Cofense PhishMe vs ScamDrill

Cofense PhishMe is a web-based phishing simulation and security awareness training platform for organizations. Its simulations draw on real phishing data and can model smishing, vishing, and QR-code phishing to measure employee readiness and identify training gaps. Training content and reinforcement can be targeted to areas where employees need more practice. Reporting and analytics track performance and risk, while one-click reporting feeds a global intelligence network. PhishMe includes phishing simulations, risk scoring, a phish reporting button, and automated training. Data travels over HTTPS and is encrypted at rest using AES-256. Simulation data includes click-related statistics, while data entered by employees is not collected or stored. Controls include role-based configuration, auditing, and multi-factor authentication; Enterprise also supports SAML 2.0 single sign-on. Cofense says its SOC 2 Type 2 certification covers PhishMe, with the report available through a sales representative under an NDA. Hosting locations include Ashburn, Montreal, Frankfurt, Sydney, and Tokyo; the Free edition is hosted only in Ashburn. The free plan costs nothing.

ScamDrill trains families and organizations to recognize scams through simulated messages and follow-up lessons. Family exercises cover email and SMS, while organization simulations also include QR code scams. The exercises adapt to each learner’s performance, increasing difficulty as skills improve. A dashboard tracks progress, scam types caught and areas that may need more practice. Family members can forward suspicious emails or texts for AI analysis; this message-checking feature is included with the Family plan. Organizations can sync rosters with Okta, Azure AD and Google Workspace, and Enterprise includes a REST API and webhooks. ScamDrill says its data is encrypted in transit and at rest, with database-level tenant isolation and passkey-based two-factor authentication. It also says simulated landing pages do not capture, transmit or store what a learner types. The company says it does not sell personal data or share learner data with advertisers or data brokers. SOC 2 is listed as planned; paid organization plans include audit report exports for frameworks including SOC 2, ISO 27001 and HIPAA.