BullPhish ID vs DarkPhish

BullPhish ID is a web-based platform that combines security-awareness training with simulated phishing campaigns. Courses address data protection, password security, phishing awareness, and compliance practices through animated videos and quizzes; organizations can also upload their own videos. Administrators can select preloaded phishing kits, customize messages and attachments, or build campaigns from blank templates. New kit content is added monthly. Campaigns can import organizations, groups, and contacts, run up to a year ahead, and randomize send times and phishing messages. Automated monthly and quarterly reports show organization and individual results, including employee actions and areas needing more training. Directory synchronization supports Microsoft Entra ID, Google Workspace, and IT Glue, with dynamic and nested groups in Entra ID and Google Workspace. Integrations include Graphus inbox delivery, KaseyaOne billing workflows, and Compliance Manager GRC evidence transfer. BullPhish ID requires two-factor setup with a compatible mobile authenticator and cannot synchronize with Microsoft 365 GCC High or DoD tenants.

DarkPhish is a self-hosted platform for authorized phishing simulations, security-awareness training, internal security testing and defensive research. Users can prepare or import email templates, define approved recipients, schedule campaigns, monitor activity, review recipient timelines and export results. The free Community plan costs nothing and includes up to 100 managed users, one active campaign, a simulation engine, basic reporting and the core REST API. Paid plans start at €249/mo (annual). The platform lists API, Linux, self-hosted and web availability; its installer supports fresh systemd-based Linux deployments on amd64 and arm64. Supported databases include SQLite, MySQL/MariaDB and PostgreSQL. DarkPhish describes encrypted and signed browser sessions, scoped expiring API tokens, secrets hidden from normal API responses, and signed, hash-chained administrative audit records. Professional and Enterprise plans are in development, with further capabilities planned. The project states that the software is for authorized testing and simulations only.