Gophish vs Living Security

Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.

Living Security provides security awareness training for organizations that need individualized employee risk training and compliance support. Its platform includes hundreds of professionally produced, plot-driven live-action modules that can be tailored by role, industry, department, and specific risk area. Ready-to-use campaign templates, audience filters, and multi-campaign management support program administration. Training is available in 20 languages, with templates described in more than 26 languages. Microsoft Teams and Slack can deliver reminders and nudges. Risk mitigation reporting covers individual, team, and company levels. Living Security lists more than 160 native integrations, custom API endpoints, and CSV uploads, producing more than 300 Human Risk signals. The training page says requirements for PCI, SOC, NIST, CMMC, HIPAA, FedRamp, and more are met. Web access supports current Microsoft Edge and Google Chrome. Phishing simulations, risk scoring, automated training, SSO, and a phish reporting button are listed.