DarkPhish vs Living Security

DarkPhish is a self-hosted platform for authorized phishing simulations, security-awareness training, internal security testing and defensive research. Users can prepare or import email templates, define approved recipients, schedule campaigns, monitor activity, review recipient timelines and export results. The free Community plan costs nothing and includes up to 100 managed users, one active campaign, a simulation engine, basic reporting and the core REST API. Paid plans start at €249/mo (annual). The platform lists API, Linux, self-hosted and web availability; its installer supports fresh systemd-based Linux deployments on amd64 and arm64. Supported databases include SQLite, MySQL/MariaDB and PostgreSQL. DarkPhish describes encrypted and signed browser sessions, scoped expiring API tokens, secrets hidden from normal API responses, and signed, hash-chained administrative audit records. Professional and Enterprise plans are in development, with further capabilities planned. The project states that the software is for authorized testing and simulations only.

Living Security provides security awareness training for organizations that need individualized employee risk training and compliance support. Its platform includes hundreds of professionally produced, plot-driven live-action modules that can be tailored by role, industry, department, and specific risk area. Ready-to-use campaign templates, audience filters, and multi-campaign management support program administration. Training is available in 20 languages, with templates described in more than 26 languages. Microsoft Teams and Slack can deliver reminders and nudges. Risk mitigation reporting covers individual, team, and company levels. Living Security lists more than 160 native integrations, custom API endpoints, and CSV uploads, producing more than 300 Human Risk signals. The training page says requirements for PCI, SOC, NIST, CMMC, HIPAA, FedRamp, and more are met. Web access supports current Microsoft Edge and Google Chrome. Phishing simulations, risk scoring, automated training, SSO, and a phish reporting button are listed.