PhishingBox
PhishingBox is a human risk management platform for phishing simulations and security awareness training.
What PhishingBox is
PhishingBox is a human risk management platform for phishing simulations and security awareness training. AI analytics and risk scoring help identify vulnerable users. Campaigns can use multi-stage email, callback, attachment, QR-code, and reply-to-only scenarios. Training includes scheduled learning, training moments, SCORM-ready content, and an included learning management system. KillPhish analyzes and reports suspicious emails, while Phishing Inbox receives submitted messages. The Standard plan is $825 a year, billed at $16.50 per seat, and includes simulators, 70+ template languages, integrations, just-in-time training, KillPhish, and support. Professional costs $1,196.25 a year at $23.93 per seat and adds LMS, API, portals, course tools, and branding. Enterprise costs $1,567.50 a year at $31.35 per seat and adds callback phishing, KillPhish AI, Security Inbox, and leadership training. A 14-day trial is available; there is no free plan.
Good
- Multiple phishing simulation formats
- AI analytics and risk scoring
- SCORM-ready training and included LMS
- RESTful API for data and workflows
- 14-day trial available
Watch out
- No free plan
- Seat counts above 25,000 require custom pricing
- Leadership training limited to 5% of licensed seats
- Plans have different feature sets
Who it suits
It suits organizations, audit and consulting firms, managed service companies, and white-label partners running phishing simulations or awareness programs. Web, extension, and API access support varied workflows.
Verdict
PhishingBox combines simulation campaigns, training, reporting, and risk scoring. Choose a plan based on whether you need LMS, API, callback phishing, or leadership-training features.
Plans and prices
From PhishingBox's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Standard | $825 | Campaign Simulator · Phishing Simulator · Training Simulator · 70+ template languages · KillPhish · just-in-time training · integrations · email/live-chat/phone support · annual license; monthly invoicing available |
| Professional | $1,196.25 | Everything in Standard · LMS · API · dedicated training portal · custom course creation · course library/store · Cyber Fundamentals · comprehensive training · custom branding · annual license; monthly invoicing available |
| Enterprise | $1,567.50 | Everything in Professional · callback phishing · KillPhish AI · Security Inbox · leadership role-based training · SecurityTips · annual license; monthly invoicing available |
The facts
Each one read from PhishingBox's own pages, with the date it was checked.
What it does
- AI integrations
- Enterprise accounts can connect OpenAI, Anthropic or Gemini for report summaries, KillPhish analysis and template translation; provider charges may apply.checked 15 Oct 2026
- API
- The REST API can import targets, launch training or testing campaigns and retrieve reports for external workflows.checked 15 Oct 2026
- API access condition
- Using the REST API requires an active PhishingBox account and generated API token sent in an api-token header.checked 15 Oct 2026
- API versions
- PhishingBox recommends API v2, released in April 2020, and says its v2 documentation has broader endpoints than v1.checked 15 Oct 2026
- Audience
- PhishingBox serves direct clients, third-party audit and consulting firms, managed service companies and white-label partners.checked 30 Sep 2026
- Compliance
- Its Trust Center describes an independent SOC audit, GDPR work and an EU hosting instance for customers avoiding U.S. processing.checked 30 Sep 2026
- Data residency
- Hosted regional instances are offered in Northern Virginia and Frankfurt for US or EU residency requirements.checked 15 Oct 2026
- Documentation depth
- The support site exposes 293 indexed help articles covering campaigns, targets, safelisting, templates, reports, settings and account workflows.checked 15 Oct 2026
- Hosting
- Core products are a web-based suite hosted mainly in AWS, with email and landing-page processing in Lexington, Kentucky and Frankfurt, Germany.checked 30 Sep 2026
- Human-risk scoring
- Employee risk scoring combines simulation results, training engagement, real-world behavior and inbox-reporting activity.checked 15 Oct 2026
- Integrations
- Published integrations include Microsoft, Google Workspace, OpenAI, Anthropic, Litmos, Cornerstone, Bridge and Captivate, with additional directory, LMS, SIEM and HR connectors documented in the help center.checked 15 Oct 2026
- KillPhish
- KillPhish lets Microsoft 365 and Google Workspace users report suspicious emails, while Microsoft users can scan messages for risk signals.checked 15 Oct 2026
- Learning management
- Its built-in LMS assigns, tracks and reports training and supports SCORM-ready content.checked 15 Oct 2026
- Legal name
- The privacy policy and subscription terms identify the provider as PhishingBox, LLC, a Kentucky limited-liability company.checked 15 Oct 2026
- Licence
- The terms identify PhishingBox, LLC as the service provider and state that service content and related intellectual property belong to the company, licensors, affiliates or identified third parties; no open-source licence is published.checked 15 Oct 2026
- Limit: interface
- Some reviewers say the user interface is confusing or difficult to handle.checked 15 Oct 2026
- Limit: reporting detail
- GetApp users rated real-time reporting 3.0 out of 5 from two ratings, lower than most other listed feature scores.checked 15 Oct 2026
- Limit: templates
- Reviewers have asked for better template organization and upgrades to the template library.checked 15 Oct 2026
- Limit: training effort
- A Gartner Peer Insights reviewer said the training program can require substantial employee time and budget to maintain.checked 15 Oct 2026
The company
- Company facts
- LinkedIn lists PhishingBox as a privately held computer-and-network-security company founded in 2013 with 11–50 employees headquartered in Lexington, Kentucky.checked 15 Oct 2026
- Company history
- The platform originated in 2005 as a social-engineering testing tool and became a standalone company in 2016.checked 30 Sep 2026
- Founded
- 2016checked 28 Sep 2026
- Headquarters
- Lexington, Kentucky, United Stateschecked 28 Sep 2026
Money
- Limit: price
- A reviewer described PhishingBox as more expensive than comparable tools.checked 15 Oct 2026
Alternatives to PhishingBox
- 1
Wizer
Free planAndroidiOSWebAPI8.0Free plan - 2
ScamDrill
Free planAndroidiOSWebAPI7.9From $84 a year - 3
Brightside AI
Free planWebAPIExtension7.3From €0.50 a month - 4
PhishSkill
WebExtension6.7 - 5
Boxphish
AndroidiOSWeb6.5From £5 a year - 6
Keepnet Labs
WebAPISelf-hosted6.4From $1.80 a month