License & Deployment Mix: 17 tools – 2 OSS, 14 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is Security Awareness Training?
Security Awareness Training (SAT) platforms combine phishing simulation, security training content delivery, compliance reporting, human risk scoring, and regulatory training into a unified program that addresses the human element of cybersecurity. SAT trains employees to recognize and respond to social engineering, phishing, and other human-targeted attacks – the attack vectors that bypass technical controls entirely.
Organizations invest in firewalls, EDR, email gateways, and access controls, but attackers consistently find that humans are the weakest link. A single employee clicking a phishing link or entering credentials on a spoofed page can compromise an entire environment. SAT platforms create a continuous training loop: simulate attacks, measure susceptibility, deliver targeted training, and track improvement over time.
Enterprise SAT platforms provide:
- Phishing simulation – simulated phishing campaigns with click tracking, credential harvest detection, and reporting rate measurement; campaigns test employee resilience against realistic attack scenarios without actual risk
- Training content libraries – video modules, interactive courses, micro-learning segments, and gamified lessons covering security topics from password hygiene to social engineering recognition
- Learning paths – role-based, risk-based, and compliance-driven training sequences that adapt content to the employee’s function, risk profile, and regulatory requirements
- Compliance tracking – regulatory framework mapping (HIPAA, PCI DSS, SOX, GDPR, CMMC), completion tracking per employee, and audit-ready reports for compliance evidence
- Human risk scoring – per-user risk assessment based on phishing simulation performance, training completion rates, reporting behavior, and incident history; identifies highest-risk employees for targeted intervention
- Reporting and analytics – executive dashboards, trend analysis over time, department and role comparisons, industry benchmarking, and campaign effectiveness metrics
- Gamification – leaderboards, badges, points, and team competitions that increase engagement with training content and encourage positive security behaviors
- Multi-language support – global workforce training delivered in native languages; phishing simulations localized for regional relevance; critical for multinational organizations
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
This evaluation covers phishing simulation, training content delivery, and compliance reporting tools.
SSO / OIDC Comparison
OIDC is the preferred SSO protocol; the notes below assume Authentik as the IdP.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| Gophish | No | No | No | No native SSO; CLI/web UI without built-in auth provider; use reverse proxy with Authentik for SSO |
| Lucy Security | No | Yes | No | SAML SSO in commercial editions; no OIDC; Authentik as SAML IdP |
| King Phisher | No | No | No | No native SSO; GTK desktop client; no web-based admin |
| KnowBe4 | No | Yes | Yes | SAML SSO; SCIM directory sync; no native OIDC; Authentik as SAML IdP |
| Proofpoint SA | Yes | Yes | Yes | Native OIDC and SAML; SCIM provisioning; Authentik as IdP |
| Cofense | No | Yes | No | SAML SSO; no OIDC; no SCIM; Authentik as SAML IdP |
| Hoxhunt | Yes | Yes | Yes | Native OIDC and SAML; SCIM directory sync; Authentik as IdP |
| Arctic Wolf SA | No | Yes | No | SAML SSO via Arctic Wolf portal; no OIDC; managed service model |
| Curricula | No | Yes | No | SAML SSO; no OIDC; no SCIM; Authentik as SAML IdP |
| Infosec IQ | No | Yes | Yes | SAML SSO; SCIM provisioning; no native OIDC; Authentik as SAML IdP |
| Mimecast SA | No | Yes | No | SAML SSO via Mimecast console; no OIDC; Authentik as SAML IdP |
| Barracuda SA | No | Yes | No | SAML SSO; no OIDC; no SCIM; Authentik as SAML IdP |
| Terranova Security | No | Yes | Yes | SAML SSO; SCIM directory sync; no OIDC; Authentik as SAML IdP |
| NINJIO | No | Yes | No | SAML SSO; no OIDC; no SCIM; Authentik as SAML IdP |
| SoSafe | Yes | Yes | Yes | Native OIDC and SAML; SCIM provisioning; Authentik as IdP |
| usecure | No | Yes | No | SAML SSO; no OIDC; no SCIM; Authentik as SAML IdP |
| Hook Security | No | Yes | No | SAML SSO; no OIDC; no SCIM; Authentik as SAML IdP |
Best SSO support: Proofpoint SA (OIDC, SAML, SCIM), Hoxhunt (OIDC, SAML, SCIM), SoSafe (OIDC, SAML, SCIM)
No SSO: Gophish (reverse proxy needed), King Phisher (desktop client)
API Comparison
| Tool | API Type | Auth | Webhooks | SDKs |
|---|---|---|---|---|
| Gophish | REST | API key | No | Go (native), Python (community) |
| Lucy Security | REST | API key, Bearer | No | None official |
| King Phisher | RPC (limited) | Session-based | No | Python (built-in) |
| KnowBe4 | REST | Bearer token | Yes (event hooks) | Python (community), PowerShell |
| Proofpoint SA | REST | OAuth2, API key | Yes (webhooks) | Python (official) |
| Cofense | REST | API token | Yes (webhooks) | None official |
| Hoxhunt | REST + GraphQL | OAuth2, API key | Yes (webhooks) | Python (community) |
| Arctic Wolf SA | REST (limited) | API key | No (managed service) | None official |
| Curricula | REST | API key | No | None official |
| Infosec IQ | REST | API key | Yes (webhooks) | None official |
| Mimecast SA | REST | OAuth2, API key | Yes (webhooks) | Python (official) |
| Barracuda SA | REST | API token | Yes (webhooks) | None official |
| Terranova Security | REST | API key | No | None official |
| NINJIO | REST | API key | No | None official |
| SoSafe | REST | OAuth2, API key | Yes (webhooks) | None official |
| usecure | REST | API key | Yes (webhooks) | None official |
| Hook Security | REST | API key | No | None official |
Phishing Simulation Features
| Tool | Templates | Landing Pages | Credential Tracking | Reporting Rates | Attachment Sim | QR Phishing | Smishing |
|---|---|---|---|---|---|---|---|
| Gophish | Yes (custom + community) | Yes (WYSIWYG editor) | Yes (captured credentials) | Yes (click/submit rates) | No | No | No |
| Lucy Security | Yes (500+ templates) | Yes (built-in editor) | Yes | Yes | Yes | No | Yes (SMS) |
| King Phisher | Yes (basic templates) | Yes (Jinja2 templates) | Yes (basic tracking) | Yes (click rates) | No | No | No |
| KnowBe4 | Yes (13,000+ templates) | Yes (managed) | Yes (full credential capture) | Yes (Phish-prone %) | Yes | Yes | Yes (SMS + voice) |
| Proofpoint SA | Yes (2,000+ templates) | Yes (managed) | Yes | Yes (ThreatSim metrics) | Yes | Yes | Yes (SMS) |
| Cofense | Yes (1,500+ templates) | Yes (managed) | Yes | Yes (PhishMe metrics) | Yes | Yes | No |
| Hoxhunt | Yes (AI-generated) | Yes (auto-generated) | Yes | Yes (engagement rates) | Yes | Yes | Yes (SMS) |
| Arctic Wolf SA | Yes (managed templates) | Yes (managed) | Yes (managed) | Yes (managed reports) | Yes | No | No |
| Curricula | Yes (story-based) | Yes (managed) | Yes | Yes | Yes | No | No |
| Infosec IQ | Yes (1,000+ templates) | Yes (managed) | Yes | Yes (PhishNotify) | Yes | Yes | Yes (SMS) |
| Mimecast SA | Yes (managed templates) | Yes (managed) | Yes | Yes | Yes | No | No |
| Barracuda SA | Yes (managed templates) | Yes (managed) | Yes | Yes | Yes | No | No |
| Terranova Security | Yes (managed templates) | Yes (managed) | Yes | Yes | Yes | Yes | Yes (SMS) |
| NINJIO | Yes (story-based) | Yes (managed) | Yes | Yes | No | No | No |
| SoSafe | Yes (AI-driven templates) | Yes (managed) | Yes | Yes (behavioral metrics) | Yes | Yes | Yes (SMS) |
| usecure | Yes (managed templates) | Yes (managed) | Yes | Yes | Yes | No | No |
| Hook Security | Yes (managed templates) | Yes (managed) | Yes | Yes | No | No | No |
Most phishing features: KnowBe4 (largest template library + QR + smishing + voice), Proofpoint SA, Hoxhunt, SoSafe
OSS phishing leaders: Gophish (full-featured phishing simulation, custom templates, credential tracking)
Training Content & Delivery
| Tool | Content Library | Video Training | Interactive Modules | Micro-Learning | Multi-Language | Custom Content | Gamification |
|---|---|---|---|---|---|---|---|
| Gophish | No (phishing sim only) | No | No | No | No | No | No |
| Lucy Security | Limited (free tier) | Yes (basic) | Yes (quizzes) | No | Yes (10+ languages) | Yes (upload) | No |
| King Phisher | No (phishing sim only) | No | No | No | No | No | No |
| KnowBe4 | Yes (1,000+ modules) | Yes (Kevin Mitnick library) | Yes (interactive games) | Yes (5-min modules) | Yes (35+ languages) | Yes (SCORM upload) | Yes (leaderboards, badges) |
| Proofpoint SA | Yes (300+ modules) | Yes (video series) | Yes (interactive) | Yes (short modules) | Yes (40+ languages) | Yes (SCORM upload) | Yes (badges) |
| Cofense | Yes (200+ modules) | Yes (video training) | Yes (interactive) | Yes (micro-learning) | Yes (30+ languages) | Yes (SCORM upload) | No |
| Hoxhunt | Yes (adaptive library) | Yes (AI-curated) | Yes (interactive paths) | Yes (continuous micro) | Yes (30+ languages) | Yes (custom paths) | Yes (points, leaderboards) |
| Arctic Wolf SA | Yes (managed library) | Yes (video content) | Yes (quizzes) | Yes (short modules) | Yes (10+ languages) | No | No |
| Curricula | Yes (story-driven) | Yes (animated stories) | Yes (episode-based) | Yes (micro-episodes) | Yes (15+ languages) | No | Yes (gamified stories) |
| Infosec IQ | Yes (700+ modules) | Yes (video training) | Yes (interactive) | Yes (AwareEd micro) | Yes (30+ languages) | Yes (SCORM upload) | Yes (leaderboards) |
| Mimecast SA | Yes (managed library) | Yes (video training) | Yes (interactive) | Yes (short modules) | Yes (20+ languages) | Yes (custom content) | No |
| Barracuda SA | Yes (managed library) | Yes (video training) | Yes (interactive) | Yes (short modules) | Yes (15+ languages) | No | No |
| Terranova Security | Yes (500+ modules) | Yes (video training) | Yes (interactive) | Yes (nano-learning) | Yes (40+ languages) | Yes (SCORM upload) | Yes (badges) |
| NINJIO | Yes (story-based) | Yes (Hollywood-style) | No | Yes (3-4 min episodes) | Yes (15+ languages) | No | No |
| SoSafe | Yes (adaptive library) | Yes (video content) | Yes (interactive) | Yes (behavioral nudges) | Yes (30+ languages) | Yes (custom modules) | Yes (gamification engine) |
| usecure | Yes (managed library) | Yes (video training) | Yes (interactive) | Yes (micro-courses) | Yes (15+ languages) | No | No |
| Hook Security | Yes (managed library) | Yes (video training) | Yes (interactive) | Yes (short modules) | Yes (10+ languages) | No | No |
Largest content library: KnowBe4 (1,000+ modules, 35+ languages, gamification)
No training content: Gophish (phishing sim only), King Phisher (phishing sim only)
Compliance & Reporting
| Tool | Frameworks | Auto Reporting | Human Risk Score | Benchmarking | Executive Dashboards |
|---|---|---|---|---|---|
| Gophish | None | No (manual CSV export) | No | No | No (basic campaign stats) |
| Lucy Security | GDPR, PCI DSS | Yes (scheduled) | No | No | Yes (basic) |
| King Phisher | None | No (manual export) | No | No | No |
| KnowBe4 | HIPAA, PCI DSS, SOX, GDPR, NIST, ISO 27001, CMMC, FERPA | Yes (automated) | Yes (Risk Score) | Yes (industry benchmarks) | Yes (board-level reports) |
| Proofpoint SA | HIPAA, PCI DSS, GDPR, NIST, SOX, ISO 27001 | Yes (automated) | Yes (CHRO Score) | Yes (industry benchmarks) | Yes (executive dashboards) |
| Cofense | HIPAA, PCI DSS, GDPR, NIST | Yes (automated) | Yes (resilience score) | Yes (peer benchmarks) | Yes (executive reports) |
| Hoxhunt | HIPAA, PCI DSS, GDPR, NIST, ISO 27001 | Yes (automated) | Yes (behavior score) | Yes (global benchmarks) | Yes (real-time dashboards) |
| Arctic Wolf SA | HIPAA, PCI DSS, GDPR, NIST | Yes (managed) | Yes (managed) | No | Yes (managed reports) |
| Curricula | HIPAA, PCI DSS, GDPR | Yes (automated) | No | No | Yes (basic dashboards) |
| Infosec IQ | HIPAA, PCI DSS, GDPR, NIST, SOX | Yes (automated) | Yes (learner risk) | Yes (benchmarks) | Yes (executive dashboards) |
| Mimecast SA | HIPAA, PCI DSS, GDPR | Yes (automated) | Yes (risk score) | No | Yes (dashboards) |
| Barracuda SA | HIPAA, PCI DSS, GDPR | Yes (automated) | Yes (risk score) | No | Yes (basic dashboards) |
| Terranova Security | HIPAA, PCI DSS, GDPR, NIST, ISO 27001, SOX | Yes (automated) | Yes (cyber risk score) | Yes (global benchmarks) | Yes (executive reports) |
| NINJIO | HIPAA, PCI DSS, GDPR | Yes (automated) | Yes (NINJIO Risk Score) | No | Yes (dashboards) |
| SoSafe | HIPAA, PCI DSS, GDPR, NIST, ISO 27001 | Yes (automated) | Yes (Human Risk OS) | Yes (industry benchmarks) | Yes (real-time dashboards) |
| usecure | HIPAA, PCI DSS, GDPR | Yes (automated) | Yes (risk score) | No | Yes (MSP dashboards) |
| Hook Security | HIPAA, PCI DSS, GDPR | Yes (automated) | No | No | Yes (basic dashboards) |
Most compliance frameworks: KnowBe4 (HIPAA, PCI DSS, SOX, GDPR, NIST, ISO 27001, CMMC, FERPA)
No compliance reporting: Gophish (manual CSV export only), King Phisher (manual export only)
Multi-Tenant / MSP Features
| Tool | Tenant Isolation | Unified Dashboard | Per-Customer Campaigns | White-Label |
|---|---|---|---|---|
| Gophish | No (single instance) | No | No (one campaign set per instance) | No |
| Lucy Security | Yes (multi-tenant) | Yes (admin console) | Yes (per-tenant campaigns) | Yes (commercial) |
| King Phisher | No (single instance) | No | No | No |
| KnowBe4 | Yes (partner program) | Yes (partner console) | Yes (per-customer campaigns) | Yes (partner branding) |
| Proofpoint SA | Yes (multi-tenant) | Yes (admin console) | Yes (per-tenant campaigns) | No |
| Cofense | Yes (multi-tenant) | Yes (admin console) | Yes (per-tenant campaigns) | No |
| Hoxhunt | Yes (multi-org) | Yes (admin console) | Yes (per-org campaigns) | No |
| Arctic Wolf SA | Yes (managed per-customer) | Yes (partner portal) | Yes (managed per-customer) | No |
| Curricula | Yes (multi-tenant) | Yes (admin console) | Yes (per-tenant) | No |
| Infosec IQ | Yes (multi-tenant) | Yes (admin console) | Yes (per-tenant campaigns) | No |
| Mimecast SA | Yes (multi-tenant) | Yes (admin console) | Yes (per-tenant campaigns) | No |
| Barracuda SA | Yes (MSP console) | Yes (MSP dashboard) | Yes (per-customer) | Yes (MSP branding) |
| Terranova Security | Yes (multi-tenant) | Yes (admin console) | Yes (per-tenant campaigns) | No |
| NINJIO | Yes (multi-tenant) | Yes (admin console) | Yes (per-tenant) | No |
| SoSafe | Yes (multi-org) | Yes (admin console) | Yes (per-org campaigns) | No |
| usecure | Yes (MSP-native) | Yes (MSP dashboard) | Yes (per-customer campaigns) | Yes (full white-label) |
| Hook Security | Yes (multi-tenant) | Yes (admin console) | Yes (per-tenant) | No |
Best MSP support: usecure (purpose-built for MSPs, full white-label), KnowBe4 (partner program), Barracuda SA (MSP branding)
No multi-tenant: Gophish (single instance), King Phisher (single instance)
Deployment and Licensing
| Tool | License | Self-Hosted | Language | Database | Docker | Cloud Console |
|---|---|---|---|---|---|---|
| Gophish | MIT | Yes | Go | SQLite, MySQL, PostgreSQL | Yes | No |
| Lucy Security | Proprietary (free tier) | Yes | – | PostgreSQL | Limited | Yes (Lucy Cloud) |
| King Phisher | BSD-3-Clause | Yes | Python | PostgreSQL | Yes (community) | No |
| KnowBe4 | Proprietary | No (SaaS only) | – | – | – | Yes (KnowBe4 Console) |
| Proofpoint SA | Proprietary | No (SaaS only) | – | – | – | Yes (Proofpoint Console) |
| Cofense | Proprietary | Partial (PhishMe on-prem) | – | – | No | Yes (Cofense Cloud) |
| Hoxhunt | Proprietary | No (SaaS only) | – | – | – | Yes (Hoxhunt Console) |
| Arctic Wolf SA | Proprietary | No (managed service) | – | – | – | Yes (Arctic Wolf Portal) |
| Curricula | Proprietary | No (SaaS only) | – | – | – | Yes (Curricula Console) |
| Infosec IQ | Proprietary | No (SaaS only) | – | – | – | Yes (Infosec IQ Console) |
| Mimecast SA | Proprietary | No (SaaS only) | – | – | – | Yes (Mimecast Console) |
| Barracuda SA | Proprietary | No (SaaS only) | – | – | – | Yes (Barracuda Console) |
| Terranova Security | Proprietary | No (SaaS only) | – | – | – | Yes (Terranova Console) |
| NINJIO | Proprietary | No (SaaS only) | – | – | – | Yes (NINJIO Console) |
| SoSafe | Proprietary | No (SaaS only) | – | – | – | Yes (SoSafe Console) |
| usecure | Proprietary | No (SaaS only) | – | – | – | Yes (usecure Console) |
| Hook Security | Proprietary | No (SaaS only) | – | – | – | Yes (Hook Console) |
Self-hosted OSS: Gophish (MIT), King Phisher (BSD-3-Clause)
Self-hosted with free tier: Lucy Security (proprietary with free community edition)
Note: King Phisher is archived and no longer actively maintained; not recommended for new deployments
Tools
17 tools.
Arctic Wolf Security Awareness
Arctic Wolf Managed Security Awareness is part of the Arctic Wolf managed security platform. Cross-reference: Arctic Wolf’s MDR/XDR capabilities are documented in edr-xdr/arctic-wolf.md.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Barracuda Security Awareness Training
Barracuda Security Awareness Training (formerly PhishLine, acquired by Barracuda in 2018) is a phishing simulation and security awareness platform integrated with Barracuda’s email security and network protection products.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Cofense (PhishMe)
Cofense (formerly PhishMe until 2018 rebrand) pioneered the phishing simulation industry and remains one of the top dedicated anti-phishing platforms.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Curricula
Curricula is a security awareness training platform that differentiates through fun, story-driven training content.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Gophish
Gophish is the leading open-source phishing simulation framework. Created by Jordan Wright, it provides a complete platform for launching simulated phishing campaigns, tracking user interactions, and generating reports.
License: MIT (OSS) · Kind: web · Deploy: native, docker · SSO: none
Hook Security
Hook Security is a security awareness training platform that emphasizes psychological safety and positive reinforcement rather than punitive “gotcha” phishing tests.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Hoxhunt
Hoxhunt is a gamified, AI-driven security awareness training platform that uses adaptive learning and behavioral science to train employees.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
Infosec IQ (Cengage)
Infosec IQ is the security awareness training and phishing simulation platform from Infosec Institute (now part of Cengage Group).
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
King Phisher
King Phisher is an open-source phishing campaign toolkit with a client-server architecture. The server runs on Linux and the client uses a GTK desktop application rather than a web-based interface.
License: BSD-3-Clause (OSS) · Kind: web · Deploy: native · SSO: none
KnowBe4
KnowBe4 is the world’s largest security awareness training and simulated phishing platform, founded by Stu Sjouwerman and the late Kevin Mitnick (who served as Chief Hacking Officer until his passing in 2023).
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Lucy Security
Lucy Security (now ThriveDX Lucy) is a Swiss-developed security awareness training platform that offers a free community edition alongside commercial tiers.
License: Proprietary (proprietary) · Kind: web · Deploy: native, docker, appliance · SSO: none
Mimecast Awareness Training
Mimecast Awareness Training is the security awareness component of the Mimecast email security and cyber resilience platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
NINJIO
NINJIO takes a unique approach to security awareness training: Hollywood-quality animated video episodes (3–4 minutes each) based on real-world social engineering attacks.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Proofpoint Security Awareness
Proofpoint Security Awareness Training (PSAT) is part of the Proofpoint Threat Protection platform, one of the leading enterprise email security suites.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
SoSafe
SoSafe is a European security awareness training platform from Cologne, Germany, offering behavioral-science-based phishing simulation, e-learning, and a Human Risk Index, with a strong GDPR and NIS2 focus.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
Terranova Security (Fortra)
Terranova Security (acquired by Fortra, formerly HelpSystems, in 2021) is a comprehensive security awareness training platform with one of the broadest content libraries in the market.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
usecure
usecure is a security awareness training platform purpose-built for Managed Service Providers (MSPs).
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
