Phished vs Hoxhunt: Security Awareness Training Compared

Security awareness training is two different jobs, done well or not

Security awareness training only works if two separate jobs both get done. One is teaching: giving employees the concepts, phishing, NIS2, GDPR, ISO 27001, DORA, through structured courses and certifications. The other is training the reflex: simulations, reporting, landing pages, and real-time guidance that fire in the moment a risky email or link actually shows up.

Hoxhunt and Phished both build for both jobs. What separates them is how much of that second job, the reflex-training layer, happens automatically versus how much still needs an admin's attention. That's the thread running through every section below.

Why “we run simulations” isn't the same as “we train everyone”

Not every training mechanism reaches the same share of employees, and the gap between them is bigger than most buyers assume.

Simulation-only training reaches a small slice of the workforce by design: only the people who fail a given campaign get a corrective lesson, and even they often skim it. That's consistent with two independent studies presented at Black Hat 2025, one from the University of Chicago and UC San Diego, one from ETH Zurich. The first, a randomized controlled trial of nearly 20,000 employees, found embedded simulation training moved the average phishing failure rate by only about 1.7%, because a median of just 10% of employees fail any given simulation in the first place. Both concluded that simulations alone do little for real resilience, and can be counterproductive.

Think about who actually gets trained in each case.

• A simulation trains the people who fail it. Everyone who spotted it, deleted it, or never opened it that day learns nothing.
• A report button trains everyone who reports. A far bigger group, and it works on real emails as well as simulated ones. But it only fires when someone is already sure enough to press the button.
• In-workflow AI guidance trains the group the other two never touch: the people who do not fail simulations and do not report either. They hesitate over a message, decide on their own, and nobody ever finds out which way they went. In most organisations this is the largest group of the three.

The figures below are Phished's own internal estimate of how much of the attack surface each layer reaches.

Phished vs Hoxhunt: feature comparison

1. Phishing simulations: Phished vs Hoxhunt

Both platforms run adaptive simulations that get harder or easier per person. So the real question is not who can send a phishing test. It is what the programme looks like a year in, once the launch energy has faded and the person who set it up has moved on to something else.

Phished answers that by not requiring anyone. The AI engine writes, targets and sends simulations on its own, tuned to job role, region, language, industry and each person's prior exposure, escalating or easing difficulty per user as behaviour changes. No campaign calendar, no template selection, no monthly planning meeting. The programme is running right now whether or not anyone logged in this week, and that is the difference that compounds: the organisations that plateau on security awareness are rarely the ones that chose the wrong template, they are the ones whose programme quietly stopped being maintained.

Scale is what keeps that engine from becoming predictable. Simulations draw on 4,500+ templates across 25+ languages and arrive from 300+ realistic sending domains, so a programme running unattended for a year does not start repeating itself, and employees never learn to spot the test instead of the threat. This is inventory for the engine, not a catalogue for anyone to browse.

Two agents go further than templates can. Threat Radar takes attacks your own colleagues reported this week, makes them safe and turns them into a simulation that trains everyone else, so the simulation is the thing that actually arrived rather than a plausible invention. Supply Chain profiles your real suppliers and builds simulations from them, because that is where targeted attacks come from. Attackers research a company before they write to it; this tests people the same way.

Channel coverage follows the same principle: a suspicious link in Microsoft Teams, an SMS or a QR code goes straight to the Phished Assistant, which isolates it and coaches the employee on the spot, on the real thing rather than a rehearsal scheduled weeks earlier.

Hoxhunt takes the admin-in-the-loop route. Its simulations personalise by role, behaviour and history, run in 30+ languages, and cover email, SMS, voice and callback, Microsoft Teams and deepfake video. The content comes from a curated library an admin selects from, or from Content Studio, so somebody owns the recurring job of deciding what goes out. If that person is engaged, it works well. If they change roles, the programme’s quality changes with them.

That is the trade. Phished puts the effort where the attack lands, in a programme nobody has to run and guidance at the moment of contact. Hoxhunt puts it into the rehearsal beforehand, with more attack types to rehearse; if simulating voice or deepfake specifically is a procurement requirement, it is the platform that does that. The question underneath is what a drill is worth, given that a simulation only ever teaches the person who failed it.

2. Custom training content: Phished vs Hoxhunt

Generic training libraries rarely match a company's actual policies. Both platforms now solve that with AI, so the question is no longer who can generate custom training. It is what you are starting from, and what you have to do afterwards.

Phished starts with a curriculum that is already finished. Phished Academy is a maintained set of short interactive modules with quizzes, gamification and certifications, mapped to NIS2, NIST, DORA, ISO 27001/27701, GDPR, SOC 2 and HIPAA, with project-based NIS2 implementation templates. It is kept current for you, so on day one there is nothing to write and nothing to approve. Phished documents NIS2 and ISO 27701 coverage explicitly, where Hoxhunt's published regulatory tracks name PCI DSS, HIPAA, DORA and GDPR; Hoxhunt does publish NIS2 guidance elsewhere, so read that as a difference in what each vendor documents rather than a gap in what it can cover.

AI agents then extend that curriculum on your terms. The Policy Transformer turns your own policy document into a training level, so policies get trained instead of sitting unread on the intranet. The Content Creation Agent adds new modules from a prompt. The Policy Evaluator checks training against legislation. The SCORM Agent converts legacy training you have already paid for into interactive Academy content, so nothing is written off when you switch. The Translation Agent translates simulations and training with the HTML intact, so you are not maintaining six versions of the same module by hand.

Hoxhunt starts from the other end. Content Studio is an AI generator that turns your uploaded policies into branded modules in minutes, with a theme editor and translation into 30+ languages, alongside 300+ ready-made modules. The vendor is explicit that nothing reaches employees until an admin publishes it, so the AI removes the writing and leaves the reviewing.

The distinction is the starting point. On Hoxhunt, custom content is how you get training that fits. On Phished it is an optional layer on a curriculum that already stands on its own: the difference between a tool you have to use and one you can use.

3. Repeat offenders: coach, don't punish

Every security team has the same short list of names, and the instinct is to escalate: name them, restrict them, send them on a remedial course. It backfires every time. Punishment suppresses reporting, the one behaviour you most need. People keep clicking because static training never adapts to why they fail, so the answer is training that adapts, not discipline that escalates. Hoxhunt reaches the same conclusion, so on principle the two platforms agree.

Where the two platforms differ is what happens on the day a repeat offender clicks anyway. Phished starts by finding them without being asked: the platform segments the organisation automatically into the groups that carry the risk, first-time clickers, repeat offenders, employees with a low Behavioural Risk Score, new hires, and keeps those groups updated as behaviour changes. Nobody maintains a watchlist.

What you do with those groups is then a choice, not a single switch. Admins can assign a different level of training and protection to each one:

• Extra training. Additional lessons targeted at the behaviour the group keeps getting wrong.
• AI approval. Links are checked automatically before the user can open them or enter data.
• Self approval. The user has to confirm deliberately before a link opens, which breaks the reflex click.
• IT approval. For the highest-risk users, IT signs off before the link opens at all.

At the strictest end sits Zero Incident Mail™ (ZIM): every email a protected user receives opens automatically in an isolated environment, with no action required from them. A malicious link runs in the silo rather than on the endpoint or the network. Most organisations start by switching it on for the segment that keeps clicking, then extend it. That is what separates ZIM from the Phished Assistant in section 5: the Assistant answers when someone asks, ZIM protects whether they ask or not.

Both platforms agree on the principle. The difference is what each can promise the security team. Hoxhunt's answer is pedagogical: escalate difficulty, coach harder, wait for the behaviour to improve. That works, and it takes time, and until it lands the risky click is still a risky click. Phished runs the same coaching with a technical floor underneath it, so the mistake stops being an incident on the day it happens rather than after the training finally sticks.

4. Reporting: training at scale, without the triage

Reporting is the one practice-based mechanism that can reach every employee who uses it, not just the ones who fail a simulation. The act of reporting is itself the training moment, provided the feedback comes back immediately. It arrives in the flow of real work, on a real message, with no session to attend and no landing page to sit through.

That condition is where most programmes break. Instant feedback on a simulation is easy, the platform already knows the answer. A real suspicious email is the hard case: someone has to establish whether it is actually malicious, which conventionally means a ticket, a queue and an analyst, with the answer hours or days later. By then the learning moment has gone and what is left is a security workflow, not a training one.

Phished closes that gap by analysing every reported item automatically, real or simulated. The employee gets an immediate verdict with reasoning, positive reinforcement for a correct report, a gentle explanation for a false alarm, and IT gets no triage queue and no investigation delay. Reports where nobody clicked, downloaded, entered credentials, replied or forwarded resolve on their own, because there is nothing to contain.

Containment is automatic too. A suspected malicious email is moved to spam to stop any further interaction, so the threat is neutralised without anyone clicking anything and without an incident to investigate. Simulation emails are removed from inboxes once a campaign ends, so nobody is tidying up after the training. The reporting flow does the security work and the training work in the same motion.

Hoxhunt automates the verdict too. Its ML model scores the report, cross-references a threat database and returns a maliciousness likelihood with tips inside the reporting workflow, with no analyst queue in between. On that mechanism the two platforms are closely matched, and both are ahead of tools that still route reports to a person.

The difference is who the flow is built to serve. In most deployments a report button is an IT hygiene metric wearing a training badge. Phished pays out on both sides at once, the employee learns and the security team gets time back, and the button is only one way in. For Hoxhunt it is the whole of what your people have, and it only fires once someone has already decided something is wrong.

Which leaves the same open question on both platforms. Reporting rewards the confident. It does nothing for the far larger group who are merely unsure, and that is the next section.

5. AI in-workflow guidance: the Phished Assistant vs Hoxhunt

That group is larger than most programmes assume, and there are two structural reasons it stays untrained:

• Reporting depends on confidence. An employee has to be sure enough of a threat to hit “report.” The people who are merely unsure, not alarmed enough to report, not careless enough to click either, get no input at all and are left to make the call by themselves.
• The reporting mechanism is email-native. A suspicious link in a browser tab, a QR code, or a message inside a business app doesn't have a “report” button to click in the first place, even on a platform that can simulate those channels.

The Phished Assistant closes both gaps in one layer, and it is the part of the platform with no counterpart on the other side of this comparison. Built on patent-pending technology, the subject of a global patent application, it sits in the employee's inbox and browser: when someone hesitates over an email, a link, an attachment, or risky web content, the Assistant opens it in an isolated digital silo, separated from company infrastructure, analyses it, and returns clear guidance before the person acts.

Two things follow. It works outside the inbox, covering browser activity and the business apps where risky links land, including Microsoft Teams, Slack and Zendesk. And it assumes some threats will always get through the filter rather than betting everything on the perimeter. It installs in minutes and supports 18 languages.

That second point is what separates this from an AI email filter. A filter decides from the outside, on signals: sender reputation, authentication records, links matched against what is already known to be bad. Those are exactly the signals an attacker using AI can now satisfy. The Assistant decides from inside the isolation, on the content itself, at the moment the employee is looking at it. So the attack never reaches the infrastructure even when the filter missed it and the person clicked anyway.

Hoxhunt has no equivalent. Its employee-facing tooling is a report button in Outlook and Gmail, and its own documentation describes the learning moment as arriving after a user reports or clicks. For the moment of uncertainty itself its published guidance is manual: hover over the URL and check whether the domain looks right.

A report button asks the employee to have already made up their mind. The Assistant answers the question for the people who have not.

6. Operational workload for IT and security teams

This is the line item that never makes the business case: how many hours a year the platform takes out of a team that is already short of them.

Phished is designed to need nobody. Content generation, report scoring, containment and Assistant queries all run automatically, with no standing review queue anywhere in the system. In most organisations only a small minority of reports ever reach a human at all.

Setup runs through an onboarding wizard in about half an hour, rather than a project with a kick-off date. And the low overhead does not cost results: IPCOS moved from roughly 50% of employees susceptible at baseline to 13% within four months, with no analyst queue to manage. What reaches your team is the record, not the workload.

Hoxhunt's model keeps a person in the loop. Someone curates simulation content from the library, and someone reviews and publishes every AI-drafted Content Studio module before employees see it. It is far less work than running a manual programme, but it is recurring work with a name attached, and it is the first thing to slip when that person is on leave or busy elsewhere.

On integrations the two are level where it counts for deployment. Both connect to Microsoft 365 and Google Workspace and support SSO with SCIM; Phished adds SAML authentication, directory sync for automated provisioning and deprovisioning, and pushes simulation and reporting data to SIEM. Hoxhunt's Behavior Risk Console can additionally pull signals from tools like Defender, CrowdStrike and Zscaler through a custom API, which is worth having if correlating human-risk data across your stack is a project someone is actively resourcing. If it is not, it is a capability that needs the same thing everything else in their model needs: an owner.

7. Pricing: Phished vs Hoxhunt

Neither vendor publishes a full per-seat price list, and for a large deployment both end in a quote. Where they differ is whether you can work out roughly what this costs before you book a call.

Hoxhunt prices per employee. Its pricing page states that the quote depends on two things, how many employees you have and which capabilities you need, and that you receive a full quote after one 30-minute scoping call. There is no published tier card and no entry-level price listed on G2.

Phished publishes three plans, Core, Advanced and All-In-One, starting at $175 per month for the platform rather than per seat. You can see the entry point before you speak to anyone, and it doesn't scale with headcount from the first user, which matters most to smaller teams.

For a large enterprise the difference narrows, since both end in a negotiated number. It matters most earlier: if you are building a business case or sizing a pilot, Phished lets you answer that today and Hoxhunt asks you to schedule something first. Either way, get a quote against your real seat count and compare total cost, not headline positioning.

Phished vs Hoxhunt: which platform should you choose?

Both platforms reject the idea that punishing employees for phishing failures works, and both build adaptive training on positive reinforcement. They diverge on where the effort goes. Hoxhunt went wide across simulation channels and gave admins Content Studio to build training from their own policies. Phished went deep on the moment risk actually occurs.

The deciding question is not which platform gives admins more control over content. It is whether you want that control, or whether you would rather hand the practice-based layer over entirely: simulations and reporting feedback running on their own, Zero Incident Mail™ isolating risky mail for the people most likely to click, and the Phished Assistant answering the employee who is merely unsure. That bet is not untested: more than 6,500 organisations and around 2 million users run on Phished today.

Phished vs Hoxhunt: frequently asked questions

About this comparison