Cofense PhishMe vs Hoxhunt

Cofense PhishMe is a web-based phishing simulation and security awareness training platform for organizations. Its simulations draw on real phishing data and can model smishing, vishing, and QR-code phishing to measure employee readiness and identify training gaps. Training content and reinforcement can be targeted to areas where employees need more practice. Reporting and analytics track performance and risk, while one-click reporting feeds a global intelligence network. PhishMe includes phishing simulations, risk scoring, a phish reporting button, and automated training. Data travels over HTTPS and is encrypted at rest using AES-256. Simulation data includes click-related statistics, while data entered by employees is not collected or stored. Controls include role-based configuration, auditing, and multi-factor authentication; Enterprise also supports SAML 2.0 single sign-on. Cofense says its SOC 2 Type 2 certification covers PhishMe, with the report available through a sales representative under an NDA. Hosting locations include Ashburn, Montreal, Frankfurt, Sydney, and Tokyo; the Free edition is hosted only in Ashburn. The free plan costs nothing.

Hoxhunt provides security awareness and phishing training for organizations seeking to reduce human cyber risk. Its simulations can reach employees by email, SMS, phone call or Teams and can reflect context such as department and location. Training combines short lessons and interactive exercises with automated enrollment, reminders and completion tracking. The library includes more than 300 modules and regulatory tracks for PCI DSS, HIPAA, DORA and GDPR. Content Studio turns organizational policies and existing materials into custom training in under 60 seconds; administrators can review and edit the result. Hoxhunt also clusters reported email threats and supports automated remediation integrations. It supports Microsoft Exchange environments, including on-premise and Microsoft 365, as well as Google Workspace. Sign-on options include Microsoft Entra ID, AD FS, Google Workspace, Okta, Ping Identity and OneLogin, plus other SAML 2.0-compatible providers. Supported environments vary by email provider and client; native Mail apps on Windows and macOS are unsupported, and Outlook mobile support is limited to Exchange Online users. Pricing is by employee and available on request.