CanIPhish

CanIPhish is an AI-powered phishing simulation and security awareness platform for organizations that want to train staff across email, voice and web. It best suits teams that need tailored campaigns and API control; employee thresholds and a monthly address cap make subscription sizing important.

Overview

The platform combines simulated attacks with adaptive training intended to improve employees’ ability to recognize threats. It serves managed service providers, enterprise customers and organizations of different sizes across more than 65 countries, and is headquartered in Queensland, Australia. Its multichannel scope is a meaningful strength, though the monthly limit on unique email addresses can constrain repeated outreach if the subscription’s employee count is too low.

Key features

Simulations and campaign selection

CanIPhish supports email, voice and web phishing simulations, with more than 140 ready-to-go scenarios. Campaign templates track clicks, credential entries, attachment opens and replies, and support domain spoofing. Autonomous mode uses OSINT, user context and historical data to select content and timing for each person, making it a stronger fit for teams seeking varied campaigns than for those content with a fixed, uniform exercise.

Voice and landing pages

Its AI voice-phishing capability can conduct dynamic conversations in different languages, accents and personas, and can clone a voice from a short audio sample. The website generator can clone templates or create bespoke phishing sites from scratch. Together these tools support simulations beyond standard email, though organizations should choose them only if those channels are relevant to their training needs.

Administration and assurance

Included integrations and add-ons cover Microsoft Entra ID, Google Workspace, Gmail Report Phish and Outlook Report Phish. The public API can read campaign results, human-risk scores, dark-web breaches and domain-supply-chain posture, and manage campaigns, employee lists, content and platform settings. Email can be delivered through CanIPhish SMTP, Google Workspace or Microsoft 365 Direct Email Injection, or a customer-controlled third-party SMTP server.

Customer data can be stored in configurable locations including Australia, the United States, the United Kingdom, Canada, South Africa, Germany, the United Arab Emirates, Brazil and Singapore. Sensiba finalized a SOC 2 Type 2 attestation report on January 22, 2026, covering security, availability and confidentiality controls. CanIPhish bases its policies and procedures on the NIST Cybersecurity Framework and the Australian Cyber Security Centre Information Security Manual.

Pricing

CanIPhish uses a freemium model and offers no free trial. The published prices for its subscription tiers are 0.00 USD, so confirm the applicable commercial terms before choosing a paid-tier label.

• Free: free, billed forever, for up to 10 employees. This is the clear starting point for a small team, but the employee ceiling limits its use for larger organizations.
• Professional: free, billed monthly, with a minimum of 11 employees. The monthly term may suit organizations that need to move beyond the free tier without an annual commitment.
• Enterprise: free, billed annual only, with a minimum of 25 employees. It is positioned for larger deployments, but the annual-only term is less flexible.

For subscriptions, the number of unique email addresses that can be emailed is tied to the subscription employee count, and the address allowance refreshes monthly. Teams should size that count against their campaign reach and cadence rather than assume they can contact an unlimited number of distinct recipients.

Platforms

CanIPhish is available through web and API platforms. The API is useful for organizations that want to manage campaigns or read risk and campaign data through integrations or internal workflows.

Who it's for

CanIPhish is a strong fit for organizations that want to combine phishing exercises, training and campaign automation, especially where voice and web simulations, risk scoring or API management matter. Its free tier can serve teams of up to 10 employees. Larger organizations should weigh the employee minimums and monthly email-address refresh against their intended audience and campaign frequency.

Pros and cons

• Pros: Email, voice and web simulations provide breadth beyond email-only exercises.
• Pros: More than 140 scenarios, personalized selection and detailed response tracking support varied, measurable campaigns.
• Pros: The public API can both retrieve security-related data and manage key platform resources.
• Pros: Configurable data residency and a SOC 2 Type 2 attestation offer useful assurance for organizations with security and location requirements.
• Cons: The free plan stops at 10 employees, while Professional and Enterprise require at least 11 and 25 employees respectively.
• Cons: Monthly unique-address limits are tied to employee count, which may restrict campaign reach for teams that contact a broad population.
• Cons: Enterprise is annual only, so it is less suitable for buyers who need a shorter commitment.

Alternatives

For a broader comparison, browse Phishing Simulation Software. CyberHoot may suit managed service providers seeking a freemium option with a free trial; its Autopilot plan is $125 a month and includes white-label functionality, multi-tenancy, automation, interactive training and videos. Choose Gophish if a free product for Windows, macOS or Linux better fits your needs.

SMARTFENSE Simulation Tools is another paid option across web, API, desktop and mobile platforms. Trellix Data Loss Prevention is a more relevant choice when the priority is enterprise data loss prevention across endpoints, email, web, networks and storage, with on-premises or SaaS management. Hoxhunt is a paid alternative available on web, desktop and mobile.

Keepnet Phishing Simulator may be worth considering for employee-count-based pricing, standalone use or one-time pay-as-you-go simulations for consulting companies. Mimecast Data Leak Prevention is a paid web option whose Advanced plan adds data protection. Proofpoint Email DLP and Encryption is a paid option spanning web, Windows and mobile.

Verdict

CanIPhish is a strong choice for organizations that want tailored phishing exercises across email, voice and web, backed by training, tracking and API controls. Its chief advantage is that breadth; its main caveats are employee thresholds and the monthly unique-address limit. Choose it when those limits fit your program, and look elsewhere if your priority is a platform with a different pricing structure or a narrower data-loss-prevention focus.