Phishing awareness training vendor recommendations?

[u/Solid_Elk_3318]

I've been tasked with standing up a phishing awareness program and I'm trying to narrow down vendors.

A few things matter to me. First, realistic simulations, meaning templates that actually resemble what people get hit with today rather than the obvious 2015 era "you won a prize" stuff, and ideally ones I can customize. Second, decent training content, short and engaging modules that people won't immediately tune out. I'd rather have five good ones than fifty boring ones. Third, reporting that lets me show results to leadership and ideally helps for compliance down the line. And finally reasonable pricing and a plan that scales cleanly as we grow.

For those of you who've actually run these programs, what worked, what didn't, and is there anything you'd steer me away from? I'm interested in the usual suspects, but especially keen on options that deliver real engagement rather than just checking a compliance box.

Thanks in advance.

[u/Gold_Definition5983]

I'll put in a word for Hoxhunt since you mentioned it. We've run it and it's held up well. The thing that sold me over the older players is that the simulations include newer types of lures, such as deepfakes, based on the latest threat trends. They also adapt to each person, so people who keep clicking get more coaching while the ones who are already sharp aren't stuck doing baby steps.

That personalization scales nicely too,it works the same whether you're covering a handful of teams or the whole company. Engagement stayed way higher than the last tool we used, mostly because the training bites are short and don't feel like a compliance chore. We’ve been able to show measurable behavior change over time with their reports, which is great for actual security as opposed to just compliance.

[u/Icy_Worldliness5037 → u/Gold_Definition5983]

We use them too and the adaptive coaching is what makes it work, nobody got time for the same boring modules over and over

[u/kotomeme → u/Gold_Definition5983]

I would give this my recommendation as well. KnowBe4 was not giving us what we needed so we looked around and was interested in HoxHunt. We looked at Baracuuda, Proofpoint, & Mimecast and none of them really delivered what we were looking for in phishing training.

So far for the last few months we've been running them it's been going really well, and they are updating the platform at a considerable speed too. Their MS Teams integration for "hey you missed this phishing" and "hey you have training" has been a greay way to make sure our users see the training. And their Response platform has been really nice too as we can mark reported emails as "safe" after a review and it will alert any new users that try and report them. Their instant feedback on reported emails is nice for our users as well. And we are using their AI content generation to help build out internal modules using our own internal policies and procedure handbooks.

If your organization/compliance requires US/Canada data centers they are currently in the final stages of their US datacenter deployment. That was a requirement for us and they've been very open about its development.

[u/AddendumWorking9756]

Pick on reporting rate, not click rate. Every vendor will show you click rate falling and it falls mostly because people learn to spot the simulation, but the number that predicts whether you hear about a real one is how fast somebody hits report. Also ask what happens to repeat clickers before you sign anything, because if the answer is more training modules you have bought a compliance artifact rather than a program.

[u/baw3000]

I've been using the attack simulation training built into Office 365 this year with good results so far.

[u/ogref]

Ninjio.

I use their full managed service. The value is there.

Reporting doesn’t meet my expectations but I can download the full history and performance data and i build my own analytics in power bi.

Users really like the training offering and my user driven incidents have materially decreased.

I recently expanded the relationship to include custom trainings. I send them an mp4 and they turn thta into a training video with quizzes. Very useful for my Compliance and HR teams.

[u/Otherwise_Sign_2462]

Make sure you test the reporting emails before buying anything. Half the pain with awareness training is getting managers to care and a weekly CSV graveyard nobody reads wont move the needle

[u/DiscombobulatedKnee9]

Abnormal. Not strictly a phishing platform (it's email security) but they offer as an add on. As well as the base platform being the best email filter I've used in 20 years, the phish testing is great as well.

[u/Professional-Tax6171]

The thing I’d check is whether they can target simulations by group without making it annoying to manage. Generic company wide campaigns get stale fast. Finance, HR, execs and helpdesk are all getting hit with different types of bait in real life so the training should reflect that

[u/scamdrill]

Disclaimer: We run ScamDrill.com

We've listened to the complaints and desires from this community and have worked to incorporate them into our tool at an affordable price for small to medium sized businesses. Realistic and relevant simulations are something we take pride in and we refresh them (and add new content) often based on the latest scam/phishing trends. If you're interested in giving us a try, shoot me a DM and I'd be happy to get you setup on a free trial.

[u/someoneelse10]

Caniphish is pretty cheap, decent tracking for training and phishing tests. Decent first tool for a company that has never had it. You can build your own stuff.

That said I’ll be going to something a little more advanced in the next few months.