Gophish vs Hoxhunt

Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.

Hoxhunt provides security awareness and phishing training for organizations seeking to reduce human cyber risk. Its simulations can reach employees by email, SMS, phone call or Teams and can reflect context such as department and location. Training combines short lessons and interactive exercises with automated enrollment, reminders and completion tracking. The library includes more than 300 modules and regulatory tracks for PCI DSS, HIPAA, DORA and GDPR. Content Studio turns organizational policies and existing materials into custom training in under 60 seconds; administrators can review and edit the result. Hoxhunt also clusters reported email threats and supports automated remediation integrations. It supports Microsoft Exchange environments, including on-premise and Microsoft 365, as well as Google Workspace. Sign-on options include Microsoft Entra ID, AD FS, Google Workspace, Okta, Ping Identity and OneLogin, plus other SAML 2.0-compatible providers. Supported environments vary by email provider and client; native Mail apps on Windows and macOS are unsupported, and Outlook mobile support is limited to Exchange Online users. Pricing is by employee and available on request.