 or Microsoft 365 E5. Good templates, basic training, reporting inside the Microsoft admin centre. Not free if you are on Business Standard or E3.
• Free tiers and trials. Wizer offers a free tier with limited simulations; Guardey offers a 14-day trial with simulations and training included, which is enough to run a baseline campaign for your whole team.

What free tools do not give you: automated follow-up training for the people who clicked, per-employee progress over time, and a report an auditor accepts. If NIS2 or ISO 27001 applies to you, that report is the reason you run simulations in the first place.

How to run your own phishing test in 5 steps

1. Set the goal and tell leadership. The goal is a baseline (how many click, how many report), not catching people. Get HR and the works council informed first; in several EU countries that is required.
2. Pick one realistic scenario. A package delivery, a shared document, an HR policy update. Avoid topics that cause anger (bonuses, layoffs); they generate backlash, not learning.
3. Whitelist the sending domain. Add the simulation tool’s sending IPs or domain to your mail filter, otherwise the test measures your spam filter instead of your employees.
4. Send in waves and measure two numbers. Click rate and report rate. The report rate is the one that matters: a company where 5% click but 60% report is safer than one where 2% click and nobody reports.
5. Follow up within minutes, without shaming. Whoever clicks lands on a short explanation, not a reprimand. Publish the team result, never individual names. Then repeat.

If you would rather not build this yourself, Guardey’s phishing simulations run these five steps automatically, including the follow-up training.

How often should you send phishing simulations?

The first simulation typically shows a click rate around 30%; most organizations get below 5% within a year of regular testing. “Regular” means:

• Monthly for the organization as a whole, at random days and times. Quarterly is too rare to change behaviour; weekly causes fatigue and complaints.
• Varied difficulty. Rotate easy, medium and targeted (spear-phishing) scenarios, otherwise employees learn to spot your template rather than phishing.
• Extra rounds for high-risk roles. Finance, HR, executive assistants and IT receive targeted simulations every four to six weeks.
• Combine with training. Simulations measure; they do not teach. The organizations that get to low click rates fastest pair monthly simulations with short weekly training.

Which phishing simulation software should you choose?

Most of the tools above do one thing well: they send a fake email and tell you who clicked. That is useful once. It does not change who clicks next time. Choose Guardey if you want the simulation and the training in one place:

• You want behaviour to change, not just a click rate. Every click is followed by a short training moment, and weekly gamified challenges keep the lesson alive between simulations.
• You have no dedicated security team. Your first simulation runs within the hour. No project, no consultant, no lead time.
• You already run Microsoft 365 or another security stack. Guardey works alongside it and covers the human side those tools leave out.
• You need to show an auditor. The reports work for NIS2, ISO 27001, IBP and most other frameworks.
• You want to see it first. Book a demo and we’ll walk you through the simulation and the training in 45 minutes.

Frequently asked questions

What is phishing simulation software?

Software that sends realistic but harmless phishing emails (and sometimes SMS, voice or QR codes) to your own employees, records who clicks, enters data or reports the message, and follows up with training.

Is phishing simulation legal under the GDPR?

Yes, if you have a legitimate interest (security), inform employees that simulations are part of the security program, limit the data you keep and never use results for disciplinary action. Involve the works council where required (Germany, Netherlands, Belgium).

What is a good phishing click rate?

Below 5% with a report rate above 50% is a healthy organization. The first simulation in an untrained organization usually lands between 20% and 35%.

Phishing simulation software vs phishing simulation tool: is there a difference?

In practice no. “Tool” is used more for simulation-only products (Gophish, PhishingBox); “software” or “platform” for products that include training and reporting.