Skip to content
SPECIFICTION
Get listed

CanIPhish

caniphish.com

Free plan WebAPIBrowser extension
Visit caniphish.com
Spec score 8.8 #1 of 31 in Phishing Simulation Software

What it is

CanIPhish provides phishing simulations and adaptive security awareness training for organizations. It supports email, voice, and web simulations, with more than 140 ready-to-go scenarios. Campaign templates can track clicks, credential entries, attachment opens, and replies, and support domain spoofing. The platform can generate customizable phishing websites by cloning templates or creating bespoke sites. Its AI voice-phishing capability can conduct dynamic conversations across languages, accents, and personas, and clone a voice from a short audio sample. Autonomous phishing mode uses OSINT, user context, and historical data to select content for each person and time. Integrations and add-ons include Microsoft Entra ID, Google Workspace, Gmail Report Phish, and Outlook Report Phish. The public API can read campaign results, human-risk scores, dark-web breaches, and domain-supply-chain posture, and manage campaigns, employee lists, content, and settings. The Free plan is free for up to 10 employees. Professional is listed at free with a minimum of 11 employees; Enterprise is free, annual only, with a minimum of 25 employees. It is available through web and API.

Spec sheet

What it does
CanIPhish is a cloud platform for simulated phishing, security-awareness training and human-risk measurement.Read 19 Oct 2026 · caniphish.com
Purpose
CanIPhish provides AI-powered phishing simulations and adaptive security awareness training to build an organization’s human firewall.Read 1 Oct 2026 · caniphish.com
API
The public API can read campaign results, human-risk scores, dark-web breaches and domain-supply-chain posture, and manage campaigns, employee lists, content and platform settings.Read 1 Oct 2026 · help.caniphish.com
Integrations
Documented integrations include Microsoft Entra ID, Google Workspace, Gmail and Outlook report-phish add-ons, Vanta, Drata and webhooks.Read 19 Oct 2026 · caniphish.com
Headquarters
Queensland, AustraliaRead 23 Sep 2026 · caniphish.com
AI selection
Autonomous phishing mode uses OSINT, user context and historical data to select content for each person and time.Read 1 Oct 2026 · caniphish.com
AI website generator
Enterprise users can generate or clone customizable simulated phishing websites using prompts, screenshots or URLs.Read 19 Oct 2026 · help.caniphish.com
API authentication and limits
API calls require X-API-Key and X-Email-Address headers, consume quota units and may require Professional or Enterprise entitlements for writes.Read 19 Oct 2026 · help.caniphish.com
API documentation depth
CanIPhish provides an interactive reference with endpoint schemas, parameters and a try-it console, plus workflow examples in its help article.Read 19 Oct 2026 · help.caniphish.com
Campaign tracking
Phishing templates track clicks, credential entries, attachment opens and replies, with domain spoofing support.Read 1 Oct 2026 · caniphish.com
Campaign types
Campaigns can deliver phishing, training, or combined phishing-and-training programs.Read 19 Oct 2026 · help.caniphish.com
Company database facts
Crunchbase describes CanIPhish as an Australian company founded in 2020 with 1–10 employees and headquarters in Peregian Beach, Queensland.Read 19 Oct 2026 · crunchbase.com
Company facts
LinkedIn lists CanIPhish as privately held, founded in 2020, headquartered in Peregian Beach, Queensland, with 2–10 employees.Read 19 Oct 2026 · au.linkedin.com
Conversational phishing
The PhishAI engine conducts back-and-forth email conversations before attempting a simulated malicious action.Read 19 Oct 2026 · help.caniphish.com
Customer profile
The platform is used by managed service providers, enterprise customers and organizations of all sizes across more than 65 countries.Read 1 Oct 2026 · caniphish.com
Data residency
Configurable storage locations include the United States, Australia, United Kingdom, Canada, South Africa, Germany, United Arab Emirates, Singapore, India and Brazil.Read 19 Oct 2026 · caniphish.com
Deepfake voice
Its AI voice-phishing capability can hold dynamic conversations across languages, accents and personas and clone a voice from a short audio sample.Read 1 Oct 2026 · caniphish.com
Documentation and support
Support resources include a Zendesk knowledge base, video walkthroughs, email, live chat and plan-dependent customer support.Read 19 Oct 2026 · help.caniphish.com
Email delivery
Email delivery can use CanIPhish SMTP, Google Workspace Direct Email Injection, Microsoft 365 Direct Email Injection or a customer-controlled third-party SMTP server.Read 1 Oct 2026 · help.caniphish.com
Legal maker
The subscription agreement identifies the maker as Can I Phish Pty Ltd, ABN 24 647 802 266.Read 19 Oct 2026 · caniphish.com
Licence
The pages describe a proprietary subscription cloud service and do not publish an open-source licence.Read 19 Oct 2026 · caniphish.com
Limit: broader coverage
The sole Gartner reviewer characterized the product as useful for phishing simulation but lacking comprehensive cybersecurity coverage.Read 19 Oct 2026 · gartner.com
Limit: training depth
GetApp summaries mention requests for more advanced or localized training content and small improvements to training management.Read 19 Oct 2026 · getapp.com
Notable news: brand protection
In September 2026, CanIPhish announced an Enterprise open beta for brand protection with lookalike-domain monitoring, sandbox analysis and takedown support.Read 19 Oct 2026 · au.linkedin.com
Notable release: roadmap
The 2026 roadmap records completed releases including an AI Program Manager, SCORM import, email sandboxing, AI email and website generators, and automated risk-based phishing.Read 19 Oct 2026 · caniphish.com
Phishing payloads
Supported simulations include attachments, credential capture, information requests and callback phishing.Read 19 Oct 2026 · help.caniphish.com
Phishing scenarios
CanIPhish offers more than 140 ready-to-go phishing scenarios.Read 1 Oct 2026 · caniphish.com
Praise: campaign effectiveness
GetApp summaries say users value quick setup, realistic customizable templates, actionable reporting and identifying risky employees with little administration.Read 19 Oct 2026 · getapp.com
Praise: usability and support
Capterra reviewers repeatedly praise the simple interface, campaign setup, configuration flexibility and responsive professional support.Read 19 Oct 2026 · capterra.com
Privacy and encryption
The security page says customer data is not sold and data in transit uses at least TLS 1.2.Read 19 Oct 2026 · caniphish.com
Public API
A version 3 REST-style API at api.caniphish.com/api/v3 exposes campaign, employee, content, reporting, settings and tenant operations.Read 19 Oct 2026 · help.caniphish.com
Rating on Capterra
4.9 out of 5 from 59 reviews.Read 19 Oct 2026 · capterra.com
Rating on G2
0.0 out of 5 from 0 reviews.Read 19 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.0 out of 5 from 1 review.Read 19 Oct 2026 · gartner.com
Rating on GetApp
4.9 out of 5 from 59 reviews.Read 19 Oct 2026 · getapp.com
Rating on TrustRadius
10 out of 10 from 1 review.Read 19 Oct 2026 · trustradius.com
Reported-phish defense
Gmail and Outlook add-ons let employees report messages, while administrators can use quarantine, sandboxing and AI analysis.Read 19 Oct 2026 · help.caniphish.com
Risk scoring
Employee phish-risk scores use results from the previous 20 campaigns, weighting recent campaigns more heavily.Read 19 Oct 2026 · help.caniphish.com
Security assurance
CanIPhish states that Sensiba finalized its SOC 2 Type 2 and SOC 3 attestations on January 22, 2026, covering security, availability and confidentiality controls.Read 19 Oct 2026 · caniphish.com
Security framework
CanIPhish bases its policies, standards, procedures and guidelines on the NIST Cybersecurity Framework and the Australian Cyber Security Centre Information Security Manual.Read 1 Oct 2026 · caniphish.com
Self-hosting
The product is described as a hosted cloud platform; customers may bring their own phishing-site hosting, but the main platform is not documented as self-hostable.Read 19 Oct 2026 · help.caniphish.com
Simulation types
The platform supports hyper-realistic email, voice and web phishing simulations.Read 1 Oct 2026 · caniphish.com
Training and LMS
The platform includes an LMS with microlearning, quizzes, gamification, automated assignments and human-risk analytics.Read 19 Oct 2026 · getapp.com
Usage limit
CanIPhish limits the unique email addresses that can be emailed according to the employee count in the subscription and refreshes those addresses monthly.Read 1 Oct 2026 · caniphish.com
Voice phishing
Enterprise voice simulations use AI conversations and require double opt-in consent.Read 19 Oct 2026 · help.caniphish.com
Voice phishing limit
Voice simulations are restricted to approved regions and do not retain call recordings or full transcripts.Read 19 Oct 2026 · help.caniphish.com
Website data safety
Managed phishing websites record interaction events but do not capture usernames, email addresses or passwords.Read 19 Oct 2026 · help.caniphish.com
Website generator
CanIPhish generates customizable phishing websites by cloning templates or building bespoke sites from scratch.Read 1 Oct 2026 · caniphish.com

Plans and prices

Enterprise Free annual only minimum 25 employees Read 1 Oct 2026 · caniphish.com
Enterprise Free annual only minimum 25 employees · includes Professional features · custom quote over 1,000 employees Read 19 Oct 2026 · caniphish.com
Free Free forever up to 10 employees · no credit card Read 19 Oct 2026 · caniphish.com
Professional Free monthly or annually minimum 11 employees · includes Free features Read 19 Oct 2026 · caniphish.com

Every CanIPhish plan and price →

Strong points and limits

Strong points

  • Supports email, voice, and web simulations
  • Offers more than 140 ready-to-go scenarios
  • Tracks clicks, credential entries, opens, and replies
  • API can manage campaigns and employee lists
  • Configurable customer data storage locations are listed

Limits

  • Free plan is limited to 10 employees
  • Professional requires at least 11 employees
  • Enterprise is annual only
  • Unique email address limits refresh monthly

Who it suits

CanIPhish suits organizations, managed service providers, and enterprise customers seeking multichannel phishing simulations and awareness training. Its campaign tools and API also fit teams that need to manage simulations and review human-risk information programmatically.

Verdict

CanIPhish combines simulation channels, training, campaign automation, and API controls for organizational use. Employee minimums and monthly address limits are important constraints to check against the intended campaign size.

Where Specifiction places it

Alternatives to CanIPhishAll alternatives →