Gophish vs SANS Phishing Platform
Gophish
getgophish.com
SANS Phishing Platform
sans.orgSide by side
| Figure | Gophish | SANS Phishing Platform |
|---|---|---|
| Price from | Free | $250/mo |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 3 |
| Spec score · Phishing Simulation Software | 8.1 (#4) | 7.9 (#7) |
| API | Gophish provides a REST API and a Python client. | SANS states that its platform includes a full API for custom integrations. |
| Purpose | Gophish is an open-source framework for testing an organization's exposure to phishing. | The platform tests employees’ ability to withstand phishing and social engineering attacks. |
| Reporting | Campaign results are delivered near real time and can be exported for reports. | It includes prebuilt stakeholder reports designed to discuss program metrics without compromising privacy, plus custom reports. |
| Support | The project asks users to file an issue for bugs, feature requests, or missing documentation. | Standard support includes implementation webinars, FAQs, getting-started guides and email support; additional implementation guidance is available. |
| Templates | Users can create or import phishing templates and customize them in a browser-based HTML editor. | The product page lists expert-curated phishing templates in five difficulty tiers and 33 languages. |
Plans
SANS Phishing Platform
- Phishing Training (CIS Aggregate Buy, 2017)$3,000 a year
- SANS Phishing PlatformPriced on request
- SANS Security Awareness / PhishingPrice not published
In their own words
Gophish
Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.
SANS Phishing Platform
SANS Phishing Platform has no write-up on Specifiction yet; its figures are above.