Cofense PhishMe vs Hackiwi

Cofense PhishMe is a web-based phishing simulation and security awareness training platform for organizations. Its simulations draw on real phishing data and can model smishing, vishing, and QR-code phishing to measure employee readiness and identify training gaps. Training content and reinforcement can be targeted to areas where employees need more practice. Reporting and analytics track performance and risk, while one-click reporting feeds a global intelligence network. PhishMe includes phishing simulations, risk scoring, a phish reporting button, and automated training. Data travels over HTTPS and is encrypted at rest using AES-256. Simulation data includes click-related statistics, while data entered by employees is not collected or stored. Controls include role-based configuration, auditing, and multi-factor authentication; Enterprise also supports SAML 2.0 single sign-on. Cofense says its SOC 2 Type 2 certification covers PhishMe, with the report available through a sales representative under an NDA. Hosting locations include Ashburn, Montreal, Frankfurt, Sydney, and Tokyo; the Free edition is hosted only in Ashburn. The free plan costs nothing.

Hackiwi is a security platform for organisational training, phishing simulations, suspicious-message triage and exposure monitoring. Its video and written lessons include interactive knowledge checks; teams can assign learning paths and track completion. The public training library is free to browse without an account, and its content is licensed under CC-BY-4.0. Organisations with up to 20 users can use the full platform free. Phishing campaigns are available only to verified organisations and domains, and track opens, clicks and reports with safety gates and audit logs. Submitted credentials are not retained; only the event is recorded. Staff can forward suspicious messages from desktop or phone mail clients for automated classification and reputation checks. Exposure tools cover scope-locked OSINT, website scanning, dependency CVE tracking, domain monitoring and alerts for newly registered lookalike domains. Hackiwi runs on the web or on an organisation’s own infrastructure under AGPL-3.0. Its simulator is not offered to individuals or families, and organisations above 20 users pay for premium tooling.