Phishing awareness software: 10 criteria to choose (2026)

The phishing awareness market includes more than 40 vendors in 2026: from American giants like KnowBe4 to European startups, along with modules built into existing security suites. For an IT manager or CISO at an SMB, picking the right anti-phishing tool from this crowded field is a daunting exercise. And mistakes are expensive.

The most common mistakes when choosing a phishing simulation solution:

Choosing on price alone. The cheapest platform is rarely the most effective, and hidden add-ons can double the initial bill.

Ignoring reporting quality. A simulation tool that does not produce actionable reports for management and auditors loses most of its value.

Overlooking integration. A solution that does not natively integrate with Microsoft 365, Google Workspace, or Slack creates operational overhead that eventually discourages adoption.

This guide offers 10 objective criteria for evaluating any phishing awareness platform, a ready-to-use scoring grid to compare your shortlist, and a factual overview of the leading solutions on the market in 2026. The goal: to give you the keys to make an informed choice, tailored to your context and budget.

Before you start

• The market counts more than 40 vendors; the usual buying mistakes are choosing on price alone, ignoring reporting quality and overlooking integrations.
• In KnowBe4’s 2025 benchmarking report, the average click rate falls from 33.1% to 4.1% after 12 months of simulations and training.
• For a 100-person company, a simulation platform costs roughly 1,000 to 3,000 euros per year.
• The criteria that most often decide the choice for an SMB: reporting quality, how far you can customize simulations, and what happens to real suspicious emails that employees report.

Why invest in a phishing simulation platform

Before comparing anti-phishing tools, it is worth understanding why not investing costs more in 2026, and why the alternatives (manual in-house training or no training at all) are no longer viable.

The regulatory environment demands action

The European NIS2 directive, enforceable in France since October 2024, requires companies in essential and important sectors to implement “cyber risk management measures including staff awareness and training.” ISO 27001 (control A.6.3) requires information security awareness, education and training. In practice, an auditor will ask for evidence that training happens and that results are followed over time. A simulation platform’s campaign history and reports make that evidence much easier to produce than spreadsheets and attendance sheets. For more on regulatory obligations, see our NIS2 guide for SMBs.

The return is measurable

KnowBe4’s Phishing by Industry Benchmarking Report 2025 puts the average click rate at 33.1% before training and 4.1% after 12 months of simulations and training. In financial terms: the median cost of a successful phishing incident for a French SMB is between 15,000 and 300,000 euros (CESIN (French cybersecurity executives association) 2025). The cost of a simulation platform ranges from 10 to 30 euros per employee per year. For a 100-person company, that is 1,000 to 3,000 euros a year against a risk measured in tens or hundreds of thousands of euros.

The alternatives fall short

Manual in-house training (PowerPoint presentations, one-off workshops) is time-consuming, impossible to measure objectively, and its effects fade within 4 to 6 weeks (Gartner, Security Awareness Program Best Practices, 2025). It provides no audit-ready compliance evidence.

No training at all is the riskiest scenario. The Proofpoint State of the Phish 2025 report shows that one in three employees clicks on a phishing link without prior training. For a 100-person company, that means about 33 potential entry points for attackers. To structure a full program: Cybersecurity training guide for SMBs.

For a deeper dive on the ROI argument to present to your management, see our dedicated article on cybersecurity awareness ROI.

The 10 evaluation criteria for an anti-phishing solution

Here are the ten criteria every company should assess before choosing a phishing simulation platform. For each criterion: why it matters, what to ask the vendor, and the red flags to watch for.

1. Simulation customization

An effective phishing simulation must replicate the conditions of a real attack targeting your company specifically. Generic templates sent from a shared domain mostly test whether your teams recognize a test email.

Questions to ask the vendor:

• Can we use our own custom sending domains?
• Are templates editable in HTML, or limited to a visual editor?
• Can we create spear phishing scenarios with dynamic variables (recipient name, department, manager)?
• Can we tailor scenarios to our company’s business context (industry, internal tools, suppliers)?

Red flags: Locked-down templates that cannot be modified, a generic sending domain shared across all clients (something like loginform.net), or the inability to create custom scenarios. If you cannot adapt simulations to your business reality, the exercise loses most of its educational value.

What user reviews show: On review platforms like G2, customization is one of the criteria most frequently mentioned in negative reviews. Some popular solutions have accumulated more than 12 negative mentions about simulation customization limitations: a sign of a structural problem, not an isolated case.

2. Reporting and analytics quality

Reporting is what lets you steer the program. Without actionable reports, you cannot measure progress, justify the investment to management, or demonstrate compliance to auditors.

Questions to ask the vendor:

• Are reports exportable as PDF for the executive committee?
• Is there a breakdown by department, team, or seniority?
• Are monthly and quarterly trends visualized automatically?
• Can results be compared to industry benchmarks?
• Is the reporting rate tracked (not just the click rate)?

Red flags: A basic dashboard with no export capability, the absence of advanced KPIs (no reporting rate, no reaction time), or reports that are too technical for a non-specialist executive to use. Reporting is the criterion that generates the most frustration among simulation platform users: on G2, some tools have accumulated up to 14 negative mentions specifically about reporting shortcomings.

3. What happens to real suspicious emails

Most awareness platforms stop at simulation: they send test emails, and a real suspicious email reported by an employee lands in an IT inbox where nobody has time to look at it. Some platforms now analyze the emails employees report and send them an answer, which closes the loop between training and daily work. This analysis does not replace your email filter: it deals with what the filter let through.

Questions to ask the vendor:

• How do employees report a suspicious email (report button, forwarding address)?
• Are reported emails analyzed automatically, and does the employee get an answer?
• Who is alerted when a reported email turns out to be malicious?

Red flags: Reported emails that go nowhere, or an employee who never hears back. With nophi.sh, employees forward a suspicious email (or use the Microsoft 365 Report button pointed at the nophi.sh address) and receive an AI verdict with its reasons, usually in under a minute; your security contacts are alerted. nophi.sh does not filter or block email.

4. Automatic training after a failure

Simulation without remediation is a diagnosis without treatment. When an employee fails a simulation, they should immediately receive training content that matches what they just fell for, rather than the same generic module for everyone.

Questions to ask the vendor:

• Is training triggered automatically after a simulation failure?
• Does the content adapt to the type of attack (generic phishing vs spear phishing vs BEC)?
• Is there a progressive path for repeat offenders?
• Are training modules short (3-5 minute micro-learning) or long 30-minute sessions?

Red flags: Generic training identical for all employees regardless of their level or type of failure, no post-simulation micro-learning, or training modules too long to be completed in full. For a deeper look at training best practices, see our cybersecurity training guide for SMBs and our guide to enterprise phishing simulation.

5. Compliance and audit reports

NIS2 (Article 21(2)(g)) requires staff cybersecurity training, and ISO 27001 (control A.6.3) requires awareness and training. Neither text names phishing simulation, but auditors ask for evidence, and the tool should produce it without manual compilation. Keep in mind that NIS2 requires far more than training.

Questions to ask the vendor:

• Can the platform export an audit report (PDF, CSV) that you can file as evidence for NIS2 or ISO 27001?
• Is the complete campaign history retained and exportable?
• Are data retention policies GDPR-compliant?
• Is a DPA (Data Processing Agreement) available?

Red flags: No exportable report, campaign history limited in duration (less than 24 months), or the inability to export raw data for an external auditor. See our dedicated compliance page to understand the detailed requirements.

6. Integrations (Slack, Teams, Google Workspace, Microsoft 365)

A phishing simulation platform that does not natively integrate with your workplace tools creates operational friction that reduces adoption and effectiveness. Syncing users from Microsoft 365 or Google Workspace saves hours of list maintenance. Check which directories are actually supported: some tools (nophi.sh included) sync Microsoft 365 / Entra ID but only take a CSV import for Google Workspace.

Questions to ask the vendor:

• Is the Microsoft 365 / Google Workspace integration native or does it require a third-party connector?
• Is the Slack / Teams integration included in the base price?
• Is Exchange admin or Google Admin access required for deployment?
• Does the report button install in Outlook and Gmail?

Red flags: Integrations offered as paid extras (some platforms charge for Slack and Teams integrations as add-ons at 2-5 euros per user per month: which can represent a 30 to 50% surcharge on the annual bill). Verify that the quoted price includes all the integrations you need.

7. Multilingual support

For a French company, simulations and training must be available in French: not just the admin interface. Simulation emails need to be written in natural French (not machine-translated), with scenarios adapted to the French context (Ameli, tax authorities, La Poste, etc.). For international companies, multilingual support must cover both scenarios and training content.

Questions to ask the vendor:

• How many languages are available for simulations? And for training?
• Are French scenarios written natively or machine-translated?
• Are scenarios adapted to the local context (brands, government services, customs)?

Red flags: An interface in French but simulations and training available only in English, poor-quality translations (awkward syntax, unnatural phrasing), or scenarios with no adaptation to the local context.

8. Ease of deployment

A platform that takes weeks to configure and requires an external consultant is not suited to an SMB. Deployment should be fast (ideally within a few hours), self-service (no dependency on an integrator), and reversible (ability to cleanly uninstall if needed).

Questions to ask the vendor:

• What is the average deployment time for a company of our size?
• Does setup require Exchange admin / Google Admin Console access?
• Is SSO (Single Sign-On) available and included in the price?
• Is a step-by-step deployment guide provided?

Red flags: A deployment quoted as “several weeks” (for an SMB, this means the tool is too complex), the need for a consulting engagement for initial setup, or SSO billed as an extra.

9. Transparent pricing

Pricing is the criterion where unpleasant surprises are most common. Some platforms display an attractive entry price, then charge separately for every essential feature: Slack/Teams integrations, advanced training modules, compliance reports, dedicated support, custom sending domains. The actual bill can be two to three times the advertised price.

Questions to ask the vendor:

• Is the price public and accessible without a contact form?
• Are there paid add-ons or extra modules?
• Is the model per-user (cost that scales linearly) or flat-rate (predictable cost)?
• What exactly is included in the listed price? And what is not?

Red flags: Opaque pricing accessible only after a sales call, essential features (advanced reporting, integrations, detection) sold as separate add-ons, or a per-user pricing model with no cap that makes costs unpredictable for growing companies. See nophi.sh pricing for an example of transparent, flat-rate pricing.

10. Support and guidance

Even the best platform requires responsive support, especially during initial deployment and the first campaigns. For a French SMB, support in French with guaranteed response times is a deciding factor.

Questions to ask the vendor:

• Is support available in French?
• What is the guaranteed response time (SLA)?
• Is there a dedicated account manager or CSM?
• Is technical support included in the price or billed separately?

Red flags: English-only support, a chatbot with no access to a human, response times not contractually guaranteed, or premium support billed as an extra.

Scoring grid: evaluate your shortlist

Use this grid to objectively compare the solutions on your shortlist. Assign a score to each criterion based on your evaluations and demos.

Criterion	Weight	Solution A	Solution B	Solution C
Simulation customization	/10
Reporting and analytics	/10
Real phishing detection	/10
Automated training	/10
Compliance and audit	/10
Integrations	/8
Multilingual support	/7
Deployment	/8
Pricing	/8
Support	/7
TOTAL	/88

How to interpret the results:

• Score above 70/88: Excellent. The solution checks all the essential boxes. Verify the contract terms and go for it.
• Score between 55 and 70/88: Good. The solution is solid but has gaps on certain criteria. Assess whether these gaps are acceptable for your context.
• Score below 55/88: Insufficient. The gaps are too significant to justify the investment. Continue your search or negotiate improvements with the vendor.

Tip: Weight the criteria according to your context. If NIS2 compliance is your priority, the “Compliance and audit” criterion deserves a multiplier. If you have international teams, “Multilingual support” moves from 7 to 10. The grid is a framework: adapt it to your priorities.

Evaluate nophi.sh with this grid: 80 email scenarios, training assigned automatically after a failed test, a PDF audit report and AI analysis of forwarded emails, for a flat price. Create a free account and launch a first campaign the same day.

Market overview in 2026

The phishing awareness solutions market is structured around two categories: generalist platforms (mostly American, designed for large enterprises) and European platforms (often better suited to SMBs and European regulatory requirements). Here is a factual overview of the most prominent players.

Generalist platforms

KnowBe4 is the undisputed global leader in market share. Its simulation template library is the largest on the market (more than 15,000 scenarios), and its training database covers a wide range of topics. However, this breadth comes with significant usability complexity. The admin interface is dense and requires a steep learning curve. The pricing, based on user volume with tier thresholds, can prove costly for mid-sized SMBs. Support is primarily in English, and while French-language content exists, it is less extensive than the English catalog.

Proofpoint Security Awareness (formerly Wombat) integrates naturally into Proofpoint’s email security suite. For companies already using Proofpoint for email filtering, the complementarity is obvious. On the other hand, the solution is firmly positioned as “enterprise”: the price, deployment complexity, and commercial model make it difficult to access for SMBs. Compliance reports are solid, but simulation customization is more limited than with pure-play vendors.

Cofense (formerly PhishMe) excels at simulation and reporting (the Cofense Reporter button is widely deployed). Its strength lies in analyzing threats reported by users. However, automated post-failure training is less developed than with awareness specialists, and the interface is considered dated by many users on G2.

European platforms

Riot is a French platform that has gained visibility thanks to a modern interface and a gamification-focused positioning. Its playful approach to training appeals to end users. However, an analysis of public reviews on G2 reveals recurring friction points: reporting is described as “limited” or “basic” in many user reviews, simulation customization is restricted (sending domains and templates lack flexibility), and some essential features (advanced Slack/Teams integrations, specialized training modules) are offered as paid add-ons, which significantly increases the total cost. Riot does not offer real phishing detection: the platform is limited to simulation and training. For a detailed comparison, see our KnowBe4 vs French solutions comparison.

nophi.sh is a French platform for email phishing simulation (80 scenarios in French and English), training assigned automatically after a failed test, and AI analysis of suspicious emails that employees forward. It does not simulate SMS, QR code or voice attacks, and it does not filter email. Pricing is flat per plan rather than per user (Starter: 99 euros excl. VAT per month up to 50 users), and data is hosted in France. Discover the nophi.sh simulation platform and pricing.

SoSafe is a German platform that has raised significant funding and positions itself as the European champion of awareness training. Its gamified training is high quality, and multilingual content is well developed (German, English, French). Points to watch: simulation customization is less advanced than with some competitors, and the pricing is on the premium end, which can be a barrier for smaller SMBs.

What the market overview reveals

Two defining trends are emerging in 2026.

Consolidation around integrated platforms. Buyers increasingly expect simulation, training and the handling of reported emails in the same tool.

NIS2/GDPR requirements favor European hosting. Platforms hosted in Europe with local-language support are gaining ground, at the expense of American vendors struggling to adapt their offerings to the European regulatory context.

The 5 questions to ask during a demo

The product demo is the moment of truth. Beyond polished sales presentations, here are the five questions that reveal the reality of the product.

1. “Can you show me a complete simulation report exported as PDF?”

This question tests the depth of reporting: the criterion that generates the most post-purchase disappointment. Do not settle for an online dashboard: ask for a PDF export as you would present it to your executive committee. The report should include the key KPIs (click rate, reporting rate, reaction time), segmentation by department, trends across multiple campaigns, and actionable recommendations. If the vendor cannot produce this document in a few clicks during the demo, reporting will not be any better in production.

2. “How does post-failure remediation work exactly?”

Ask for a full demonstration of the post-click path: what does an employee see after clicking a simulated phishing link? Is the remediation page customizable? Is the micro-learning module adapted to the type of attack? Is there a different path for repeat offenders? The best platforms show a smooth and supportive path. The weaker ones show a generic page identical regardless of the simulation.

3. “What is the average deployment time for a company of our size?”

This question forces the vendor to be specific. For an SMB with 50 to 200 employees, deployment should not take more than half a day. If the vendor mentions “several weeks” or the need for an “integration project,” that signals the tool is not designed for your segment. Also ask what technical permissions are needed (Exchange admin access, DNS, etc.) to assess the burden on your IT team.

4. “Are there any additional costs beyond the listed price?”

Ask the question directly and listen carefully to the answer. The most common add-ons: Slack/Teams integrations, advanced training modules, custom sending domains, compliance reports, premium support, SSO. Request a simulated annual invoice that includes all the features you need: not just the base price. Compare total cost of ownership (TCO), not the entry price.

5. “How does your platform help me prove NIS2 compliance?”

This question tests the solution’s maturity on the regulatory front. A good answer: an exportable audit report, a complete history of campaigns and results, and documentation of the awareness program you can hand to an auditor. Be wary of the opposite excess too: no training tool “covers NIS2” on its own, because the directive requires risk management, incident handling, business continuity and much more.

You can put these 5 questions to nophi.sh during the 14-day free trial: full product, no credit card. Create a free account.

Frequently asked questions

Should I choose a French or an international solution?

The choice between a French and an international solution depends on several factors.

Data location: GDPR does not prohibit hosting outside Europe (under certain conditions), but hosting in France simplifies compliance and reassures DPOs (Data Protection Officers).

Quality of French-language content: a natively French solution will offer more realistic scenarios (French brands, administrative context, communication habits) than a translated English catalog.

Support: French-language support during CET business hours is a real everyday advantage. For a French SMB without a dedicated cybersecurity team, a French or European solution is generally the most pragmatic choice.

What budget should I plan for a phishing simulation platform?

The market is structured around three price ranges. Entry-level solutions cost 3 to 8 euros per user per year, offering basic features (simulation and micro-learning) but often limited in reporting and customization. Mid-range solutions cost 10 to 25 euros per user per year and cover simulation, training, advanced reporting, and integrations. Enterprise solutions exceed 30 euros per user per year: they target large organizations with complex needs (multi-entity, API, SIEM). For a 100-person SMB, the typical annual budget falls between 1,000 and 2,500 euros all-inclusive. Watch out for per-user models that penalize growth: a flat-rate model is more predictable. Always compare the TCO (total cost including add-ons) rather than the advertised unit price.

Can I use a simulation solution AND keep my existing email filter?

Yes, and it is actually recommended. A phishing simulation platform is not meant to replace your email filter (Microsoft Defender, Proofpoint, Barracuda, etc.) but to complement it. The two layers work together: the email filter blocks technical threats, the simulation trains the human factor. Most simulation platforms require whitelisting their IP addresses in your email filter so that simulations reach inboxes. Some platforms, including nophi.sh, also analyze the suspicious emails employees forward and send back a verdict; this works alongside the existing filter and does not block anything.

How do I convince my management to invest in a simulation tool?

The most effective argument combines risk figures, regulatory requirements, and measurable ROI. Present the median cost of a phishing incident (15,000 to 300,000 euros for an SMB) against the cost of the platform (1,000 to 3,000 euros per year). NIS2 mandates documented awareness measures: the absence of a program exposes the company to penalties and executive liability in the event of an incident. And unlike most cybersecurity investments, phishing simulation produces tangible metrics (before/after click rates) that demonstrate return on investment within months. Propose a 3-month pilot to prove effectiveness before committing to an annual contract. For industry benchmarks to present to your management, see our article on phishing click rates by industry.

What is the difference between phishing simulation and penetration testing?

Phishing simulation and penetration testing (pentest) are two complementary exercises that target different vulnerabilities. A pentest assesses technical vulnerabilities in the infrastructure (servers, applications, network) and is conducted by offensive security experts, typically once or twice a year. Phishing simulation assesses human vulnerability (employees’ ability to detect a phishing attempt) and is conducted monthly on an ongoing basis. A pentest may include a phishing component (sending phishing emails as part of the test), but that is a one-off exercise with no training dimension. Phishing simulation is a continuous program that includes remediation and training: it is a tool for improvement, not just a diagnostic.

Next step: score three tools this month

Pick three platforms, run each one through the grid above during a demo or trial, and ask for the PDF report and the post-click page on day one. The comparison you build yourself, grid in hand, is worth more than any marketing page or sponsored ranking, this one included.

nophi.sh can be one of the three: the 14-day trial gives access to the full product, with no credit card and no automatic charge at the end.

Create a free account | See the KnowBe4 vs French solutions comparison