Hackiwi

Hackiwi is a security platform for training staff, running controlled phishing exercises, triaging suspicious messages and monitoring external exposure. It is best suited to organisations that want these functions together, particularly teams of up to 20 users. The free small-organisation tier is unusually broad, while verification and scale limits make it a less suitable choice for individuals or larger deployments.

Overview

Hackiwi covers the main stages of security-awareness work in one service: teach users, measure their responses to simulated attacks, classify reports and watch for risks outside the organisation. That combination can spare a small security team from stitching together separate training, reporting and exposure tools.

Its public training library can be browsed without an account and is released under CC-BY-4.0. Organisations that need control over infrastructure can run the AGPL-3.0 code themselves. The web and self-hosted options therefore suit both teams seeking a hosted workflow and those with the capacity to operate their own installation.

Key features

Training and phishing simulations

Video and written modules use interactive knowledge checks, learning-path assignment and completion tracking. Automated training and SSO support are included, making the platform more appropriate for structured programmes than for a library that employees simply visit at will.

Campaigns record opens, clicks and reports, with safety gates, audit logging and delivery restricted to verified domains. Submitted credentials are not retained; Hackiwi records the event instead. These controls reduce the risk of a simulation becoming a data-storage problem, but the simulator is not offered to individuals or families and requires organisational domain verification.

Reporting and exposure monitoring

Users can forward suspicious messages from any desktop or phone mail client. Hackiwi says reports receive automated classification and reputation checks, which can help a small team sort incoming reports without manually reviewing every message first.

Exposure tooling covers scope-locked OSINT, website scanning, dependency CVE tracking, domain monitoring and alerts for newly registered lookalike domains. This extends the product beyond awareness training into ongoing external-risk monitoring, although organisations should assess whether its scope matches their own security operations before replacing specialist tools.

Pricing

Individuals and families — free. The whole library and premium tools are included, and no account is needed to browse. This is useful for personal learning, but the phishing simulator is restricted to verified organisations, so individuals cannot use that function.

Organisations up to 20 — free. This tier provides the full platform for up to 20 users, including phishing simulation after domain verification. It is the clearest value proposition for small businesses and non-profits that need training, reporting and exposure features without a subscription.

Organisations over 20 — custom pricing. The training library remains free, while premium administrative tooling is paid at scale. Larger teams should budget for a paid arrangement rather than assume the 20-user offer extends indefinitely. Hackiwi says no credit card or sales call is required to get started.

Platforms

Hackiwi is offered as a web service and as self-hosted software. Self-hosting is supported by the AGPL-3.0 licence and suits organisations that want to run the platform on their own infrastructure; the hosted option is the simpler route for teams that do not want that operational responsibility.

Who it's for

Choose Hackiwi if you are a small organisation seeking one free platform for assigned security education, measured phishing exercises, suspicious-message reporting and exposure monitoring. It is also a good fit for teams that value a browsable, openly licensed training library or need a self-hosting option.

It is not a strong fit for a family or individual wanting to run phishing simulations, because those campaigns require a verified organisation. Larger organisations should expect paid premium tooling and should confirm that the administrative capabilities at scale meet their requirements.

Pros and cons

• Pro: Organisations with up to 20 users get the full platform free, including simulations after verification.
• Pro: Training, reporting and exposure monitoring sit in one workflow, reducing the need for several separate products.
• Pro: Simulation safety gates, audit logging and non-storage of submitted credentials provide important safeguards.
• Pro: Self-hosting under AGPL-3.0 gives infrastructure-conscious teams more deployment control.
• Con: Simulation access is limited to verified organisations, excluding individuals and families from that feature.
• Con: Teams above 20 users pay for premium administrative tooling, so the free offer does not scale with headcount.

Alternatives

Wizer is a better choice when you want a free annual awareness-training plan with basic user management, learner reminders and limited reporting across Android, iOS, API and web.

DarkPhish suits teams wanting a free, self-hosted simulation engine with up to 100 managed users, one active campaign, basic reporting and a REST API.

Gophish is the simpler pick if you need a free, open-source phishing framework across major desktop platforms and self-hosting.

SentryMail is another freemium self-hosted and web option for organisations comparing community offerings.

Cofense PhishMe is worth considering when you prefer a paid product with free and enterprise plans rather than Hackiwi's 20-user boundary.

RansomLeak is an alternative for teams seeking a free exercise library with a trial and self-hosted or web deployment.

Hoxhunt fits organisations prepared to buy a per-employee custom quote across desktop, mobile and web platforms.

Infosec IQ is the alternative for buyers needing enterprise plans with LMS integration and SCORM support.

Verdict

Hackiwi is a strong recommendation for organisations of up to 20 users that want training, phishing simulation, report triage and exposure checks in one free platform. Its breadth, self-hosting option and safety controls are the main reasons to choose it. Look elsewhere if you are an individual wanting simulations or a larger organisation that needs predictable, no-cost administration beyond the 20-user limit.