Every European security awareness training tool reviewed
Cologne, Germany
Founded 2018
Plans start from EUR 625 per month billed annually and include 50 seats, covering onboarding and set-up, basic support, ready-to-use phishing simulations, training and compliance-ready reporting; Enterprise Support is a separate purchase
Best for: Mid-sized companies that want a certified, multilingual programme with a published entry price
SoSafe is run by SoSafe SE at Lichtstrasse 25a in Cologne, entered at the Cologne Local Court under HRB 121629, with Dr. Niklas Hellemann as managing director.
He co-founded the company in 2018, and the company describes a product team in which more than 30 percent have a social science or psychology background. The platform has four parts: security awareness training, smart phishing simulations, an AI copilot called Sofie and a human risk management tool. The SE in its name is the European company form, and its privacy policy names an external data protection officer at a firm in Hamburg.
The Core plan lists more than 40 lessons and Advanced more than 75, delivered in 36 languages, with gamified learning paths and awareness assessments.
SoSafe states ISO/IEC 27001:2022 certification and says it participates in TISAX, and it describes its platform as hosted in industry-leading cloud infrastructure, without naming a country or provider. That last point is worth asking about in a data processing agreement, since hosting is the most common question from German and Dutch works councils. The platform also lists personalised and gamified learning journeys and reporting that shows where employee risk sits and where attention is needed.
Plans start from EUR 625 per month, billed annually, and include 50 seats with onboarding, basic support, ready-to-use simulations, training and compliance-ready reporting.
That is EUR 12.50 per seat per month at the minimum size, far above Fallax, so SoSafe is a choice for programmes that use the depth of the content and reporting. Enterprise Support, with customer success managers and full implementation, is a separate purchase. Billed annually, the starting commitment is EUR 7,500 a year, so a team well below 50 people would still be buying a 50-seat entry plan.
What SoSafe does well
- SoSafe SE is entered in the Cologne commercial register under HRB 121629
- ISO/IEC 27001:2022 certified and a TISAX participant
- Training in 36 languages, with 40+ lessons in Core and 75+ in Advanced
- A published starting price: EUR 625 per month, billed annually, with 50 seats
- Simulations, training, an AI copilot and human risk reporting in one platform
Where SoSafe falls short
- EUR 12.50 per seat per month at the 50-seat entry is the highest published rate in this comparison
- The security page names no hosting country or cloud provider
- Enterprise Support, with dedicated customer success managers, is a separate purchase
- Larger than a team needing two campaigns a year requires
Standout feature. SoSafe is the one platform in this comparison that combines a commercial-register entity, ISO 27001:2022 and a published entry price.
Leuven, Belgium
Three plans, Core, Advanced and All-in-one, on the pricing page; the amounts are not shown and are given on request
Best for: Companies that want automated, per-employee simulations and a downloadable ISO 27001 certificate
Phished is published by Phished BV at Bondgenotenlaan 138 in Leuven, registered in the Belgian Crossroads Bank of Enterprises under number 0735.908.019. The company says it trains two million users in 7,100 organisations together with more than 400 partners, which points to a channel-led model.
The core idea is automation: simulations are tailored with AI to the organisation, progress with each employee, and run without administrator effort, with gamified microlearning in between. The website is available in English, French, Dutch, Spanish and German, and the legal notice, privacy policy and cookie policy are published on it.
Its distinctive feature is Zero Incident Mail, a secure environment in which a person who clicks a link or submits data is trained inside a contained mail experience.
Advanced adds repeat offender training and user certificates from Bronze to Platinum, and All-in-one adds NIS 2 and GDPR topics, custom training, a Behavioral Risk Score and Power BI reporting. The security page offers the ISO 27001 certificate for download, states hosting by cloud providers in the EU (Google and Microsoft) and lists SOC 2 certified infrastructure.
The pricing page shows the three plans, Core, Advanced and All-in-one, with a currency selector and a request for advice, but no amount in the page text. Multi-factor authentication for the application is optional according to the security page, which a security-minded buyer will want switched on.
Compared with SoSafe, Phished states fewer content and language figures; compared with Hoxhunt it is more automated and reaches fewer channels. The security page also states encryption in transit with TLS 1.2 and 1.3 and at rest with AES-256, logical tenant separation and annually tested disaster recovery.
What Phished does well
- Phished BV is registered in Belgium under enterprise number 0735.908.019
- ISO 27001 certificate available for download on the security page
- Application hosted by cloud providers in the EU, named as Google and Microsoft
- Zero Incident Mail contains clicks inside a secure training environment
- Core plan states compliance with NIS2, NIST, DORA and ISO 27001
Where Phished falls short
- No amount on the pricing page; each plan is quoted on request
- Multi-factor authentication for the application is optional, not enforced
- Runs on Google and Microsoft cloud, which are US providers in EU regions
- Partner-led model, so the buying route may run through a reseller
Standout feature. Phished is the only platform here that trains a person who clicks inside a contained mail environment, called Zero Incident Mail.
Trondheim, Norway
Founded 2017
Priced per user per month by the products chosen; the pricing page calculates a sample for 50 users and ends in a quote, with no amount in the page text
Best for: Organisations with works councils or strict privacy rules that want training without individual tracking
Secure Practice is operated by Secure Practice AS in Trondheim, organisation number 919 420 197, registered in the Norwegian Business Register in August 2017. The CEO is Erlend Andreas Gjaere.
Its toolkit has five parts: PrepJam, interactive incident exercises that teams play together; MailRisk, which analyses suspicious emails people report and sends feedback; gamified e-learning; simulated phishing with follow-up loops; and Human Risk Metrics for team-level insight. The company says its mission is to help millions of people develop their cybersecurity abilities and knowledge and become more confident in using them.
Privacy is the product's pitch. The trust page says learning is personalised from anonymised behaviour data and that individual actions can never be tied back to a particular person, and that the company took part in the Norwegian Data Protection Authority regulatory sandbox for responsible AI.
Cloud servers are in the EU/EEA (Norway), and ISO/IEC 27001 compliance documentation is offered. Azure cognitive services run in private mode, so a US cloud provider is still involved. The trust page also says a data protection impact assessment is available to customers on request, and the regulator published a public version of the final sandbox report.
That design is a strength for a works council and a weakness for an auditor who needs a named record per employee, a point on which Fallax takes the opposite view.
The pricing page computes a sample for 50 users by selected products but shows no amount in the page text, and the vendor asks for a quote. The site is available in 17 languages; the lesson library size is not stated on the pages read. The pages read do not state how many lessons the e-learning library holds.
What Secure Practice does well
- Secure Practice AS is confirmed in the Norwegian Business Register, organisation number 919 420 197
- Cloud servers in the EU/EEA (Norway), stated on the trust page
- Individual actions are not tied to a named person, by design
- PrepJam adds live incident exercises that other platforms here do not list
- Took part in the Norwegian Data Protection Authority AI sandbox
Where Secure Practice falls short
- No per-person record, which a compliance auditor may expect
- No amount in the page text; a quote is requested
- ISO 27001 is stated as compliance documentation, not as a named certificate
- Azure services are used for AI features, even if in private mode
Standout feature. Secure Practice is built so that no individual employee can be singled out in the data, and it took part in a data protection authority sandbox to prove it.
Helsinki, Finland
Founded 2016
Per employee, quoted after a 30-minute scoping call; the quote depends on the number of employees and the capabilities needed
Best for: Security teams with capacity that want adaptive training across email, SMS, calls and Teams
Hoxhunt is operated by Hoxhunt Oy at Porkkalankatu 3 in Helsinki, business ID 2758722-7, registered in April 2016 in the Finnish register. The site also lists a German imprint for Hoxhunt GmbH in the Dusseldorf register, and offices in Minneapolis and Singapore. Hoxhunt says it serves 3 million users worldwide, runs 7 million simulations a month and supports more than 40 languages. Its products are security awareness training, adaptive phishing training, email incident response automation and a behaviour risk console.
The adaptive idea is that each person receives simulations personalised by department and location, with instant micro-training after a failure. Simulations run across email, SMS, phone calls or Teams, and employees can report a suspicious message, which Hoxhunt then analyses.
The security page lists SOC 2 Type II and SOC 3 reports, GDPR and CCPA, and does not name a hosting location, so the data processing agreement is where to ask. Hoxhunt pairs this with automated phishing analysis and instant feedback for reported messages, so reporting becomes part of the training instead of an afterthought.
Hoxhunt says its price is per employee and quoted after a 30-minute scoping call, so there is no amount to compare. It is a heavier platform than a phishing simulator, and more of a programme than a campaign tool.
A company that needs a record for a first audit will find it more than it needs; a security team that wants to measure reporting behaviour over time will find the depth useful. Compared with Phished it reaches more channels, and compared with CybSafe it leans on simulations more than on nudges.
What Hoxhunt does well
- Hoxhunt Oy is confirmed in the Finnish register under business ID 2758722-7
- Simulations across email, SMS, phone calls and Teams
- SOC 2 Type II and SOC 3 reports listed on the security page
- Supports more than 40 languages and personalises by department and location
- Email incident response automation analyses reported messages
Where Hoxhunt falls short
- No amount; a quote follows a 30-minute scoping call
- No hosting location or provider named on the pages read
- Has a US office in Minneapolis and lists CCPA alongside GDPR
- More platform than a team that needs only simulations and evidence
Standout feature. Hoxhunt is the only platform here that describes simulations reaching people over email, SMS, phone calls and Teams in one adaptive programme.
London, United Kingdom
Founded 2015
No amount found on the pages read; the site routes to a demo
Best for: Security teams that want to measure behaviour, not completion rates, and keep data in London
CybSafe is operated by CybSafe Limited, registered in England and Wales under company number 09642350 with its registered office at 5 New Street Square in London, and a main trading address at One Canada Square.
Companies House shows it as incorporated on 16 June 2015 and held 75 percent or more by CybSafe Holdings Limited, itself a UK company. The platform has four products: GUIDE for personalised guidance, PHISH for simulations, RESPOND for no-code automation and SIGNAL, an AI layer for programme owners.
The approach is behavioural. CybSafe says it maps more than 100 behaviours to NIST CSF and MITRE ATT&CK and delivers nudges in Teams, Slack and email at the moment a risky action happens.
Its own results come from randomised controlled trials across 22,000 people, a claim that comes from the vendor and has not been independently checked here. The trust centre lists ISO 27001 and Cyber Essentials Plus, and production data is in the London AWS region. The trust centre also states AES-256 at rest and TLS 1.2 or higher in transit, with keys held in the AWS Key Management Service and rotated annually.
The service suits a security team that wants evidence of behaviour change and has the tooling to feed it, since signals come from the stack around the platform.
A company that wants a lesson catalogue and a monthly campaign will find it unusual. No amount was found on the pages read, and the /pricing address on its site returned a not-found page. As a British company it sits outside the EU and EEA, which matters only if your buyer requires a contracting party inside them.
What CybSafe does well
- Registered in England and Wales as company 09642350, with a UK parent holding company
- Production data stored in the London AWS region, with backups and retention stated
- ISO 27001 and Cyber Essentials Plus listed in the trust centre
- Nudges delivered in Teams, Slack and email where people already work
- Maps more than 100 behaviours to NIST CSF and MITRE ATT&CK
Where CybSafe falls short
- United Kingdom, outside the EU and EEA
- No amount found on the pages read; a demo is the route in
- Runs on AWS, a US cloud provider, although in the London region
- Trial results are the vendor's own and were not independently checked
Standout feature. CybSafe is the platform here most explicitly built around measuring behaviour change instead of completion and click rates.
London, United Kingdom
Founded 2017
Four plans, Essentials, Plus, 360 and Enterprise, with a currency selector for USD, EUR and GBP; the amounts are rendered by script and are not in the page text
Best for: Teams that want many simulation channels and phishing incident response in one platform
Keepnet is operated by Keepnet Labs Ltd, company number 11047987 at Companies House, registered at 124 City Road in London and incorporated in November 2017.
Its end user licence calls it a United Kingdom corporation, and its privacy policy refers to Keepnet, Inc. among the Keepnet brands, so an American affiliate exists. The founder, Ozan Ucar, set it up in London, according to the company's own history. A single individual holds 75 percent or more of the shares at Companies House.
The platform is the widest in channel coverage: email phishing, smishing, vishing with AI-driven interactive calls, quishing for QR codes and callback phishing, plus a phishing incident response product that speeds analysis of reported mail, threat sharing and an email threat simulator.
Agentic AI that creates simulations and training is an optional add-on. The vendor also states 10 pending patents. The company says it began operating in 2017 and serves small and medium businesses, enterprises and MSP or MSSP partners across sectors.
Four plans are listed, Essentials, Plus, 360 and Enterprise, with a currency selector for USD, EUR and GBP, but the amounts are rendered by script and could not be read, so none is quoted here.
The page text says security awareness training is typically priced per user per year. Keepnet is a better fit for a security operations team than for an office manager, and it names no hosting location or certification on the pages read, which a buyer should request in writing.
What Keepnet does well
- Keepnet Labs Ltd is registered at Companies House as company 11047987
- Email, SMS, voice, QR code and callback simulations in one platform
- Phishing incident response, threat sharing and threat intelligence products
- Four plans from Essentials to Enterprise, shown with a currency selector
- A single individual holds 75 percent or more of the shares
Where Keepnet falls short
- United Kingdom, outside the EU and EEA, with a Keepnet, Inc. brand named in the privacy policy
- Amounts are rendered by script and could not be verified
- No hosting location or certification named on the pages read
- Wider than a team needing only simulations and training
Standout feature. Keepnet lists the most simulation channels of any platform here: email, SMS, voice, QR code and callback.
Londonderry, United Kingdom
No amount published; pricing is given after a demo
Best for: Organisations that want awareness training, policy management and incident handling in one place
MetaCompliance is operated by MetaCompliance Limited, company NI049166, with its registered office in Londonderry, and a London address in its privacy notice. Companies House shows it as incorporated on 31 December 2003.
Since 31 July 2025 shares of 75 percent or more have been held by Gandalf Bidco Limited, part of a UK holding chain that ends at Gandalf Topco Limited, whose three registered controllers are French individuals resident in France with significant influence or control; the investor behind the chain is not named. The company says it bought Moch in 2022 and opened a Marseille office in 2025.
The platform has four products: automated security awareness with personalised learning, advanced phishing simulation with role-based targeting and instant coaching, compliance management that centralises policy, privacy and incident handling, and risk intelligence with Power BI reporting.
The company states that it is available in more than 44 languages, has trained more than 10 million people and has a 4.6 rating on G2, all of which are its own figures. It also lists a partner programme and says there is always a person available in support, with customer quotes from security, learning and people leaders.
What distinguishes it from a pure training vendor is the compliance module, which handles policy acceptance and incident reports in the same tool as the training. No amount is published, and pricing follows a demo. The pages read name no hosting location or certification, so a buyer should ask for both.
As a Northern Irish company it is outside the EU and EEA, although the Marseille office and the 2022 Moch acquisition point to a continental focus. A buyer should ask what the Gandalf holding structure means for the contract, since Companies House names the holding companies but not the fund behind them.
What MetaCompliance does well
- MetaCompliance Limited is a registered UK company, NI049166, in business since 2003
- More than 44 languages in one platform, by its own account
- Policy, privacy and incident management beside the training
- Power BI integration for audit-ready reports
- Held through a UK holding chain, with no US parent in the register
Where MetaCompliance falls short
- United Kingdom, outside the EU and EEA
- No published amount; pricing follows a demo
- No hosting location or certification named on the pages read
- The investor behind the Gandalf holding companies is not named in the register
Standout feature. MetaCompliance puts policy, privacy and incident management in the same tool as the training, which most platforms here do not.
Manchester, United Kingdom
Founded 2016
All core features in one plan, priced by user volume with monthly or annual billing and savings for longer commitments; no amount is shown and a quote is requested through a form
A trial can be requested before committing
Best for: MSPs and small IT teams that want training, phishing, policies and breach monitoring in one plan
usecure is supplied by usecure Limited, company number 10113345, with its registered office at Holyoake House in Manchester, incorporated in April 2016.
Companies House shows two controlling parties: Kennet VI Master Holdco S.a r.l. of Luxembourg, holding more than 25 and up to 50 percent since June 2025, and an individual. The company says it is trusted by more than 2,000 MSPs and 15,000 organisations, and its pitch is human risk management on autopilot for channel partners and internal IT teams.
The product is modular and named by letter: uLearn for automated, personalised training, uPhish for simulations, uBreach for dark web monitoring, uPolicy for policy management and uHealth for human risk intelligence.
Auto Enrol puts training delivery and reminders on autopilot, Auto Phish adapts campaigns to behaviour, and a custom LMS lets a partner host and brand its own courses. A self-service portal gives end users training, policies and risk insights. The site says most organisations deploy within a day and that setup scales across multiple client tenants.
Pricing is one plan with all core features, quoted by user volume and billing preference, monthly for MSPs, and a trial can be requested. No amount is shown.
The pages read name no hosting location, and the trust site did not load for this check, so the data processing terms are the place to look. For a company that is not an MSP, the partner-first framing means the pricing and the product are shaped for resale, which can suit a single team or can feel like someone else's tool.
What usecure does well
- usecure Limited is a registered UK company, number 10113345, incorporated 2016
- Training, phishing, policy and dark web monitoring modules in one plan
- Built for MSP use with a custom LMS, distributors and monthly billing
- A trial can be requested before committing
- Mapped to ISO 27001, NIS2, DORA, GDPR and other frameworks on its site
Where usecure falls short
- United Kingdom, outside the EU and EEA
- No amount published; a quote form is required
- Partly held by a Luxembourg investment holding company, the ultimate investor unnamed
- No hosting location named on the pages read
Standout feature. usecure is the platform here most clearly shaped for MSPs, with a custom LMS, distributors and monthly billing for partners.
Utrecht, Netherlands
Program plans Shift, Plus, Pro and Next, tiered by organisation size and support level; amounts are given on request
Best for: Dutch-speaking and international organisations that want a culture programme, not only simulations
Awareways B.V. is at Euclideslaan 141 in Utrecht and registered with the Chamber of Commerce under number 56432267, according to its general terms.
It sells programmes rather than licences: the Wave learning platform with more than 85 microlearnings, phishing simulations by email, vishing and smishing, a mystery guest visit, a culture scan, campaigns and games such as an escape room. The company is certified to ISO 9001 and ISO 27001 and states WCAG 2.2 accessibility. Customers quoted on the site include the Dutch public body CIBG, whose information security officer calls the programme the clear frontrunner in a tender five years ago.
Programme plans are called Shift, Plus, Pro and Next, and are tied to a resilience level from Unaware to Resilient.
Shift is the quick start with four phishing rounds and twelve templates, Plus adds a configured Wave programme and SAML single sign-on, and the higher plans add behaviour strategy, a programme manager and an advisory board seat. The pages describe Shift for organisations of more than 25 employees and Plus for more than 150. The Pro plan lists 12 customised microlearnings, and the higher plans add priority care support and early beta access to new content.
The strength is the human side: culture scans, communication kits and a programme manager. The limitation is scale and price transparency: no amount is shown, the website is strongest in Dutch and English, and the pages read name no hosting location. Compared with SoSafe it is closer to a consultancy with software, and compared with Fallax it is a long way from a self-service tool. The vendor states that all plans meet GDPR, NIS2, ISO27001, DORA and the AI Act.
What Awareways does well
- Awareways B.V. is registered in the Netherlands under Chamber of Commerce number 56432267
- ISO 9001 and ISO 27001 certified
- Culture scan, campaigns and games beside the training and simulations
- Phishing, vishing, smishing and a mystery guest visit
- A programme manager and advisory seat on the higher plans
Where Awareways falls short
- No amount shown; programme plans are quoted
- Plans are tied to organisation size and a service model, not self-service
- No hosting location named on the pages read
- Focused on Dutch and English, with extra languages as an add-on
Standout feature. Awareways is the only platform here that measures an organisation on a resilience scale from Level 0 to Level 5 and sells programmes to match each level.
Orleans, France
Founded 2020
Based mainly on the number of employees trained or assessed; a quote is requested through the pricing page
Best for: Security teams that want realistic voice, SMS and deepfake simulations beside phishing
Arsen is a French simplified joint-stock company (SAS) with share capital of EUR 16,500, registered at the Orleans trade register under number 881 923 775.
Its legal notice gives a registered office in Paris at 34 rue Richer, while the French register lists the seat at a business centre in Orleans. The publication director is Alexandre Esser. The company says more than 1,000 organisations use it, and its own focus is social engineering rather than a general training library. The legal notice gives a Paris postal address for data subject requests.
The simulations are its centre: realistic phishing and spear phishing, BEC scenarios, QR code attacks, smishing, an AI voice vishing simulator that uses real-time voice and voice cloning, and deepfake CEO fraud videos. There is also a phishing API that other security products can integrate.
Cyber awareness training is described as learn-by-doing simulations that build reflexes, rather than a catalogue of courses. The site is in English and French. The company also offers a free AI voice phishing playground, SPF, DKIM and DMARC checks, a QR code phishing test and a phishing policy generator.
Arsen states that its prices depend on the number of employees to be trained or assessed, and a quote is requested through the pricing page.
The pages read name no hosting location and no certification, and the privacy policy lists hosting and office suite providers among its subcontractors and names Microsoft. For a team that wants sophisticated attack simulation, especially voice, it is among the more specialised options here. For a team that wants lessons and a compliance record, SoSafe or Awareways fit better.
What Arsen does well
- Arsen is confirmed in the French register under SIREN 881923775
- AI voice vishing, smishing, QR code and deepfake CEO fraud simulations
- A phishing API for integration into other security tools
- Simulation-first approach, which suits red-team style testing
- English and French interface
Where Arsen falls short
- No amount; the quote depends on the number of employees
- No hosting location or certification named on the pages read
- Legal notice names a Paris office while the register lists Orleans
- Less of a lesson library than SoSafe, Phished or MetaCompliance
Standout feature. Arsen simulates voice attacks with real-time AI voice and voice cloning, a scenario most platforms here cover only lightly or not at all.
Verrebroek, Belgium
The first 10 seats are free; seats 11 to 100 are EUR 1.00 each, seats 101 to 250 EUR 0.80, seats 251 to 1,000 EUR 0.60 and seats 1,001 and above EUR 0.40; at 50 people EUR 40 per month or EUR 480 for a year billed once; no tiers, every account gets the whole product
10 seats are free permanently, with no card and no trial clock
Best for: Small and growing teams that need cheap, audit-ready simulations inside Google Workspace or Microsoft 365
Fallax is a phishing simulation and awareness platform from Ghent, operated by Blink Technologies CommV at Rijkstraat 55 in Verrebroek, Belgium, enterprise number 1018.579.875, registered with the RPR Gent, division Dendermonde. Its terms are governed by Belgian law with the courts of Brussels.
Simulations are injected inside the customer own Google Workspace or Microsoft 365 tenant, so no sending domain, DNS record or allowlisting is needed and the message does not travel over the public email system. The privacy notice says credential values entered on a simulated login page are never stored, only that a submission happened and which field names were present.
Each person follows their own schedule, adjusted by their last result, from every two weeks to every eight.
People who click are trained at that moment, people who report are thanked with points and a streak, and the lure library is ranked by the apps the tenant uses. The evidence export has a timestamped row per person and syncs continuously to Vanta, Drata, Secureframe and Sprinto, mapped to ISO 27001, SOC 2, NIS2, DORA, PCI DSS, HIPAA and GDPR. A blocked or undelivered message is never counted as training.
The first 10 seats are free permanently with the full product; seats 11 to 100 cost EUR 1.00 each, falling to EUR 0.40 above 1,000. The scope is narrower than the large suites: the pages read describe email simulations and click-time training, not a broad lesson catalogue, voice or SMS channels.
Customer data is stored in the EU, with Cloudflare, Resend, PostHog, Featurebase and Stripe as sub-processors, and it needs a Google or Microsoft tenant. Admins and people who only read reports are not counted as seats, and an 80 percent discount for 12 months exists for qualifying startups under 100 people.
What Fallax does well
- Blink Technologies CommV is a Belgian company with an enterprise number, under Belgian law
- The first 10 seats are free permanently, with the whole product and no card
- EUR 1.00 per seat for seats 11 to 100, with each rate applying only inside its bracket
- Simulations delivered inside the Google Workspace or Microsoft 365 tenant, with no DNS work
- A timestamped per-person evidence export that syncs to four compliance platforms
Where Fallax falls short
- Needs Google Workspace or Microsoft 365; other mail systems are not covered
- The pages read describe email simulations only, not SMS or voice
- No broad lesson catalogue is described; training happens at the moment of a click
- No certification named on the pages read
Standout feature. Fallax is the only platform here that publishes a full per-seat rate card with permanently free first seats and a per-person export for the compliance platform.
