Overview

CanIPhish pairs simulated attacks with adaptive training, aiming to help organizations improve how employees recognize and respond to phishing. It serves managed service providers, enterprise customers and organizations of varying sizes across more than 65 countries, and is headquartered in Queensland, Australia.

The multichannel scope and public API make it relevant to teams that want simulations to fit into existing security workflows. For organizations primarily seeking data loss prevention rather than awareness training, it is not a direct substitute.

Key features

Simulations across channels

CanIPhish supports email, voice and web phishing simulations, with more than 140 ready-to-go scenarios. Campaign templates can track clicks, credential entries, attachment opens and replies, and support domain spoofing. That gives security teams several ways to measure employee responses, though email reach is constrained by subscription employee count rather than an unrestricted address pool.

Adaptive campaigns and training

Autonomous phishing mode uses OSINT, user context and historical data to choose content and timing for each person. Campaign automation, risk scoring and training content are supported, making the product more than a scenario library; teams can use it to connect simulated behavior with follow-up learning.

Voice and web content creation

The AI voice capability can hold dynamic conversations across languages, accents and personas, and can clone a voice from a short audio sample. The website generator can clone templates or create bespoke phishing sites from scratch. These options broaden simulation design, but organizations should weigh the realism they enable against their own internal policies for training exercises.

Integrations, API and controls

Included integrations and add-ons cover Microsoft Entra ID, Google Workspace, Gmail Report Phish and Outlook Report Phish. The public API can read campaign results, human-risk scores, dark-web breaches and domain-supply-chain posture, and manage campaigns, employee lists, content and platform settings. Teams with existing automation can use that breadth to incorporate CanIPhish into their workflows.

Email delivery can use CanIPhish SMTP, Google Workspace or Microsoft 365 Direct Email Injection, or a customer-controlled third-party SMTP server. Customer data can be stored in configurable locations including Australia, the United States, the United Kingdom, Canada, South Africa, Germany, the United Arab Emirates, Brazil and Singapore. Sensiba finalized a SOC 2 Type 2 attestation report on January 22, 2026, covering security, availability and confidentiality controls. CanIPhish bases its policies and procedures on the NIST Cybersecurity Framework and the Australian Cyber Security Centre Information Security Manual.

Pricing

CanIPhish is freemium, with no free trial. The key constraint across plans is email reach: unique email addresses are limited according to subscription employee count, and the allowance refreshes monthly.

Plan	Price and term	Fit
Free	0.00 USD per free (billed forever; up to 10 employees)	A small team can use the platform without a recurring charge, but the 10-employee ceiling and monthly email allowance make it a limited fit for larger rollouts.
Professional	0.00 USD per month (billed monthly; minimum 11 employees)	The monthly term and 11-employee minimum position it for organizations moving beyond the free plan. Email reach remains linked to employee count.
Enterprise	0.00 USD per month (billed annual only; minimum 25 employees)	The annual-only term and 25-employee minimum suit larger organizations prepared for a yearly commitment; the employee-linked email limit still matters for campaign planning.

The paid-tier prices are shown as 0.00 USD per month, but no paid-plan feature breakdown accompanies them, so those figures do not establish what each tier includes. Teams should compare the employee thresholds and billing terms against their intended rollout before choosing a plan.

Platforms

CanIPhish is available on the web and through an API. That combination suits teams that want both a browser-based campaign interface and programmatic access to results and campaign management.

Who it's for

CanIPhish is a strong candidate for security teams, MSPs and organizations that want adaptive simulations across email, voice and web, with reporting and API access. Configurable data residency and multiple delivery methods also give teams options when aligning the service with their operating environment.

It is a weaker fit for teams that need an uncapped email audience, a clear paid-plan feature matrix, or a dedicated data loss prevention product. The monthly recipient refresh and employee-based cap should be factored into campaign design, especially for organizations with broad or frequently changing address lists.

Pros and cons

Pros: Email, voice and web simulations plus more than 140 scenarios support varied training programs.
Pros: Individualized content selection, campaign automation, risk scoring and training connect exercises with adaptive learning.
Pros: The public API covers both reporting and campaign administration, which can support integration into security workflows.
Pros: Multiple email delivery methods and configurable data residency offer operational flexibility.
Cons: Unique email addresses are capped by subscription employee count and refresh monthly, limiting campaign reach.
Cons: Free access ends at 10 employees, while Enterprise requires at least 25 employees and annual billing.
Cons: The plan prices alone do not clarify the differences in included features between tiers.

Alternatives

For a broader comparison, browse Phishing Simulation Software.

Keepnet Phishing Simulator is worth considering when employee-count-based pricing, standalone use or one-time PAYG simulations for consulting work better suit the buying model.
CyberHoot is an alternative for buyers seeking a web-based freemium product with a free trial; its Autopilot plan is 125.00 USD per month.
SoSafe may fit teams that want a stated annual entry plan with 50 seats, onboarding, support, simulations, training and compliance-ready reporting; it starts at 625.00 EUR per year.
Trellix Data Loss Prevention is the more relevant choice for enterprise DLP across endpoints, email, web, networks and storage, with on-premises or SaaS management.
SMARTFENSE Simulation Tools is another paid simulation option with support across a broad range of platforms.
Fortra Data Security Posture Management may suit mid-sized or evolving security environments looking for an Advanced plan with enhanced support and required Quick Start Implementation.
Mimecast Data Leak Prevention is a paid alternative focused on data protection.
Proofpoint Email DLP and Encryption is another paid option for teams evaluating email DLP and encryption.

Verdict

Choose CanIPhish if you want a broad, adaptive phishing-awareness program with email, voice and web simulations, flexible delivery options and an API that reaches into campaign management. Look elsewhere if recipient caps constrain your program, if you need clearly differentiated paid-plan inclusions before buying, or if your priority is data loss prevention rather than employee simulation and training.

	CanIPhish	CyberHoot
Free plan	Yes	No
Free trial	No	Yes
Paid from	Free	$125/mo
Open source	No	No
Platforms	api, Web	Web
Free plan	Yes	Yes
Simulation channels	multichannel	—
Campaign automation	Yes	—
Landing page builder	Yes	—
Risk scoring	Yes	Yes
Training content	Yes	—
API access	Yes	—

CanIPhish vs CyberHoot

CanIPhish

CyberHoot