SentryMail

Overview

SentryMail is a self-hosted open-core platform for running phishing-awareness campaigns and measuring individual responses. It is best suited to organizations that want campaign data and training workflows inside their own infrastructure. The open-source Community plan provides a way to self-host the core, but paid plans are aimed at employers with at least 25 employees.

Key features

Campaigns can be scheduled, built from HTML or Markdown templates, or imported from .eml files, then paired with landing pages. Per-recipient tracking of opens, clicks and form submissions helps teams identify who may need follow-up; campaign analytics, a dashboard risk score and CSV export support review and reporting. A phish-reporting button adds a way for recipients to flag suspicious messages.

Automated training can connect campaign outcomes to education. The Enterprise LMS adds self-hosted mandatory video courses, automatic assignment for low awareness scores, quizzes and audit-proof certificates. That is a useful documented training loop for organizations with compliance obligations, but it is not part of the Community core.

Integrations cover LDAP, Microsoft Graph for Azure AD or Entra ID, SCIM 2.0, OIDC/SSO providers and SMTP services including IONOS, Hetzner, Mailgun, SES and Postmark. Enterprise adds SAML SSO, SIEM export to Splunk HEC, Elasticsearch, Microsoft Sentinel or JSON, and LMS xAPI export to a Learning Record Store. These options make SentryMail more suitable for established identity and security workflows than for teams seeking a minimal standalone campaign tool.

Security measures documented by the maker include Argon2id passwords, encryption of secrets at rest, two-factor authentication with backup codes, audit logging and hardened containers. Core also describes SHA-256 hash chaining for audit entries and an exportable evidence package with a standalone verifier. The maker says the platform minimizes personal data, supports pseudonymized reporting and can run entirely within a customer's infrastructure; it also says SentryMail is GDPR-compliant and supports awareness documentation for NIS2. Its compliance center covers GDPR, NIS2, ISO 27001, BSI ORP.3 and § 38 BSIG.

Pricing

Community: free, free forever. It includes the open-source Core features, self-hosting on your own infrastructure and GitHub community support. This is the clearest fit for organizations able to operate their own deployment and make do with community support; it avoids a subscription but does not include the paid plans' stated advanced campaigns, analytics and email support.

Business: custom pricing, billed from €10 / employee / year on an annual subscription tiered by employee count. It includes advanced phishing simulations and campaigns, reporting and analytics, and email support. The minimum is 25 employees, and license purchase is marked “Coming soon,” so it is not a practical ready-to-buy option for smaller employers or teams that need to purchase immediately.

Enterprise: custom pricing, billed from €14 / employee / year, annual subscription, and described as Business plus 40%. It is available only as an upgrade to Business and has the same 25-employee minimum. White-labeling, SAML SSO, SIEM export, AI risk scoring and automated campaigns distinguish it for organizations with broader integration or campaign automation needs. License purchase is also marked “Coming soon.”

Installation is described as a Docker Compose stack, with Linux and Docker Engine as the operating-system requirement. That gives technically equipped teams a self-hosting route, but not a web-only managed deployment choice.

Platforms

SentryMail is available as self-hosted software and on the web. The documented installation path requires Linux with Docker Engine, so teams should be comfortable operating that environment to use the self-hosted option.

Who it's for

SentryMail is a strong fit for organizations that want to run phishing simulations, track responses by recipient and connect results to training while keeping the system within their infrastructure. Its integrations, evidence features and compliance center are particularly relevant to teams documenting security-awareness work. It is a weaker fit for organizations with fewer than 25 employees seeking paid features, or for buyers who need an available paid license now.

Pros and cons

• Pro: Self-hosted open-source Core gives organizations a free route to operate the platform on their own infrastructure.
• Pro: Recipient-level tracking, risk scoring and CSV reporting help turn campaign results into targeted follow-up.
• Pro: Evidence-package verification, audit logging and pseudonymized reporting support documented, privacy-conscious workflows.
• Pro: Enterprise integrations include SAML SSO, SIEM export and LMS xAPI export for organizations that need to connect security and training systems.
• Con: Paid plans require at least 25 employees, ruling them out for smaller employers.
• Con: Business and Enterprise license purchases are marked “Coming soon,” limiting immediate access to paid capabilities.
• Con: The documented deployment requires Linux and Docker Engine, which may not suit teams seeking a fully managed service.

Alternatives

Compare security awareness training software if you want to review the category before choosing a platform.

• Wizer is a freemium web and mobile alternative with a free plan offering basic annual security awareness training, basic user management, limited reporting and automatic learner reminders. Choose it if those training basics and reminders matter more than SentryMail's self-hosting and recipient-level phishing campaign workflow.
• Hoxhunt is a paid alternative available on web, desktop and mobile platforms; consider it if you prefer a paid option with broader listed platform coverage.
• CyberHoot offers a freemium web platform and a $125 a month Autopilot plan with white-labeling, multi-tenancy, automation and interactive HootPhish training. Consider it if those capabilities and a stated monthly plan are a better fit than SentryMail's self-hosting approach and coming-soon paid licenses.
• Proofpoint Email DLP and Encryption is a paid option with web, desktop and mobile platform coverage; consider it if that platform mix is the priority.
• BullPhish ID is another paid web option to consider.
• Check Point MDR/MPR offers custom-priced MDR plans; consider it if you are comparing custom-priced managed detection and response options.
• Cofense PhishMe is a paid web alternative to consider.
• DarkPhish is a freemium alternative for web and Linux.

Verdict

Choose SentryMail if your organization can self-host and wants per-recipient phishing simulations, response evidence and a path into training workflows. Its strongest case is the combination of infrastructure control and reporting-oriented security features. Look elsewhere if you have fewer than 25 employees, need a paid license immediately, or do not want to operate Linux and Docker Engine.