CanIPhish vs Gophish

CanIPhish provides phishing simulations and adaptive security awareness training for organizations. It supports email, voice, and web simulations, with more than 140 ready-to-go scenarios. Campaign templates can track clicks, credential entries, attachment opens, and replies, and support domain spoofing. The platform can generate customizable phishing websites by cloning templates or creating bespoke sites. Its AI voice-phishing capability can conduct dynamic conversations across languages, accents, and personas, and clone a voice from a short audio sample. Autonomous phishing mode uses OSINT, user context, and historical data to select content for each person and time. Integrations and add-ons include Microsoft Entra ID, Google Workspace, Gmail Report Phish, and Outlook Report Phish. The public API can read campaign results, human-risk scores, dark-web breaches, and domain-supply-chain posture, and manage campaigns, employee lists, content, and settings. The Free plan is free for up to 10 employees. Professional is listed at free with a minimum of 11 employees; Enterprise is free, annual only, with a minimum of 25 employees. It is available through web and API.

Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.