Hackiwi

Hackiwi is a security platform that combines staff education, simulated phishing, message reporting and external-exposure monitoring. It is best suited to organisations that want these functions in one system, particularly smaller teams. Its free access is unusually broad, but simulation eligibility and the 20-user threshold matter when planning adoption.

Overview

Hackiwi covers preventive and responsive security work in a single platform. Teams can teach users, assign learning paths, measure reactions to simulated attacks, triage suspicious mail and monitor internet-facing risks. That combination is practical for an organisation that would otherwise coordinate several narrowly focused services.

The public training library can be browsed without an account, and its material is released under the CC-BY-4.0 licence. Organisations that need control over deployment can run the AGPL-3.0 code on their own infrastructure. Self-hosting is therefore a meaningful option for teams with the operational capacity to manage their own installation.

Key features

Training and phishing simulations

Video and written modules include interactive knowledge checks. Administrators can assign learning paths, track completion and use automated training, making the platform more suitable for structured programmes than for an uncurated reading library. SSO support is also available for organisations that need centralised sign-in.

Phishing campaigns measure opens, clicks and reports. Campaigns are sent only to verified domains and include safety gates and audit logging, which supports accountable testing but adds an eligibility step. Individuals and families cannot use the simulator. Submitted credentials are not retained; Hackiwi records the event instead, reducing the risk of turning an exercise into a credential store.

Reporting and exposure monitoring

Users can forward suspicious messages from any mail client on a desktop or phone. Hackiwi says reports receive automated classification and reputation checks, giving teams a faster initial triage path than relying entirely on manual review.

Exposure tooling is broad: scope-locked OSINT, website scanning, dependency CVE tracking, domain monitoring and alerts for newly registered lookalike domains. These tools extend the product beyond awareness training, although teams should choose them for that integrated coverage rather than assume they replace every specialist exposure-management service.

Pricing

The small-organisation tier is the standout: up to 20 users receive the full platform without a subscription charge. The trade-off is clear for larger deployments, where premium tooling becomes paid and the price is custom. No credit card or sales call is required to start, and browsing the library requires no account.

Platforms

Hackiwi is offered as a web service and as self-hosted software. The self-hosted option is licensed under AGPL-3.0, while the web platform suits teams that do not want to operate the infrastructure themselves.

Who it's for

Hackiwi is a strong fit for small organisations that need coordinated awareness training, phishing exercises, reporting and exposure checks, especially when a free full-platform tier or self-hosting is important. It is less suitable for individuals seeking phishing simulations, since those are restricted to verified organisations, and for larger teams that want predictable published pricing for premium administration features.

Pros and cons

• Pro: Up to 20 organisational users get the full platform free, including simulations after domain verification.
• Pro: Training, reporting and exposure functions sit together, reducing the need to stitch together separate tools.
• Pro: Self-hosting under AGPL-3.0 gives organisations deployment control.
• Pro: Simulation credentials are not stored, while audit logging records campaign events.
• Con: Phishing simulations are unavailable to individuals and families and require verified domains.
• Con: Organisations above 20 users move to paid premium tooling with custom pricing.
• Con: Teams must have the capacity to manage infrastructure if they choose self-hosting.

Alternatives

Choose Wizer instead if you want a freemium awareness product with Android, iOS, web and API access, a free trial, basic user management, limited reporting and automatic learner reminders.

Gophish is the better choice when a free, open-source phishing framework across Linux, macOS, Windows, API and self-hosted deployments is the priority.

Pick SentryMail for a freemium, self-hosted and web-based alternative. Cofense PhishMe suits buyers considering a paid web product with a free plan and an enterprise tier. DarkPhish is worth choosing for a forever-free community tier supporting up to 100 managed users, one active campaign, basic reporting and a core REST API.

Hoxhunt is a paid, multi-platform option priced by employee count and required capabilities. RansomLeak offers a free exercise library alongside paid plans and a free trial. Proofpoint Email DLP and Encryption is a paid email-focused alternative without a free plan.

Verdict

Choose Hackiwi if you are a small organisation wanting training, phishing simulation, reporting and exposure monitoring in one free platform, or if self-hosting is important. Look elsewhere if you need simulations without organisational verification, a plan designed for individuals, or transparent pricing for teams beyond 20 users.