Boxphish vs ScamDrill

Boxphish combines phishing simulations, security training, and analytics to help organisations address cyber attack risk. Its library offers over 150 templates for B2B and B2C scenarios, and a builder supports custom simulations. Training uses short videos followed by quizzes or games, covering subjects such as phishing, malware, social engineering, GDPR, and data privacy. Dashboards report simulation outcomes, course completion, and risk scores, with detail by user, department, or location. Listed options include Google and Microsoft Office 365 user syncing and single sign-on for Google and Microsoft Office. A Microsoft Teams integration is available as a bolt-on for Essentials and Enhanced; it supports notifications, course access and completion in Teams, and progress syncing. Enhanced adds dark web and credential monitoring for up to five domains, breach alerts, risk prioritisation, and a secure password handling portal. Lite costs £5 per user per year and includes one admin, 12 simulations, and 12 training topics. Boxphish runs on Android, iOS, and web; AWS hosting and WCAG compliance are listed across all three plans.

ScamDrill trains families and organizations to recognize scams through simulated messages and follow-up lessons. Family exercises cover email and SMS, while organization simulations also include QR code scams. The exercises adapt to each learner’s performance, increasing difficulty as skills improve. A dashboard tracks progress, scam types caught and areas that may need more practice. Family members can forward suspicious emails or texts for AI analysis; this message-checking feature is included with the Family plan. Organizations can sync rosters with Okta, Azure AD and Google Workspace, and Enterprise includes a REST API and webhooks. ScamDrill says its data is encrypted in transit and at rest, with database-level tenant isolation and passkey-based two-factor authentication. It also says simulated landing pages do not capture, transmit or store what a learner types. The company says it does not sell personal data or share learner data with advertisers or data brokers. SOC 2 is listed as planned; paid organization plans include audit report exports for frameworks including SOC 2, ISO 27001 and HIPAA.