Boxphish vs Cofense PhishMe

Boxphish combines phishing simulations, security training, and analytics to help organisations address cyber attack risk. Its library offers over 150 templates for B2B and B2C scenarios, and a builder supports custom simulations. Training uses short videos followed by quizzes or games, covering subjects such as phishing, malware, social engineering, GDPR, and data privacy. Dashboards report simulation outcomes, course completion, and risk scores, with detail by user, department, or location. Listed options include Google and Microsoft Office 365 user syncing and single sign-on for Google and Microsoft Office. A Microsoft Teams integration is available as a bolt-on for Essentials and Enhanced; it supports notifications, course access and completion in Teams, and progress syncing. Enhanced adds dark web and credential monitoring for up to five domains, breach alerts, risk prioritisation, and a secure password handling portal. Lite costs £5 per user per year and includes one admin, 12 simulations, and 12 training topics. Boxphish runs on Android, iOS, and web; AWS hosting and WCAG compliance are listed across all three plans.

Cofense PhishMe is a web-based phishing simulation and security awareness training platform for organizations. Its simulations draw on real phishing data and can model smishing, vishing, and QR-code phishing to measure employee readiness and identify training gaps. Training content and reinforcement can be targeted to areas where employees need more practice. Reporting and analytics track performance and risk, while one-click reporting feeds a global intelligence network. PhishMe includes phishing simulations, risk scoring, a phish reporting button, and automated training. Data travels over HTTPS and is encrypted at rest using AES-256. Simulation data includes click-related statistics, while data entered by employees is not collected or stored. Controls include role-based configuration, auditing, and multi-factor authentication; Enterprise also supports SAML 2.0 single sign-on. Cofense says its SOC 2 Type 2 certification covers PhishMe, with the report available through a sales representative under an NDA. Hosting locations include Ashburn, Montreal, Frankfurt, Sydney, and Tokyo; the Free edition is hosted only in Ashburn. The free plan costs nothing.