SANS Phishing Platform
SANS Phishing Platform helps organizations test employees’ ability to withstand phishing and social engineering attacks.
What SANS Phishing Platform is
SANS Phishing Platform helps organizations test employees’ ability to withstand phishing and social engineering attacks. Teams can run preconfigured or customizable email simulations, provide just-in-time training and assign automated remedial courses. Campaigns may be scheduled for up to 12 months with randomized templates and target groups. SANS lists expert-curated templates in five difficulty tiers and 33 languages. User lists can be synchronized from the SANS LMS, Azure AD or other sources. Reporting covers simulation outcomes, interactions with business systems and potential exposure to financial, personal and business email compromise risks. Prebuilt stakeholder reports are designed to discuss metrics without compromising privacy, and custom reports are available. Human detection uses signals such as mouse movement and mobile-device motion to filter erroneous failures. The web platform is sold by subscription, with price and named-user limits set in a customer-specific quote. Simulated phishing may target only domains and recipients for which the customer has authorization.
Good
- Supports customizable phishing simulations and remedial training
- Schedules continuous campaigns for up to 12 months
- Offers templates in five tiers and 33 languages
- Syncs targets from LMS, Azure AD and other sources
- Provides stakeholder and custom reporting
Watch out
- Pricing is available only through a customer quote
- License limits depend on quoted named users
- Simulations require authorization for domains and recipients
- Web access is the only listed platform
Who it suits
It suits organizations running continuous phishing-awareness programs that need simulations, training, campaign automation and reporting. Customers must have authorization for every simulated target.
Verdict
SANS Phishing Platform combines recurring simulations, training and privacy-conscious reporting for organizational awareness programs. Obtain a quote and confirm authorized testing scope before adopting it.
Plans and prices
From SANS Phishing Platform's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Phishing Training (CIS Aggregate Buy, 2017) | $3,000 a year | 1,200 users included · $2.50 per additional user · 2-year price $5,520 · 1-year price |
| SANS Phishing Platform | Priced on request | Price and subscription limits are set out in a customer-specific quote. |
| SANS Security Awareness / Phishing | — | Pricing varies by users and selected features · Annual subscription; quote required |
The facts
Each one read from SANS Phishing Platform's own pages, with the date it was checked.
What it does
- Access and license
- Use is licensed for the subscription term and number of phishing named users stated in the customer’s price quote.checked 5 Oct 2026
- Accessibility
- SANS says its training was built with Section 508 and other accessibility frameworks in mind and that a VPAT is available on request.checked 15 Oct 2026
- API
- SANS states that its platform includes a full API for custom integrations.checked 15 Oct 2026
- Authorized testing
- Customers may conduct simulated phishing only against domains and recipients for whom they have authorization.checked 5 Oct 2026
- Campaign scheduling
- The campaign wizard can schedule up to 12 months of continuous simulations using randomized templates and target groups.checked 5 Oct 2026
- Compliance alignment
- SANS says regular awareness training can support PCI DSS, ISO 27001 and NIST objectives.checked 15 Oct 2026
- Content customization limit
- SANS says its videos are off-the-shelf and cannot be edited, although organizations can add branding, policies and homegrown material.checked 15 Oct 2026
- Executive reporting
- Prebuilt C-suite reports present program results while protecting individual privacy, and administrators can create custom reports.checked 15 Oct 2026
- Human detection
- Human detection uses indicators such as mouse movement and mobile device motion to filter erroneous simulation failures.checked 5 Oct 2026
- Integrations
- The platform offers prebuilt SSO, SMTP and Active Directory integrations.checked 15 Oct 2026
- Intended users
- SANS describes the platform as a way for organizations to train and test employees continuously and manage their phishing awareness programs.checked 5 Oct 2026
- License model
- The master agreement grants customers a limited, nonexclusive, nontransferable and nonsublicensable license during the subscription term.checked 15 Oct 2026
- Limit: customization and scoring
- G2's 2025 grid reports lower feature scores for white-labeling, customization and risk-scoring than category averages.checked 15 Oct 2026
- Limit: onboarding and support
- Gartner includes a critical review alleging poor onboarding, slow implementation and difficulty obtaining SCORM guidance from support.checked 15 Oct 2026
- Limit: usability
- G2 reviewers report cumbersome multi-window viewing, learning-curve issues and some language limitations.checked 15 Oct 2026
- Measurement method
- SANS recommends tracking reporting and click rates, benchmarking, trends, real-world incidents and its Normalised Reporting Score and Human Risk Score.checked 15 Oct 2026
- Metrics
- Reporting covers simulation results, user interactions with business systems, and potential exposure to financial, personal, and business email compromise risks.checked 5 Oct 2026
- Phishing tests
- Administrators can use prebuilt campaigns or create customized phishing tests.checked 15 Oct 2026
The company
- Company
- SANS says it launched in 1989 as a cooperative for information security thought leadership.checked 5 Oct 2026
- Company profile
- LinkedIn lists SANS Institute as privately held, founded in 1989, headquartered in Rockville, Maryland, with 201–500 employees.checked 15 Oct 2026
- Founded
- 1989checked 28 Sep 2026
- Headquarters
- North Bethesda, Maryland, United Stateschecked 28 Sep 2026
- Legal maker
- SANS identifies the legal entity as The Escal Institute of Advanced Technologies, Inc., doing business as SANS Institute.checked 15 Oct 2026
Money
- Limit: price
- G2 reviews repeatedly describe SANS training as expensive or unaffordable compared with alternatives.checked 15 Oct 2026
Alternatives to SANS Phishing Platform
- 1
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 2
CanIPhish
Free planWebAPIExtension6.8Free plan - 3
6.3 - 4
CyberHoot
Web6.3From $125 a month - 5
Hoxhunt
AndroidiOSWebmacOS6.3 - 6
6.3From $1.75 a month