DarkPhish vs RansomLeak

DarkPhish is a self-hosted platform for authorized phishing simulations, security-awareness training, internal security testing and defensive research. Users can prepare or import email templates, define approved recipients, schedule campaigns, monitor activity, review recipient timelines and export results. The free Community plan costs nothing and includes up to 100 managed users, one active campaign, a simulation engine, basic reporting and the core REST API. Paid plans start at €249/mo (annual). The platform lists API, Linux, self-hosted and web availability; its installer supports fresh systemd-based Linux deployments on amd64 and arm64. Supported databases include SQLite, MySQL/MariaDB and PostgreSQL. DarkPhish describes encrypted and signed browser sessions, scoped expiring API tokens, secrets hidden from normal API responses, and signed, hash-chained administrative audit records. Professional and Enterprise plans are in development, with further capabilities planned. The project states that the software is for authorized testing and simulations only.

RansomLeak provides security awareness training through interactive 3D simulations and a cloud learning management system. Its library has more than 200 exercises visitors can try without signing up, spanning security awareness, privacy and compliance, AI and LLM security, real-world incidents, application and API security, Git and repository security, and cloud security. Organizations can add custom content and uploaded materials, create role-based learning paths and campaigns, and use analytics, reminders, and compliance reports. Training can be exported as SCORM 1.2 or 2004 packages, or launched through LTI 1.3 with grade passback and roster sync. Deployment choices include multi-tenant cloud, dedicated private cloud, and on-premises installation, including air-gapped networks. The documented REST API uses scoped per-tenant tokens; webhooks use HMAC-SHA256 signatures and include retries and delivery logs. The maker says stored data uses AES-256 encryption and data in transit uses TLS 1.2+/1.3. Multi-tenant hosting is available in US or EU regions. The service is not HIPAA-covered, and customers are advised not to upload personal health information. Paid platform pricing is by custom quote.