Gophish vs Infosec IQ

Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.

Infosec IQ provides employee security awareness training and phishing simulations for organizations. Its library contains more than 3,000 role-based resources, and the phishing simulator has more than 2,000 templates; the vendor says it adds templates weekly. Training can be tailored to employee roles and security aptitude, with recommendations informed by assigned courses and engagement patterns. Dashboards cover completion, phishing activity, learner risk and culture survey results, with customizable, exportable reports. PhishNotify connects with Outlook and Gmail so employees can report suspicious email with one click. Listed integrations include Active Directory, Azure AD, SCIM, SSO, an open API and several endpoint protection products. The platform supports 34 course languages, automated training and risk scoring. The vendor says its training, simulations and learner tools comply with WCAG 2.2 AA and Section 508, and that completion tracking can document training for frameworks including HIPAA, PCI-DSS, SOC 2 and CMMC. Pricing is on request; a free phishing risk test is offered for up to 100 employees.