What is Phished? Features, reviews and alternatives (2026)

In brief: Phished is a Belgian security awareness vendor from Leuven, not to be confused with the everyday word for falling for a phishing email. The platform (phished.io) automates phishing simulations with AI, trains employees through the Phished Academy, scores risk per person with the Behavioral Risk Score and now also sells zero-trust email protection under the name Zero Incident Mail. According to its own site, Phished trains two million users in 7,100 organisations together with more than 400 partners. Reviewers give it 4.5 out of 5 on G2 (164 reviews) and praise the automation and ease of use. The criticism is about reporting depth, the fixed pace of the training sessions and uneven language coverage.

Phished at a glance

What Phished does

Phished started as a tool that sends phishing simulations without an administrator having to plan them. That is still the heart of the product, but the company now describes itself as an AI-native security awareness platform with zero trust at its core. In practice there are six parts:

• Adaptive phishing simulations. You configure the platform once. After that, AI agents plan, write, send and follow up the simulations, with difficulty, timing and scenario adjusted per employee. Phished sends them on a recurring schedule, for example every two weeks, and not only by email: the simulation page lists Teams and Slack, SMS and WhatsApp, QR codes and voice or video calls. Whoever clicks lands on a short lesson that shows the clues they missed.
• Phished Academy. Training in levels of 10 to 15 sessions, each taking about 5 to 10 minutes, with questions, storytelling and video. Employees earn certificates from Bronze to Platinum. Topics run from the basics to NIS2, GDPR, ISO 27001, DORA and AI.
• Phished Assistant and automated incident response. An assistant in Outlook, Gmail and the browser that employees use when they doubt a link, attachment or QR code. The item is opened in an isolated environment, AI gives a verdict in the employee’s own language and the IT team sees the case logged and resolved.
• Behavioral Risk Score. A score per person, per team and for the whole organisation, fed by simulation results, reported emails, training status, Assistant verdicts, unsecured apps and devices, and whether people read threat alerts. It is benchmarked against national and global averages.
• Zero Incident Mail. Email protection that isolates unknown messages automatically. If someone still clicks a malicious link, the threat stays contained and away from devices and internal systems.
• Threat alerts. Short, timely articles from Phished’s own team about new scams and attack methods.

The platform integrates with Microsoft 365, Google Workspace, SIEM and SOAR tools. Phished states it is ISO 27001 certified and SOC 2 audited, and that setup takes one to two hours. G2 reviewers report an average time to implement of one month.

Who is behind Phished

According to the company’s own press release, Arnout Van de Meulebroucke came up with the idea in 2019 and serial entrepreneur Jo Vandebergh put in €1 million to launch it, followed by roughly €8 million more in phases. Vandebergh took over as CEO in 2022; Van de Meulebroucke became CTO. On 2 May 2024 Phished announced a €7.5 million convertible bond from the Flemish investment fund Welvaartsfonds, available over four years. At that point the company counted 50 employees, 2,500 business customers and 200 MSP partners, and set itself the goal of more than €20 million in annual recurring revenue by 2027.

Phished is privately held. We found no announcement of an acquisition or a new funding round between May 2024 and November 2026. What did change is the reach: the number of partners on the site has doubled to more than 400.

Phished pricing and plans

The pricing page shows three plans. Core contains the AI-driven simulations, a report button, microlearnings, threat alerts and the administrator dashboard. Advanced adds repeat offender training, Zero Incident Mail, the user certificates and cyber hygiene for apps and devices. All-in-One adds training on specific topics such as NIST, GDPR and NIS2, custom training you build yourself, the Behavioral Risk Score, in-depth reporting including custom Power BI and a management platform for international groups. Each plan leads to a request form, after which you receive a quote for your number of users in euros, pounds or dollars.

Two practical points when you compare offers. First, check which plan holds the features you read about: the Behavioral Risk Score sits in All-in-One, Zero Incident Mail starts at Advanced. Second, ask whether you buy from Phished or from a partner, since an MSP may bundle the licence with its own services and support.

What users say about Phished

We read the reviews on G2, Gartner Peer Insights and Capterra on 5 November 2026. The scores: G2 4.5 out of 5 from 164 reviews, Gartner Peer Insights 4.4 from 37 ratings, Capterra 4.6 from 27 reviews. The pattern across the three sites:

• Praise: the automation comes first. Reviewers describe a platform you set up once and that then keeps sending simulations and training without reminders in the admin’s calendar. Ease of use is the most mentioned plus on G2 (29 mentions), followed by realistic simulations, a visible rise in awareness and a team that picks up feedback.
• Criticism: reporting (6 mentions on G2, and Capterra reviewers who want more drill-down in the dashboard), the pace of the Academy (one reviewer does not want to wait 21 days for the next session, another saw attention fade once all levels were completed), uncertainty about how the Behavioral Risk Score is calculated, the number of reminder emails, and language coverage. One small-business reviewer found the interface clunky and the integration with Google Workspace and Okta slow to set up.

The independent review by Expert Insights, updated on 22 September 2026, gives Phished an editor’s score of 4.5. It commends the self-learning campaigns and the quick deployment, and notes that the amount of training content, video in particular, is smaller than at some competitors and that most material is available in Dutch and English. Phished itself lists 32 Academy languages, so ask for the content list in your own languages.

Where Phished is strong

• Simulations that run themselves. For an IT manager who wants continuous phishing tests without building campaigns, this is one of the most automated options on the market.
• The partner model. With more than 400 partners and licence management built for MSPs, Phished fits service providers who run awareness for many customers.
• Less phishing triage. The Assistant, automated incident response and Zero Incident Mail aim at the work that lands on the security team after an employee reports an email. Few awareness vendors go that far into email security.

Where Phished falls short

• Breadth of training. Phishing is covered thoroughly. For topics beyond it, reviewers and Expert Insights find the library thinner than that of the large content vendors.
• Rhythm and motivation. Sessions arrive on the platform’s schedule, weeks apart, and the reward is a certificate. Teams that want a short weekly moment and competition between colleagues will miss that.
• Reporting for the board or auditor. The data is there, but several reviewers ask for more flexible dashboards and reports to share with management.

Phished alternatives

The trial column shows what each vendor offered on its own website on 5 November 2026. For a wider field, see our overview of the best security awareness training software.

Phished vs Guardey: the short version

Both are European, both include phishing simulations and both deliver reports for NIS2 and ISO 27001. The difference is where the weight lies. Phished is built around automated simulations and, increasingly, around protecting the mailbox itself. Guardey is built around one habit: every employee plays a gamified challenge of about three minutes each week and competes with colleagues on a leaderboard, with simulations included and no features locked behind add-ons. If phishing tests and email isolation are your priority, Phished is a strong candidate. If you want people to keep learning about every topic, week after week, start with Guardey. The detailed comparison, feature by feature, is on our Phished vs Guardey page.

Frequently asked questions

What is Phished used for?

Security awareness: automated phishing simulations, training through the Phished Academy, a risk score per employee and, in the higher plans, email isolation with Zero Incident Mail. The goal is fewer incidents caused by human error.

Is Phished a Belgian company?

Yes. Phished is based on the Bondgenotenlaan in Leuven, is privately held and is backed by its CEO Jo Vandebergh and, since May 2024, by a €7.5 million convertible bond from the Flemish fund Welvaartsfonds.

How much does Phished cost?

Phished sells three plans, Core, Advanced and All-in-One, and quotes a price for your number of users after a request through the pricing page or a partner. The plan determines whether features such as Zero Incident Mail and the Behavioral Risk Score are included.

Does Phished offer a free trial?

The website offers a demo, which Phished says it can show in your own environment. A self-service trial is not listed there.

What is the best alternative to Phished?

For most organisations Guardey: weekly three-minute training, team competition, phishing simulations included and a 14-day free trial. For enterprises with their own security team, Hoxhunt, SoSafe and KnowBe4 are the usual alternatives.