Gophish vs Shirudo

Gophish is an open-source framework for testing an organization's exposure to phishing through simulations. It is intended for penetration testers and businesses conducting real-world exercises. Users can create or import phishing templates and edit them in a browser-based HTML editor. Campaigns send emails in the background and can be scheduled. Results arrive near real time: recipient timelines show email opens, link clicks, and submitted credentials, and campaign results can be exported for reports. For programmatic work, Gophish provides a REST API and a Python client. It can run from a downloaded binary or the official Docker container, across API, Linux, macOS, self-hosted, and Windows environments. The Gophish Community Edition repository includes an MIT License, permitting use, copying, modification, distribution, and sale subject to its terms. The plan is free at free. Listed attachment tracking covers docx, docm, pptx, xlsx, xlsm, txt, html, and ics files. Version 0.12.1 added configurable trusted origins to the CSRF handler for configurations where TLS terminates at an upstream load balancer.

Shirudo is a cybersecurity awareness service combining a serious game, phishing simulations, and communications materials for employee training. The game uses short sessions, progressive learning, several difficulty levels, regular new content, and multilingual access across devices. Topics include phishing, internet use, downloads, malware, authentication, mobile working, and data protection. Shirudo PS lets campaign managers create or customize multilingual phishing templates, schedule email campaigns, and monitor progress and user reactions. Follow-up tools assess user maturity and risky behavior, then generate and schedule reports. Shirudo CT supplies emails, posters, wallpapers, trainer kits, screensavers, and customizable messages. An LMS interface and API access are listed. The service runs on Android, iOS, and the web. SOKIEN BY GREEN IT ADDICT publishes it from Grenoble, France. The provider says it uses security safeguards, encrypts bank-card data, follows GDPR and French data-protection law, and hosts and backs up data through OVH in France with daily saves and secondary replication. Pricing is on request.