CyberHoot vs Gophish

CyberHoot is a web-based security awareness training service focused on phishing recognition and reducing human risk. HootPhish uses interactive scenarios to teach six indicators of malicious emails; AttackPhish sends realistic phishing messages and ranks individual and team performance. Dark Web Monitoring generates reports about exposed personal data and recommends protective actions. Autopilot runs awareness programs with minimal oversight, without daily logins or manual sending. CyberHoot integrates with EntraID and Google Workspace, while its enterprise offering lists an API and integrations with enterprise software and security infrastructure. It serves individuals, MSPs, businesses, education institutions, enterprises and partners. Individual training is free and includes six foundational videos, monthly video training and quarterly HootPhish training. The service has a free plan and a 30-day trial. Autopilot costs $125 a month and includes 50 users; listed tiered pricing ranges from $2.50 user/mo at a 50-user minimum to $1.00/user/m. CyberHoot states that it complies with CCPA, GDPR, PIPEDA and the Australian Privacy Act.

Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.