PhishingBox
About
PhishingBox is a phishing simulation and cybersecurity training platform company based in Lexington, Kentucky. The platform combines realistic phishing attack simulations, security awareness training, behavioral analytics, AI-powered risk scoring, and threat reporting tools to help organizations reduce human risk. It serves organizations of varying sizes across industries including banking, education, healthcare, financial services, manufacturing, and retail.
Details
VenSearch Intelligence
Ideal Customer
- PhishingBox is positioned primarily for SMB and lower-mid-market organizations, with third-party analysts describing its sweet spot as buyers who want focused phishing simulation tooling without the price point or operational complexity of enterprise platforms.
- The platform is cloud-based and designed for small to large organizations, with pricing tiers targeting individuals and small teams, growing teams of 10–50, and MSP/reseller channel partners managing multiple client accounts.
Key Differentiators
- PhishingBox differentiates primarily on price competitiveness, simulation depth, and customization flexibility for SMB and lower-mid-market buyers, positioning itself as a cost-effective alternative to larger platforms like KnowBe4 and Cofense.
- The platform's white-label capability—described as powering several leading security platforms in the market—gives it a distinct channel and OEM angle, while its integrated ecosystem spanning phishing simulation, human risk scoring, KillPhish email reporting, Security Inbox triage, LMS, and managed services makes it a consolidated solution for lean teams.
Industries Served
- PhishingBox explicitly targets banking, education, financial services, manufacturing, non-profits, professional services, and retail as named industry verticals, and is also noted by third-party sources as serving healthcare, finance, and government sectors.
- Its compliance training content covers HIPAA for healthcare, PCI-DSS and FFIEC/GLBA for financial institutions, GDPR for European-facing organizations, and SOC 2 for technology and services companies.
Service Coverage
- PhishingBox operates globally, serving both direct clients and partners from its headquarters in Lexington, Kentucky, with cloud infrastructure hosted on the AWS network in Northern Virginia (US instance) and Frankfurt, Germany (EU instance) to support data residency requirements in both North America and Europe.
- The company describes itself as 'trusted worldwide' and its platform and services are used by organizations globally, with employees spanning multiple continents including North America, Asia, and Europe.
Partnerships
- PhishingBox has a formal Solution Provider / MSP Reseller program that includes white-label capabilities, multi-client account management, and a partner-branded delivery model, allowing MSSPs and IT solution providers to resell and co-brand the platform.
- Technology integrations span Microsoft (Microsoft 365, Entra ID, Azure AD, Microsoft Graph, Outlook), Google (Google Workspace, Google Gemini, Google Chronicle), AI platforms (OpenAI, Anthropic), LMS platforms (Litmos/SAP, Cornerstone, Bridge, Captivate, SmarterU, Moodle), identity providers (Okta, OneLogin, Ping Identity), SIEM tools (Splunk), and communication tools (Slack, Amazon Translate, LDAP).
Company Size & Ownership
- PhishingBox was founded in 2005 (originally as a social engineering testing tool for an audit and consulting firm) and became a stand-alone company in 2016 following a merger with eLink Design.
- The company currently has approximately 21–25 employees across multiple continents, with 2024 revenue reported at approximately $2.8 million, up from $1.7 million in 2023 and $1.3 million in 2021, reflecting consistent year-over-year growth.
Compliance & Certifications
- PhishingBox has publicly announced completion of a SOC 2 Type 2 audit conducted by MCM CPAs & Advisors LLP, with its report validating internal controls meeting AICPA Trust Services Principles for security.
- The platform supports customer compliance workflows aligned to SOC 2, HIPAA, PCI DSS, ISO 27001, and GDPR, though PhishingBox notes that its training supports compliance efforts but that certification or legal compliance depends on the customer's full control environment.
Compiled from public sources by VenSearch · Last researched October 14, 2026
Offerings
14 offeringsAPI
The PhishingBox application programming interface (API) provides a method to integrate the platform into custom security awareness training solutions and external workflows. Teams can access risk score data, automate processes, and pull platform data into reporting, SIEM tools, executive dashboards, client reporting, or other internal security processes. It is designed to support developer-led customization and automation of platform management.
AuditFindings
AuditFindings is a web-based audit issue management platform affiliated with PhishingBox that replaces spreadsheet-driven follow-up with a structured system for capturing findings, assigning corrective actions to owners, tracking due dates, and monitoring resolution progress. It supports imports from CSV or spreadsheet sources, exports to Excel or PDF, a custom report writer, dashboard views for issue aging and priority, and secure hosted delivery. The platform has been in service since 2016 and is positioned as the remediation and follow-through counterpart to the PhishingBox awareness and testing tools.
Cybersecurity Training
A training delivery capability within PhishingBox that provides phishing-triggered training moments, recurring course assignments, SCORM-ready content, KillPhish coaching, and SecurityTips reinforcement from one connected platform. It covers topics including phishing awareness, AI security, privacy, malware, social engineering, HIPAA, GDPR, and more. Training can be assigned for new hire onboarding, annual awareness cycles, and automated remediation after failed phishing simulations.
Human Risk Management
A platform feature that assigns dynamic risk scores to individual employees and groups based on phishing simulation behavior, training engagement, email reporting activity, and AI-assisted signals. Security teams can use dashboards to identify high-risk users and departments, compare group trends, and connect risk scores to targeted training and remediation workflows. The scoring model is customizable, including color bands, weighted averages, and how much specific events can move a score up or down.
Integrations
PhishingBox offers integrations with third-party applications including Microsoft 365, Google Workspace, OpenAI, Anthropic, Google Gemini, and LMS platforms such as Litmos, Cornerstone, Bridge, and Captivate to streamline user syncing, SSO access, notifications, and training workflows. Integrations also support HRIS, CRM, SIEM, and other operational systems. The API allows teams to connect platform data including risk scores to custom reporting and external security processes.
KillPhish
An email scanning and phishing reporting tool delivered as a Microsoft Outlook add-in and Google Workspace reporting button that allows employees to flag suspicious emails directly from their inbox. It reviews messages against domains, IPs, SPF records, sender cues, and keywords, and can use AI integrations from OpenAI, Anthropic, or Google Gemini to translate technical signals into plain-language explanations. Reported emails can feed into Security Inbox for triage, update Net Reporter Score metrics, and contribute signals to the Human Risk Management risk score.
Learning Management System (LMS)
A built-in LMS included with PhishingBox Pro and Enterprise plans that enables administrators to assign, deliver, and track cybersecurity training courses including imported SCORM 2004, 1.2, and 1.1 packages, as well as non-SCORM courses built with Video Link, Slideshow Link, and PDF content. It supports enrollment automation tied to phishing simulation failures, completion certificates, progress tracking, and token-based learner access. Teams can also connect PhishingBox to third-party LMS platforms via integrations instead of using the built-in LMS.
Managed Phishing Services
A fully managed service in which the PhishingBox team plans, launches, monitors, and reports on phishing simulation campaigns on behalf of the customer's organization, including campaign strategy, template rotation, targeting, scheduling, and follow-up recommendations. The service is built on top of the Phishing Simulator platform and includes expert review of campaign results and connection of risky behavior to phishing training and cybersecurity training. It is designed for lean security and IT teams that want continuous testing without managing every campaign internally.
Phishing Simulator
A tool that allows security teams to create and run realistic simulated phishing campaigns targeting employees and departments, with support for template libraries, AI-assisted template editing, landing pages, Direct Delivery, callback phishing, and advanced scheduling. Employee actions such as clicks, data submissions, and email reports are tracked and can automatically trigger training moments and LMS course enrollments. Results feed into Human Risk Management and compliance reporting workflows.
Phishing Training
A solution that automates the connection between phishing simulation failures and targeted employee remediation, including Training Moments shown immediately after a failed test and automatic course enrollment through the Phishing Simulator workflow. Teams can use the Phishing Email Library of ready-built templates and landing pages and customize emails, pages, and training moments with a template editor. The solution tracks clicks, submissions, attachments, and reports throughout the campaign lifecycle.
Secure Global Cloud & Data Residency
PhishingBox provides hosted regional cloud infrastructure in Northern Virginia (US instance) and Frankfurt (EU instance) to support data residency, privacy, and procurement requirements for organizations in different geographies. Customers can choose which instance hosts their platform data to align with regional security and regulatory needs. The company states plans to expand its hosted footprint into additional regions as business grows.
Security Awareness Training
A continuous security awareness training program solution that combines scheduled course assignments, phishing-triggered remediation, new hire onboarding training, SecurityTips reinforcement, and compliance-oriented reporting covering SOC 2, HIPAA, PCI DSS, ISO 27001, and GDPR. The platform supports a Training Wall feature that surfaces required courses directly in the employee's path when deadlines arrive. Course topics include phishing awareness, information security, data privacy, HIPAA, GDPR, and AI security practices.
Security Inbox
A lightweight phishing threat identification and mitigation tool that centralizes reported emails from employee inboxes, surfaces phishing patterns, and supports security operations team workflows for reviewing and responding to threats. It includes tools for triage, blocklists, attack replication, Advanced Threat Graph intelligence, and sending consistent guidance back to employees. Reported emails from KillPhish can flow directly into Security Inbox for deeper analysis.
SecurityTips
SecurityTips is a security awareness and embedded reinforcement platform affiliated with PhishingBox that delivers bite-sized security tips, phishing quizzes, short video lessons, and compliance tracking directly inside websites, portals, SharePoint, desktop environments, and internal tools where employees already work. It includes a Training Wall model that interrupts workflow to surface required training when needed, as well as anonymous whistleblower and incident reporting forms with AI-powered severity scoring. The product supports custom branding and partner or reseller delivery.
Considering PhishingBox?
Our team will work with you to determine if PhishingBox is the right fit for your organization. From research and assessment through procurement negotiation and ongoing vendor management — we handle the entire process at no cost to you.