SentryMail

Overview

SentryMail is an open-core phishing-awareness platform for organizations that want to run simulations inside their own infrastructure and measure responses by recipient. Its clearest appeal is to teams with self-hosting capacity and a need to document security awareness work; small organizations looking for a ready-to-buy paid service will find the 25-employee minimum and unavailable licenses significant constraints.

The free Community edition gives teams an open-source core they can self-host, but paid features are not purchasable yet. That makes SentryMail easier to consider as a self-managed project than as an immediate paid deployment.

Key features

Campaigns can be scheduled, assembled from HTML or Markdown templates, or imported from .eml files. Landing pages and per-recipient tracking of opens, clicks and form submissions show which actions need follow-up; campaign analytics, a risk-score dashboard and CSV export help administrators turn results into reports. A phish-reporting button and automated training extend the workflow beyond sending simulations.

Enterprise adds a self-hosted LMS for mandatory video courses, automatic assignments when awareness scores are low, quizzes and audit-proof certificates. This is a useful progression from identifying risky behavior to documenting training, but it belongs to the upper tier, not Community.

Identity and delivery integrations include LDAP, Microsoft Graph for Azure AD or Entra ID, SCIM 2.0, OIDC/SSO providers and SMTP services such as IONOS, Hetzner, Mailgun, SES and Postmark. Enterprise adds SAML SSO, SIEM exports to Splunk HEC, Elasticsearch, Microsoft Sentinel or JSON, and xAPI export to a Learning Record Store. Those options make the product more relevant to organizations with established identity, monitoring and learning systems.

Security documentation describes Argon2id passwords, encrypted secrets at rest, two-factor authentication with backup codes, audit logging and hardened containers. Audit entries use SHA-256 hash chaining, with an exportable evidence package and standalone verifier. SentryMail also supports pseudonymized reporting and says it can run entirely within a customer's infrastructure, a combination suited to organizations with tighter privacy or evidence requirements.

Pricing

Community is the practical starting point for teams able to operate their own deployment and rely on community support. Business adds campaign and reporting capabilities plus email support, while Enterprise is for organizations that need branded deployment, SIEM connections and its additional automation and scoring. The paid tiers are annual and exclude organizations under 25 employees; both license purchases are marked as coming soon, so their features cannot yet be bought.

Platforms

SentryMail is self-hosted and web-based. The installation guide describes a Docker Compose stack and requires Linux with Docker Engine, so it suits organizations prepared to run and maintain that environment rather than users seeking a hosted-only setup.

Who it's for

SentryMail is best suited to organizations with at least 25 employees that can self-host and want recipient-level simulation results, training workflows and auditable reporting. Community can also suit smaller teams willing to use the open-source core, but its GitHub support model and the absence of purchasable paid licenses make it a less straightforward option for teams needing vendor-backed service now.

Pros and cons

Pros

• Recipient-level opens, clicks and form submissions make campaign follow-up more targeted than aggregate-only measurement.
• Self-hosting, pseudonymized reporting and a privacy-oriented design support organizations seeking control over infrastructure and personal data.
• Hash-chained audit entries and a verifiable evidence package strengthen the record of awareness activity.
• Training, quizzes, certificates and integrations with identity, SIEM and learning systems can support a broader compliance workflow.

Cons

• Business and Enterprise require at least 25 employees, ruling out smaller organizations from paid tiers.
• Paid licenses are marked as coming soon, limiting the product today to its free Community edition.
• Linux and Docker Engine are required for the described self-hosted installation, adding operational responsibility for the customer.
• Community users depend on GitHub community support rather than the email support included with Business.

Alternatives

Browse Security Awareness Training Software for more options in the category. Wizer is a freemium web option with Android and iOS apps, a free plan, and basic annual training, user management, limited reporting and reminder emails; choose it when those basics matter more than SentryMail's self-hosted, recipient-level simulation workflow. Proofpoint Email DLP and Encryption is a paid option without a free plan. Hoxhunt is a paid alternative with web, desktop and mobile platform support. Kaspersky Research Sandbox offers cloud or on-premise deployment, including air-gapped environments, and is a paid option without a free plan. LUCY Security is a paid alternative with self-hosted and web support; its CORE plan covers security awareness training, phishing simulations and an on-premise option. CyberHoot has a free plan and trial, and its Autopilot plan is $125 a month for features including white-labeling, multi-tenancy and interactive training. Breach Secure Now is a paid web option with a free trial. Keepnet Labs is a paid alternative with self-hosted and web support and a free trial.

Verdict

Choose SentryMail if your organization can self-host, needs recipient-level phishing measurement and values a documented route from simulation results to training and auditable evidence. Its open-source Community tier is the immediate way in, but organizations that need paid support or advanced features now—or have fewer than 25 employees—should look elsewhere until its paid licenses become available.